Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

231–240 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#231

Post by Telemakhos »

compootr wrote: post #7

Reading the commentary, this guy seems unhinged. He thinks he owns literal hex codes he sucks at tech and has driven away everyone good at it. I don't use his software, but I hope he gets out of this episode soon (and learns he didn't invent material!)

Someone else described him as a lunatic. But, this is a security issue, and you shouldn't assume that someone who is successfully putting malicious code into developers' IDEs around the world is unhinged or a lunatic, but rather cunning and deceptive (or a front for an intelligence agency). It's not paranoid to have such suspicions about someone who is getting malicious code into developers' tools.

Re: Material Theme has been pulled from VS Code's marketplace

#232

Post by cratermoon »

BigParm wrote: post #141
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Imagine the amount of infected packages we use every day. Probably 20 different governments see everything we do.

why worry about governments so much? You know how many different companies see everything you do? Do you trust all of them?

https://www.wired.com/story/gravy-location-data-app-leak-rtb...

Re: Material Theme has been pulled from VS Code's marketplace

#233

Post by xyst »

yukIttEft wrote: post #107
isidorn wrote: post #90

Earlier quoted context omitted.

This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116 We do not plan to add a permission model in the next 6 months.

> We do not plan to add a permission model in the next 6 months. I guess Copilot functionality trumps "Security above all else" now. https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...

[flagged]

Re: Material Theme has been pulled from VS Code's marketplace

#234

Post by not_wyoming »

dark-star wrote: post #108
bagels wrote: post #103

Earlier quoted context omitted.

This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?

It's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems

Are you contending that's what happened here? This is not a leading question, I genuinely do not know and am trying to learn more.

Re: Material Theme has been pulled from VS Code's marketplace

#235

Post by mmcnickle »

esperent wrote: post #210
Cthulhu_ wrote: post #180

Earlier quoted context omitted.

Many English speaking countries, I'm sure the US is more the exception than the rule in this case. Of course, 'git' is also an insult.

Git is a fairly mild insult though, roughly equivalent to calling someone annoying. I'm sure at least a few of us have thought Git (the tool) to be aptly named, from time to time.

Linus once quipped "I'm an egotistical bastard, and I name all my projects after myself. First 'Linux', now 'git'."

Re: Material Theme has been pulled from VS Code's marketplace

#236

Post by cratermoon »

bad_user wrote: post #77
weinzierl wrote: post #50

Earlier quoted context omitted.

"What's wrong is the bait and switch,[..]" Morally wrong, legally not so much. If it is under a permissive license (and it was MIT originally as others have pointed out) you can always cut a proprietary version. That doesn't take away the right to use the permissively licensed code of course.

> Morally wrong, legally not so much Of course, but then, the legality of it is irrelevant. Free markets work because consumers can exercise their freedom to choose, and in such instances it's easy, given that the reason for why many such projects see wide adoption is their FOSS nature.

Just a reminder: https://bitworking.org/news/2008/01/the-free-market-fairy/

Re: Material Theme has been pulled from VS Code's marketplace

#237

Post by evgen »

cratermoon wrote: post #228
memsom wrote: post #225

Earlier quoted context omitted.

It's pretty mild, but still offensive in the UK. Your friend was right to believe that much. That everyone thinks it means that? No - the US uses it differently for a region of the body slightly less offensive. It's a bit like spunk, which is also fairly offensive in the UK, and fag, which despite having an offensive meaning in the US, is actually traditionally not offensive here, though the US meaning is known and s…

Remember when fanny packs were a thing?

Did you mean a bum bag?

Re: Material Theme has been pulled from VS Code's marketplace

#238

Post by [deleted] »

darkwater wrote: post #189
stef25 wrote: post #178

Earlier quoted context omitted.

Correct, the author links to it from his github page https://github.com/equinusocio

So, this is pretty weird no? In his GH profile he links his website/portfolio https://astorinomattia.com/ which is actually his surname + name. It doesn't seem to be pretty smart and safe going rogue with such public exposure no? Unless it is a completely fake persona, of course.

[deleted]

Re: Material Theme has been pulled from VS Code's marketplace

#239

Post by kevlened »

mannotcool wrote: post #216

I found the malicious javascript (messages.js) file and put it in a Pastebin for anyone to analyze https://pastebin.com/yY1X0LiD obviously its obfuscated by the guy originally

This code is harmless. We may need a copy of the actual, shipped extension from vscode.

https://pastebin.com/T998ZstM

Re: Material Theme has been pulled from VS Code's marketplace

#240

Post by Narishma »

Cthulhu_ wrote: post #198
TZubiri wrote: post #130

One of the things I love about the internet is learning how different people can be, I perceive it as different than me but I assume everyone has their quirks. In this case, this is one of the most extreme instances of people installing lots of dependencies. The moment I realized something was different in me was left pad, I already felt that couldn't be me. The log4j incident hit me different, it COULD have easily b…

A theme is fine - Google has been pushing Material for a while now, after all, so if you come from Google land the colours are familiar and preferred to you, same with themes like Solarized and whatnot. That said, I do agree that dependency management and reliance is a Problem these days. left-pad was the camel that broke the proverbial camel's back for many people, and it made people realise how ridiculous dependenc…

The same thing is happening in Rust. Try to compile any random app and it pulls dozens if not hundreds of dependencies.
Post reply on HN