191–200 of 424 posts
Earlier quoted context omitted.
> The young new mom who pretends to love her children is speeding on the road like an idiot. If everyone is crazy on the road, it's best to reduce the exposure to the road. Speeding decreases time spent on the road. Speeding on the road is genius, not stupid.
Well, no, because speeding increases the energy of potential collisions, and also encourages others to speed. If you have to drive more than once, "speeding" isn't necessarily a dominant strategy.
Earlier quoted context omitted.
> The log4j incident hit me different, it COULD have easily been me. That couldn't be me, because I don't use Java, PHP, Windows APIs, or `xdg-open`. The closest I come to Java-esque "include ALL THE BATTERIES" is the occasional Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)
> (Incidentally, I don't get very much done.) Lol, that's definitely part of the tradeoff of security in life. > I don't use Java I didn't use Java either, but whatever I was using at the moment (Python) could have been anything, if I stayed in my other job or gotten a different one I could very well been using Java and been the one that installed the thing. >Python script, but I won't use `http.server`. (Incidentall…
Not getting very much done isn't because I practice secure software development. It's easy to write secure software that works. I don't get much done because I try to find new ways to write secure software: experimentation and tool-building takes up a lot of my time, when I should really be writing hacks, documenting them, and moving on.
Never roll your own crypto, unless you understand systems programming on that platform/arch very well: modern systems have all the side-channels, and take great pains to subvert your attempts to mitigate them.
Earlier quoted context omitted.
Will Microsoft consider adding a permission model for extensions?
There will never be some permission model. Like in VBA there is after all this years nothing. VBA would be much less problematic if you could restrict VBA to just one Excel sheet or so
In VS Code linux is very annoying the message that appears as a notification "We have uninstalled..." I try to remove the extension and after a few seconds it appears again and again. I think I have to use another IDE for today, fix this guys. PLS
Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...
Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
Will Microsoft consider adding a permission model for extensions?
The only sane way to contain the blast radius is to run is to run code-server in a container (or in a VM) and use it through a browser tab.
Luckily, the UI works perfectly, hotkeys and everything. They did an awesome work there.
One of the things I love about the internet is learning how different people can be, I perceive it as different than me but I assume everyone has their quirks. In this case, this is one of the most extreme instances of people installing lots of dependencies. The moment I realized something was different in me was left pad, I already felt that couldn't be me. The log4j incident hit me different, it COULD have easily b…
That said, I do agree that dependency management and reliance is a Problem these days. left-pad was the camel that broke the proverbial camel's back for many people, and it made people realise how ridiculous dependencies in at least NodeJS land has become. It was already silly in Java land since the 2000s, but more from the layers of abstraction and overhead that frameworks like Spring add (which is ironic because Spring was originally conceived to be a lightweight alternative to J2EE, but that's a thread on its own).
I know the general community atmosphere in the Go ecosystem is adverse to adding dependencies and frameworks; it has a good standard library which was complete enough and which isn't yet fully bogged down by design by committee like Java and JS were (to their credit things are moving again), and its users are like "you know, plain Go is good enough", so they are much less likely to add frameworks or DSLs like assertion libraries.
I'd like to know if the same thing is happening in the Rust ecosystem, I've never ventured there before.
Earlier quoted context omitted.
This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?
It's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems
Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
[flagged]