I don’t like this feature. It’s annoying and I just don’t see the benefits.
Did you read the linked article? I don't like it either, but I can understand the reasoning behind it after reading the post.
Workspace Trust in VS Code
21–25 of 25 posts
Re: Workspace Trust in VS Code
#22Ah, the classic tug of war continues between the principle of least privilege and convenience/productivity. It's safe to say people's opinions are all over the spectrum. Despite favoring "least privilege" myself, I find the new nag screens overbearing. I think some basic UI reworking can help to alleviate that, though. It's a new feature; they'll get it right within a couple of iterations.
There is a third approach, which is both safe and convenient, but unfortunately it's not universal and well supported on modern systems - segregation. The vast majority of applications don't actually need access to your operating system. My entire development environment for each project I work on could run in its own container or even VM and I'd simply connect my interface into it.
Builds, tests and the app itself could easily run inside a container - web apps can simply expose a TCP port and GUI apps can use X forwarding or the platform equivalent. Other programs that need external devices (like a serial connection to an MCU) could have those and only those passed in.
And if we're even more paranoid and worried about code exploiting our editor and tools, the editor could also be just a simple thin client with all the linters, language servers and everything else running in the container. For VS Code, this already exists for cloud development services (Che, etc.).
Re: Workspace Trust in VS Code
#23> Now, I'm sure many of you will agree, VS Code suffers from a bit of what we call "Notification Fatigue" Yup. I love VS Code but the sheer amount of chatty notifications especially when browsing a large code base can be simply overwhelming. I just start reflexively ignoring them. There’s no “just shut up already and let me work” button. I’m glad this is something they are working on improving.
Being verbose isn't bad, but VS Code is actively spammy. "Hey, this extension just updated, want to read the changelog?", "hey, we've added this new feature", "hey, want to star our extensions on github?"... It's like WordPress plugins all over again.
Re: Workspace Trust in VS Code
#24It's usually a bit silly, yes i trust the author of this directory but I have no clue about the authors under node_modules.
Yeah I think people really underestimate how massive of a security liability node modules are in the way the system currently works. Fixing it should really be given top priority, but doesn't look to be a very popular subject when you compare it to some of the others such as whether or not ESLint should become a NodeJS core module ...
NPM is one of the most dangerous implementations, but the whole concept of pulling in thousands of unknown dependencies is dangerous on its own, even in other languages.
Re: Workspace Trust in VS Code
#25Ah, the classic tug of war continues between the principle of least privilege and convenience/productivity. It's safe to say people's opinions are all over the spectrum. Despite favoring "least privilege" myself, I find the new nag screens overbearing. I think some basic UI reworking can help to alleviate that, though. It's a new feature; they'll get it right within a couple of iterations.
There is a third approach, which is both safe and convenient, but unfortunately it's not universal and well supported on modern systems - segregation. The vast majority of applications don't actually need access to your operating system. My entire development environment for each project I work on could run in its own container or even VM and I'd simply connect my interface into it. Builds, tests and the app itself c…
This makes sense. Remote-Containers (without bond-mounted volumes) or Codespaces may help here.