121–130 of 424 posts
Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
[flagged]
Earlier quoted context omitted.
This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?
It's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems
Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
[flagged]
Earlier quoted context omitted.
This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?
It's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems
Nobody is gonna pay for a VSCode theme.
Earlier quoted context omitted.
Can you please clarify whether the fork also suffers from the same security issues (or engage the fork's owner to ensure that it doesn't https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you )
Hi, owner of the fork here. I did a thorough combing of the code base when I forked. Just did another audit and still not seeing anything suspicious. Gutting all of the opencollective and changelog code to be 1000% sure.
You could instead "append" your name to the copyright notice though, which is legal.
https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you/c...
Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
[flagged]
Earlier quoted context omitted.
This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?
It's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems
In this case, this is one of the most extreme instances of people installing lots of dependencies. The moment I realized something was different in me was left pad, I already felt that couldn't be me.
The log4j incident hit me different, it COULD have easily been me. A security vulnerability is like death or a terminal illness in my eyes. Successful companies that scale do so without incidents, If you are running a company and you have a vuln you are out of the race. So I tightened up a lot after that.
I realize something similar with sex I just can't fathom putting my whole life on the line just to have sex with somebody and then have nothing to show for it, no relationship, nothing.
And today we see this, people are really risking their companies, their reputation, their pride to have pretty colors on their IDE.
I used to fight it, try to convince people, of course I still keep the pride of being different and weary, but in the end, you will likely be fine, and I only hold a statistical advantage, both are valid strategies of going about life I guess.