31–40 of 109 posts
I've only been using VSC for about 6 months. During my the first week of use, I noted how insecure all the plugins and their communications with the main application were set up. Dismayed, I moving the workstation to an airgapped portion of my environment, and the piece of shit would not work without a net connection. So I use VCE inside a VM now. My career includes working for security companies with sensitive infor…
Lovely
Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to…
> Browsers need to stop connecting to anything other than what's typed into the navigation bar. Yes, indeed!
I've only been using VSC for about 6 months. During my the first week of use, I noted how insecure all the plugins and their communications with the main application were set up. Dismayed, I moving the workstation to an airgapped portion of my environment, and the piece of shit would not work without a net connection. So I use VCE inside a VM now. My career includes working for security companies with sensitive infor…
Why not just use some other editor?
> Does it fix the issues? Yes. > Do I think there are other security issues here and we can bypass this? Also, yes. > Do I want to spend more time doing free work for a company with a 2.5 TRILLION market cap? Hell, no. Troubling.
Either Microsoft or other future vendors can actually honor an established bug bounty program, or the author can sell his findings to the highest bidder. Or the author can simply not spend time and energy finding bugs in the first place.
Earlier quoted context omitted.
> Browsers need to stop connecting to anything other than what's typed into the navigation bar. Yes, indeed!
A web browser that doesn’t support links isn’t much of a web browser
Still bad, but not quite as bad as owning from the browser via localhost GET.
Earlier quoted context omitted.
> Browsers need to stop connecting to anything other than what's typed into the navigation bar. Yes, indeed!
oh how i would love this future.
You can still import all nasty third parties required by marketing department, bypassing first party protections and leading to even worse security. Or maybe maintain allow lists, basically that's a Content Security Policy.
Future is now old man.
Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.
> Does it fix the issues? Yes. > Do I think there are other security issues here and we can bypass this? Also, yes. > Do I want to spend more time doing free work for a company with a 2.5 TRILLION market cap? Hell, no. Troubling.
Not really all that troubling, all the author is saying is that he wants to get paid for their work. Either Microsoft or other future vendors can actually honor an established bug bounty program, or the author can sell his findings to the highest bidder. Or the author can simply not spend time and energy finding bugs in the first place.
But does not change the monetary reality