Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

171–180 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#171

Post by galagladi »

isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...

Re: Material Theme has been pulled from VS Code's marketplace

#172

Post by TZubiri »

wizzwizz4 wrote: post #163
TZubiri wrote: post #130

One of the things I love about the internet is learning how different people can be, I perceive it as different than me but I assume everyone has their quirks. In this case, this is one of the most extreme instances of people installing lots of dependencies. The moment I realized something was different in me was left pad, I already felt that couldn't be me. The log4j incident hit me different, it COULD have easily b…

> The log4j incident hit me different, it COULD have easily been me. That couldn't be me, because I don't use Java, PHP, Windows APIs, or `xdg-open`. The closest I come to Java-esque "include ALL THE BATTERIES" is the occasional Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)

> (Incidentally, I don't get very much done.) Lol, that's definitely part of the tradeoff of security in life.

> I don't use Java I didn't use Java either, but whatever I was using at the moment (Python) could have been anything, if I stayed in my other job or gotten a different one I could very well been using Java and been the one that installed the thing.

>Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)

Interesting, I use http.server or the Tcp socket server thing, but I consider myself to be in the extreme, there's still people that use Flask (and I do partake ocasionally) or things like Django, Spring, Next,etc... Same with binaries like Apache, Nginx.

I mean you gotta use something, and if you go too far on the deep end, you get the risk of introducing the vulnerabilities yourself, (in addition to the risk of getting nothing done as you mentioned). I know my limits I wouldn't implement cryptography for example.

Re: Material Theme has been pulled from VS Code's marketplace

#174

Post by [deleted] »

theobr wrote: post #109

Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…

[deleted]

Re: Material Theme has been pulled from VS Code's marketplace

#175

Post by preommr »

galagladi wrote: post #171
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...

Is this a troll name? Fanny is a faily well-known slang term[0]

[0] https://en.wikipedia.org/wiki/Fanny#In_slang

Re: Material Theme has been pulled from VS Code's marketplace

#176

Post by skydhash »

diggan wrote: post #165
oneeyedpigeon wrote: post #125

Earlier quoted context omitted.

People used to pay for ringtones. People pay for all sorts of things that might seem weird to you because people have different tastes.

Heck, iPhone users AFAIK still can't just put their own .wav as a ringtone and need to pay Apple to use songs/sounds as ringtone.

I don’t remmener the exact steps, but it was fairly easy. You just need a mac (which you can borrow) and an audio editor. But that’s been a few years as I’ve been using the same one for a while now.

Re: Material Theme has been pulled from VS Code's marketplace

#177

Post by napolux »

preommr wrote: post #175
galagladi wrote: post #171

Earlier quoted context omitted.

They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...

Is this a troll name? Fanny is a faily well-known slang term[0] [0] https://en.wikipedia.org/wiki/Fanny#In_slang

only in UK IIRC

Re: Material Theme has been pulled from VS Code's marketplace

#178

Post by stef25 »

galagladi wrote: post #171
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...

Correct, the author links to it from his github page https://github.com/equinusocio

Re: Material Theme has been pulled from VS Code's marketplace

#179

Post by thatgerhard »

theobr wrote: post #109

Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…

thank you!

Re: Material Theme has been pulled from VS Code's marketplace

#180

Post by Cthulhu_ »

napolux wrote: post #177
preommr wrote: post #175

Earlier quoted context omitted.

Is this a troll name? Fanny is a faily well-known slang term[0] [0] https://en.wikipedia.org/wiki/Fanny#In_slang

only in UK IIRC

Many English speaking countries, I'm sure the US is more the exception than the rule in this case.

Of course, 'git' is also an insult.

Post reply on HN