Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

311–320 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#311

Post by aa-jv »

camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

>The security model

I just don't use VSCode and I discourage its use in any environment in which I have to work. It has already been demonstrated that it is a major security hole - not just through the public extensions, but also in terms of the telemetry data transmitted back to Microsoft in order that they can invest millions in it and yet charge nothing for it...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#312

Post by aa-jv »

hungryhobbit wrote: post #126
pamcake wrote: post #112

Earlier quoted context omitted.

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them. Migrate off vscode already.

I won't say "you can take my VS Code from cold dead hands" or anything, but it is a very good tool, and Microsoft hasn't yet fucked it up the way they have so many other things. I guess I'd say "you take my VS Code ... willingly ... but only after M$ fucks it up and makes me not want it anymore (like they've done to everything else they acquired)".

>Microsoft hasn't yet fucked it up

I beg to differ. Have you inspected its network traffic?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#313

Post by aa-jv »

kristiandupont wrote: post #251
loloquwowndueo wrote: post #148

Earlier quoted context omitted.

Vs code is a weapon, designed to fracture. It being “good” is a weapon as well. https://ghuntley.com/fracture/

That seems like a very, very long-winded way of accusing them of "embrace, extend, extinguish"? Which is obviously not falsifiable, but just feels a bit trite at this point, IMO.

Its trite until you have to explain to your boss why your editor brought down the business.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#314

Post by aa-jv »

stephenr wrote: post #163
Gigachad wrote: post #139

Earlier quoted context omitted.

The problem is not VS code itself. It's the fact extensions can access things outside of the editor. As far as I am aware, no editor sandboxes extensions.

Part of the problem is that people are adding a metric fuck ton of extensions onto a text editor trying to make it into an IDE. If you start with an IDE first you likely need far fewer extensions.

How about just don't become dependent on an IDE and don't use technologies which require that dependency...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#315

Post by camkego »

Balinares wrote: post #277
camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

Wait, how do you arrive at the thought that Zed is more secure? The one time I gave it a try, it tried to silently run npm -- yes, THIS[1] npm -- in the background without telling me, and I noped the heck out. Did I miss something? [1] https://www.reddit.com/r/programming/comments/1tapmvi/mass_n...

Maybe I am wrong about this, but I think Zed will run the npm stuff on the dev-container if you are using dev-containers. That can be your isolated virtual machine image or docker instances. But I believe you do need to use Zed (stdio or ssh) dev containers to get that security isolation. I know it’s a pain, but for me, I am going to pay the logistics price for security until a better solution comes along.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#316

Post by seanieb »

21asdffdsa12 wrote: post #307
danpalmer wrote: post #256

Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.

Because centralized management of resources is the death of innovation, intrinsic motivation and speed? The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task. The security tax and speeding tickets on everything are a luxury destroying much value.

Your company getting hacked because of random plugins for emerging or dysfunctional ecosystems that don’t have enterprise management solutions yet is worth it to avoid friction?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#317

Post by panchtatvam »

notnullorvoid wrote: post #45

I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.

Sure. Microsoft will spin up a "SuPeR AI AgEnT" that will "fix" the issue. As an added benefit, it will officially promote Edge and Win 11 ( or K2 )

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#318

Post by stephenr »

aa-jv wrote: post #314
stephenr wrote: post #163

Earlier quoted context omitted.

Part of the problem is that people are adding a metric fuck ton of extensions onto a text editor trying to make it into an IDE. If you start with an IDE first you likely need far fewer extensions.

How about just don't become dependent on an IDE and don't use technologies which require that dependency...

Good point. Any editor is a needless dependency.

True developers just scream at the universe and it responds with cosmic radiation that flips the correct bits to form the binary code they intended.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#319

Post by gabrielgio »

21asdffdsa12 wrote: post #307
danpalmer wrote: post #256

Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.

Because centralized management of resources is the death of innovation, intrinsic motivation and speed? The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task. The security tax and speeding tickets on everything are a luxury destroying much value.

Move fast, break things, get internal repository leaked and lose all the 9s.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#320

Post by raxxorraxor »

miki123211 wrote: post #173
Gigachad wrote: post #138

Earlier quoted context omitted.

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.

Yes, because sandboxing gets us unusable OS like iOS or Android. It isn't a solution. Perhaps the gun nuts are right then. Better be a gun nut than a Google employee, probably.
Post reply on HN