Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

291–300 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#291

Post by solomatov »

isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Is it possible for you to add color theme/icon theme/keymap only extensions, without any executable code? I think, it will improve the security situation a bit. I don't see why the mentioned kinds of extensions should have any code.

Re: Material Theme has been pulled from VS Code's marketplace

#292

Post by staticfish »

johnisgood wrote: post #251
esperent wrote: post #210

Earlier quoted context omitted.

Git is a fairly mild insult though, roughly equivalent to calling someone annoying. I'm sure at least a few of us have thought Git (the tool) to be aptly named, from time to time.

Is "fanny" an insult at all?

Yes, in Britain it is, you fanny.

Re: Material Theme has been pulled from VS Code's marketplace

#293

Post by vlovich123 »

isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Help me square this circle:

> A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us.

> As a reminder, the VS Marketplace continuously invests in security

If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself?

I would also suggest that the trust model for VSCode is fundamentally broken - you’re running arbitrary third party code on client machines without any form of sandboxing. This is a level of security you would not deploy into Azure, so why is “run arbitrary 3p code on someone else’s machine” appropriate for VSCode?

While I appreciate the work that the VSCode team does and I use it, the lack of any form of sandboxing has always bothered me.

Re: Material Theme has been pulled from VS Code's marketplace

#295

Post by bun_at_work »

sigmoid10 wrote: post #168

Curiously, someone on reddit noticed suspicious changes in this extension 7 months ago [1]. Obfuscation in open source is usually an extreme red flag. Microsoft really needs to rethink their security model for vs code extensions. It has simply become way too profitable to target given whatever they are doing against it. For every dev they ban 10 will come with new malicious extensions. [1] https://www.reddit.com/r/vs…

Be careful what you wish for.

VS Code is maybe the best product Microsoft has ever released, largely because the extension market. If Microsoft polices the marketplace more, you can probably expect VS Code quality to degrade.

Here's my argument: More scrutiny of the marketplace will lead to less extensions overall (the scrutiny process will reduce the number of extensions overall as barrier to entry will be increased). Less extensions available will create an incentive for Microsoft to add features to VS Code directly. The more features MS adds, the more bloated VS Code will become.

So then, more security auditing in the extensions marketplace will lead to a more bloated VS Code.

All that said, it would be nice if there were better security controls in the extensions marketplace, I just don't trust Microsoft to do anything in a way that actually improves their products for the people who use them.

Re: Material Theme has been pulled from VS Code's marketplace

#297

Post by iLemming »

bravetraveler wrote: post #11

The day {n,}vim take away my color schemes, I die. Convenience until it isn't, eh?

Yeah well, MSFT - the behemoth among evilish corporations, invests vast sums into developing a sophisticated tool with extensive features - more than their combined philanthropic initiatives - and offers it freely to just about anyone. This generosity doesn't seem questionable at all, eh?

I mean, when I use Vim and Emacs, the benefits clearly flow to users and the developer community. Back when I paid for the IntelliJ license - I knew exactly how their revenue model worked. Yet whenever I download and use VSCode, I don't really know what's Microsoft's grand plan here, does anyone else do?

Re: Material Theme has been pulled from VS Code's marketplace

#298

Post by rfl890 »

anakaine wrote: post #96
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

You might need to chase down reuploads, too. https://marketplace.visualstudio.com/items?itemName=t3dotgg....

Maybe point to the actual reupload instead? https://marketplace.visualstudio.com/items?itemName=fanny.vs...

Re: Material Theme has been pulled from VS Code's marketplace

#299

Post by Quot »

yesthis wrote: post #262
isidorn wrote: post #99

Earlier quoted context omitted.

Thanks. Our security researchers will review this today and we might take it down. We reached out to the new author and he does not have malicious intent, and agreed that we just take down the new extension if we see something is off.

> We reached out to the new author and he does not have malicious intent Because he said so?

The maintainer goes into more detail here: https://news.ycombinator.com/item?id=43182156

Re: Material Theme has been pulled from VS Code's marketplace

#300

Post by [deleted] »

hombre_fatal wrote: post #223
oefrha wrote: post #100

Earlier quoted context omitted.

Asking for money isn’t a problem. The problem is this person went out of their way to extract money by harassing people who rightfully use the open source Apache 2 version, switching the marketplace extension to a closed source version with obfuscated code (likely malicious according to MS), and possibly more, all this for doing a quite small amount of work. That’s after already raising $7.6k, apparently.

Making a theme is not minimal effort which is why 99.9999% of everyone uses preexisting themes rather than making their own. LoC is a red herring. And the fact that thousands of people decided to introduce his LoC as a dependency in their local development environment makes the point. I'm surprised to see supposed software engineers get this wrong. We tend to dismiss look&feel type things as low effort which is funny…

[deleted]
Post reply on HN