Earlier quoted context omitted.
I was part of an org with more than 15k repos
Damn that's alot. I'm wondering how many engineers handled all that?
GitHub confirms breach of 3,800 repos via malicious VSCode extension
301–310 of 488 posts
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#302Earlier quoted context omitted.
You're assuming they allow it, but it might be against policy.
Fair point, I hadn't considered this, but wouldn't they just disallow it? Like, I use a VSCode fork at work, but the enforced extensions store backend is based on an allowlist and extensions need reviewing to be available there.
Big tech can be suprisingly not locked down!
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#303Earlier quoted context omitted.
You're assuming they allow it, but it might be against policy.
I’m pretty sure there is an policy on their internal wiki saying you shouldn’t do that. Problem is: most employees don’t care to read these. Although I’m sure something like this could have been checked for during commit.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#304Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#305Am I blind or did they never say which extension that was?
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#306I ditched VSCode for Sublime Text long back and don't feel missing anything. If any, my productivity and control over things has only improved.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#307Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.
The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task.
The security tax and speeding tickets on everything are a luxury destroying much value.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#308Earlier quoted context omitted.
How so? Part of what seemed good about Zed was that extensions have explicit permission controls.
2 years ago and still nothing has changed. https://news.ycombinator.com/item?id=40902826
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#309The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…
I'm guessing you're referring to https://coder.com/docs/code-server ?