Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Inspected My Take-Home Interview Project. It Was a Whole Operation

citizendot.github.io

Post reply on HN
Print view View original

111–120 of 135 posts

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#111

Post by zeratax »

hyperhello wrote: post #84
CITIZENDOT wrote: post #58

Earlier quoted context omitted.

> I wonder if vscode would still load the script if you click “don’t trust author” It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712 . But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.

Typical. I’m uninstalling VSCode right now. Does it leave any malware behind that can still run things? Probably.

I feel like vscode is doing everything right here and they cant really do much about users choosing to ignore security warnings. Other IDEs here do exactly the same or less. Not saying there isn't room to improve, but again if you're uninstalling vscode what are you going to replace it with?

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#112

Post by zeratax »

kazinator wrote: post #108

> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected. LOL, is that shit being worked on by former Outlook developers, bringing with them their zero click bags of tricks?

vscode explicitly warns you when you open a directory and gives you the choice to open it in restricted mode without all the integrations. it's not zero click at all.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#113

Post by zeratax »

zombot wrote: post #100

The post title really buries the lede. > You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected. The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance. Never open 3rd-party stuff with VSCode.

Okay but this is just not true here. VSCode always first asks you if you trust the author of this code and if not gives you the option to open the directory in restricted mode

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#114

Post by hyperhello »

zeratax wrote: post #111
hyperhello wrote: post #84

Earlier quoted context omitted.

Typical. I’m uninstalling VSCode right now. Does it leave any malware behind that can still run things? Probably.

I feel like vscode is doing everything right here and they cant really do much about users choosing to ignore security warnings. Other IDEs here do exactly the same or less. Not saying there isn't room to improve, but again if you're uninstalling vscode what are you going to replace it with?

Hiding malicious behavior behind security warnings you can only click yes or no to is the Microsoft way of neatly denying responsibility, and it compounds and reinforces itself. This pdf looks like a pdf, acts like a pdf, opens like a pdf, what are you going to do? You clicked OK so you wanted that Outlook virus to email itself to everyone on your address book and send their bitcoin to Madagascar, not Microsoft.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#115

Post by sph »

andOlga wrote: post #105
sph wrote: post #99

Ok, how do I disable git hooks unless it’s in a manually blessed directory?

git config --global core.hooksPath /dev/null Then, in repos you want to turn it on: git config core.hooksPath "$PWD/.git/hooks" This also works on Windows (and presumably other operating systems where /dev/null does not exist) as it seems to be handled as a special-case value.

I would have liked for git to ask me first (like direnv does), rather than disabling them altogether, but this is good enough for now, so thanks.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#116

Post by ErroneousBosh »

I don't understand why you'd just clone a random repo that someone tells you to like that.

If you want to hire me, I do not want to see your code until I see money from you.

I do not want your code on my computer until there is a contract and quite a lot of money in my account. Even then, I'd prefer you to keep your code on your computers, which I will connect to.

For a "take-home interview"? You want me to work for you for free? Nah. Pay me.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#117

Post by Scaled »

CITIZENDOT wrote: post #58
syntaxing wrote: post #52

That was a fun read, I wonder if vscode would still load the script if you click “don’t trust author”? That being said, can you embed something yourself and push the commit?

> I wonder if vscode would still load the script if you click “don’t trust author” It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712 . But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.

Yeah, I had no idea Microsoft thinks trust means auto run immediately a script. I always just thought it was something more pedestrian, like restricting debug launch links or something. I will probably not use vs code at all for untrusted repos now.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#118

Post by HackerThemAll »

Why isn't there a tool that would check those dangerous places, such as git hooks, VSCode and Claude commands that launch automatically, and warn the user of consequences, showing the hook code, allowing to allowlist this single repo if the user deem it secure? I'd say it should be a job of AV/EDR/XDR easily... Or a dedicated software with a highly protected service, and a tray/UI part.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#119

Post by BrokenCogs »

anal_reactor wrote: post #98
IvanGoncharov wrote: post #56

Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…

It's so weird to me that I'm on same social media as people worthy of targeted attacks. Like, I'm a total nobody, all I get is "Free Spins For You!" and "I am a dying German billionaire...". My favorite email had a subject "Sorry I broke your vagina".

What are you expecting with a name like anal_reactor?

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#120

Post by manarth »

lathiat wrote: post #67
IvanGoncharov wrote: post #56

Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…

Yikes. Going to need containerised vscode in this world.

Kind-of exists with VSCode Remote, although for stricter isolation you'd want VSCode Server via a web-browser.
Post reply on HN