Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

271–280 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#271

Post by skyyler »

Thorrez wrote: post #265
skyyler wrote: post #257

Earlier quoted context omitted.

I use Youtube Premium, plus an ad blocker, plus an extension that removes shorts, plus an extension that skips sponsored segments. Soon, I'm going to need an extension that removes the AI stuff I don't want and didn't ask for. Using youtube in 2025 is exhausting.

Does the ad blocker do anything on Youtube since you have premium? It'll of course do things on other sites, but I'm wondering if it has any impact on Youtube.

Yes. It removes ad elements that Google / Youtube don't consider to be ads, like channel stores and that sort of stuff.

Re: Material Theme has been pulled from VS Code's marketplace

#272

Post by Tomte »

maleldil wrote: post #242
Tomte wrote: post #55

Earlier quoted context omitted.

No, it cannot. You can incorporate an MIT licensed work into a work that is licensed differently, but compatibly (not a real problem with MIT), but now you have three works that are under different licenses: the MIT part, the "other" part and the whole. The MIT part stays MIT. Someone can cherry-pick just that file (or file snippet) and use it under MIT, without caring about the license of the whole.

What happens when a file was previously under MIT, the license changes, and a new change is made? Do I need to look at the git blame to find which parts I can use as MIT?

You don't need blame necessarily, just git log. You look at the latest version under your preferred license. That's the one you take your snippets from.

Re: Material Theme has been pulled from VS Code's marketplace

#273

Post by flutas »

filiptronicek wrote: post #160
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

> Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/ Hi Isidor, excited for this! At Open VSX, we'd love to take a look and potentially flag the extension as malicious on our side as well. Are you aware of the version range that the malicious code was included in? I'm asking because https://open-vsx.org does not have any version published since the extension went closed-sou…

The extension file is still available to download directly from MS.[0]

I downloaded the file, and unzipped it, but on a cursory glance I only see obfuscated code nothing malicious.

[0]: !!!WARNING MAY BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...

Re: Material Theme has been pulled from VS Code's marketplace

#274

Post by coffeecantcode »

skyyler wrote: post #257
Thorrez wrote: post #252

Earlier quoted context omitted.

With Youtube at least, you can buy Youtube premium, so you don't have to sit through Youtube ads without needing an ad blocker (though you'll still have to sit through any ads the Youtuber directly adds into the video itself). Disclosure: I work at Google.

I use Youtube Premium, plus an ad blocker, plus an extension that removes shorts, plus an extension that skips sponsored segments. Soon, I'm going to need an extension that removes the AI stuff I don't want and didn't ask for. Using youtube in 2025 is exhausting.

Care to share these extensions?

Re: Material Theme has been pulled from VS Code's marketplace

#275

Post by Bjartr »

Telemakhos wrote: post #231
compootr wrote: post #7

Reading the commentary, this guy seems unhinged. He thinks he owns literal hex codes he sucks at tech and has driven away everyone good at it. I don't use his software, but I hope he gets out of this episode soon (and learns he didn't invent material!)

Someone else described him as a lunatic. But, this is a security issue, and you shouldn't assume that someone who is successfully putting malicious code into developers' IDEs around the world is unhinged or a lunatic, but rather cunning and deceptive (or a front for an intelligence agency). It's not paranoid to have such suspicions about someone who is getting malicious code into developers' tools.

> unhinged or a lunatic, but rather cunning and deceptive

These aren't mutually exclusive.

Re: Material Theme has been pulled from VS Code's marketplace

#277

Post by mightysashiman »

dark-star wrote: post #108
bagels wrote: post #103

Earlier quoted context omitted.

This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?

It's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems

reminds me of mx player on android (nova launcher also?)

Re: Material Theme has been pulled from VS Code's marketplace

#278

Post by Capricorn2481 »

bad_user wrote: post #34
oefrha wrote: post #29

Earlier quoted context omitted.

The original author seemed to talk a lot about funding development/maintenance, so I got curious about what the hell needs to be maintained. I cloned the https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you repo and had a look. Here's a LoC summary: =============================================================================== Language Files Lines Code Comments Blanks ==========================================…

There's nothing wrong with building proprietary software of a couple of thousand lines of code, including themes. And people should be able to ask for money in exchange for their work. What's wrong is the bait and switch, as these projects end up being popular because of their FOSS nature.

> There's nothing wrong with building proprietary software of a couple of thousand lines of code, including themes. And people should be able to ask for money in exchange for their work.

The issue is not someone wanting to be financially rewarded for work, however small. That's completely different from saying you need money to "maintain" what is essentially configuration for colors. That's a deceptive use of that word.

Let's call this what it is: a grifter asked people to pay him for the privilege of hacking them.

Re: Material Theme has been pulled from VS Code's marketplace

#279

Post by [deleted] »

xeonmc wrote: post #18
mock-possum wrote: post #2

Another creator gone off the deep end apparently? > reading the review responses by the creator, I don't really trust it anymore. Being rude to others who are concerned over the recent move to closed-source (and without warning!) is pretty disheartening. > So, uh, the guy who made the VS Code Material Theme is threatening everyone who uses it in their products. He seems to have forgotten it was originally licensed un…

The old commit history can still be accessed here: https://github.com/material-theme/vsc-material-theme/activit...

[deleted]

Re: Material Theme has been pulled from VS Code's marketplace

#280

Post by zitterbewegung »

adamc wrote: post #261
dingnuts wrote: post #220

Earlier quoted context omitted.

This is why I use Emacs and it's why I didn't stop using Emacs when Sublime Text II, then Atom, then VSCode became popular. When Microsoft gets bored of VSCode or forces you to only do AI "vibe coding", Emacs will still be there. New version just came out. The release notes were full of good things.

Well, I used Emacs for 15-20 years. It has problems of its own -- mostly that it is effectively locked into an antediluvian view of how editors work, and that to use it effectively you end up maintaining large and complex configuration files. I still use it for some things, but what we really need is a new, different edition of Emacs that has the same basic architecture but a more modern take on all the stuff that da…

XEmacs Tried to do that, it has been attempted to rewrite the backend of emacs into Rust twice, Guile has tried to interpret emacs lisp twice. The biggest problem is basically how large the user base is and the ability of people to want to perform the port so actually improving the editor is more likely.

GTK+ and webkit has been integrated into emacs and it has a package manager now and configuration is still a problem.

Post reply on HN