181–190 of 424 posts
Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
Earlier quoted context omitted.
> We do not plan to add a permission model in the next 6 months. I guess Copilot functionality trumps "Security above all else" now. https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...
Yeah, the vscode release notes used to be lists of interesting new things and novel improvements. Now they are all “copilot” “features”.
AI features is one of the bigger innovations in editors in years, I fully understand the enthusiasm, especially given it can be linked to an earnings model. That said, before AI stuff I would've expected them to push integration with Github and Azure more.
Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...
Earlier quoted context omitted.
This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?
It's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems
Society as a whole could easily avoid this by funding open source/free utilities to the point where malware makers need to spend significant cash to outbid yearly community support, but unfortunately maintaining anything available online for free is a thankless job that barely covers the electricity required to maintain the code.
In this case too, the developers behind the theme seemed to want to monetise their work, which had attained almost 4 million installs, in the past, but found themselves with a rather unwilling customer base. I don't know if they snapped and uploaded something malicious or if they're intentionally making it hard for forks to copy their work, but either way the lesson learned is that if you want to make money you should just abandon your free projects and start something else.
Earlier quoted context omitted.
Heck, iPhone users AFAIK still can't just put their own .wav as a ringtone and need to pay Apple to use songs/sounds as ringtone.
I don’t remmener the exact steps, but it was fairly easy. You just need a mac (which you can borrow) and an audio editor. But that’s been a few years as I’ve been using the same one for a while now.
Yeah, so only-iPhone users are out of luck since the majority of people don't have a Mac. Last time I used Android you needed the file and the phone itself, you select the audio file and you're done.
Earlier quoted context omitted.
They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...
Thank you. We will security audit this extension today and take action if needed.
Earlier quoted context omitted.
To me it seems ridiculous, that a theme could even accumulate such things as analytics and even lots of dependencies. A theme is usually something self-contained. And even more ridiculous, that anyone can, as you write, "force uninstall" anything from my machine. So glad I am not a VS Code user. It seems all the typical corporate BS is happening with its marketplace and plugins.
If one can "force uninstall" for safety, then it implies that automatic upgrading an extension with the user's consent is unsafe at the first place.
Another creator gone off the deep end apparently? > reading the review responses by the creator, I don't really trust it anymore. Being rude to others who are concerned over the recent move to closed-source (and without warning!) is pretty disheartening. > So, uh, the guy who made the VS Code Material Theme is threatening everyone who uses it in their products. He seems to have forgotten it was originally licensed un…
Question bouncing around in my mind reading this, especially with money involved, is why did this not cross the line into criminal fraud?
Earlier quoted context omitted.
They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...
Correct, the author links to it from his github page https://github.com/equinusocio
It doesn't seem to be pretty smart and safe going rogue with such public exposure no? Unless it is a completely fake persona, of course.
Earlier quoted context omitted.
It’s off topic but I don’t believe most people are functional in society. I think they are hiding their shitty behavior to themselves and to others, and their true self comes out once in a while. They hide it mostly to their family, but other human beings are treated like NPCs. For example I live in the south of France and people are literally crazy on the road but they still avoid accidents by some kind of miracle.…
> The young new mom who pretends to love her children is speeding on the road like an idiot. If everyone is crazy on the road, it's best to reduce the exposure to the road. Speeding decreases time spent on the road. Speeding on the road is genius, not stupid.