In VS Code settings search for "tasks" you will find "Task: Allow Automatic Tasks"...turn it off. Anything else that should be locked down?
Yes, uninstall the whole thing. It's just a Chromium covered with a bunch of JavaScript.
Threat actors expand abuse of Microsoft Visual Studio Code
111–120 of 306 posts
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#112In VS Code settings search for "tasks" you will find "Task: Allow Automatic Tasks"...turn it off. Anything else that should be locked down?
Even if you lock everything now, what if the thing autoupdates with new helpful "features". You can't patch bad development culture.
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#113My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language. However I did not know about tasks.json (I don't use V…
You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#114My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language. However I did not know about tasks.json (I don't use V…
You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.
This is when I say no.
Then copy-paste my default .dev-container directory and reload.
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#115Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.
To myself and many others, vscode is not the defacto answer. JetBrains is. IntelliJ was miles ahead of eclipse last time I checked. Rider is miles ahead of Visual Studio. WebStorm is miles ahead of vscode for js etc.
It's not even a competition, to me. I've had to use Visual Studio instead of Rider for work the past year and it's been a very bad experience.
The biggest difference is JetBrains intellisense feels like it's reading my mind, I'll just type a couple characters and hit tab most of the time. Visual studio on the other hand has the worst intellisense I can imagine. It very frequently just messes up what I'm doing - I'll write what I want correctly, hit space and VS will just change it to something entirely different and import a package while it's at it. It's incredibly annoying. And when I actually want to use auto complete, say for example I've declared a variable on the line above and I want to use it, I'll write a couple characters and then without fail the variable I just declared on the line above is like option 6 down the list behind a bunch of crap that doesn't even make sense in the context at all. And as if it wasn't enough that the IDE is crap when it's working correctly, it very frequently craps out and just stops providing syntax highlighting and such in .razor files, or showing errors in files that compile just fine, forcing me to restart it and delete the .vs folder. Like every day.
Personally I think the only people who prefer other products than JB are people who don't know what they're missing. JB is literally just better in pretty much every way. At least the products I've used. I think I'll turn down the next job that asks me to use VS.
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#116In VS Code settings search for "tasks" you will find "Task: Allow Automatic Tasks"...turn it off. Anything else that should be locked down?
Sounds like autorun on usb drives all over again. They cant learn
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#117In VS Code settings search for "tasks" you will find "Task: Allow Automatic Tasks"...turn it off. Anything else that should be locked down?
On macOS systems, this results in the execution of a background shell command that uses nohup bash -c in combination with curl -s to retrieve a JavaScript payload remotely
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#118Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.
This is so insane to me. Eclipse is... Fine for Java in the sense Visual Studio is for dotnet. But man can they both be slow.
Use case depending sometimes you just need a quick editor, thats why sublime had and probably still has a huge userbase, its fast startup and flexibility. Vim, emacs and derivatives of it are the same story.
I can't imagine ever opening up eclipse to edit a zig/go/js file or project. It's too bloated.
The answer is neovim anyway. That's all anyone needs. /s
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#119Earlier quoted context omitted.
> A million plug-ins > I don't use it because it's so dog slow. You might find it runs better with fewer plugins.
Load time is in seconds, even with the program cached. I can still load vim with a ton of plugins[0] and still load a project in a few hundred milliseconds. Maybe VS Code is faster with fewer plugins but it's still "dog slow" to load and run. Only thing I'm "missing" in vim is the bloat [0] personal I only use a handful but I've played around because why not
>>Load time is in seconds, even with the program cached.
Are you like, for real? How often do you load it up for it to matter in the slightest? Do you not just open the project once at the start of the day and then continue working?
Sorry but for someone used to working in VS proper and projects which take minimum 40 minutes to build, saying that a startup time of a few seconds is a problem is.....just hard to understand.
Re: Threat actors expand abuse of Microsoft Visual Studio Code
#120Earlier quoted context omitted.
> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…
How much ram did you have, and when was this? I remember being extremely happy with Eclipse on an 8GB machine - this was back in the jvm7 days. Heck, I did jvm6 development with Eclipse on Windows XP with 4GB of ram and was content. Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE. For years and years I had people telling…
> Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE.
this is a huge assumption and also ignores the fact that if it's not clear to users, it's a bad design.