Earlier quoted context omitted.
Is "fanny" an insult at all?
Yes, in Britain it is, you fanny.
Damn! That was fannier than I expected. Lmao.
Material Theme has been pulled from VS Code's marketplace
301–310 of 424 posts
Re: Material Theme has been pulled from VS Code's marketplace
#302Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…
I was going to point this weird part of their comment too.
Reminder that the Open-VSX extension registry exists: https://open-vsx.org
Idk if they removed the malicious theme (or if they have it at all), but if MS isn't doing anything beyond just responding to user reports, you might as well switch to an open registry that probably does the same level of security work, and avoid giving them yet another monopoly.
Re: Material Theme has been pulled from VS Code's marketplace
#303Earlier quoted context omitted.
You might need to chase down reuploads, too. https://marketplace.visualstudio.com/items?itemName=t3dotgg....
Maybe point to the actual reupload instead? https://marketplace.visualstudio.com/items?itemName=fanny.vs...
Wild how its github page (1 commit, 1 hour ago) has already 885 forks and 11.2K stars to mislead people
Re: Material Theme has been pulled from VS Code's marketplace
#304Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
To me it seems ridiculous, that a theme could even accumulate such things as analytics and even lots of dependencies. A theme is usually something self-contained. And even more ridiculous, that anyone can, as you write, "force uninstall" anything from my machine. So glad I am not a VS Code user. It seems all the typical corporate BS is happening with its marketplace and plugins.
yeah. I hope you leave malicious code running on your computers to prove your point.
Re: Material Theme has been pulled from VS Code's marketplace
#305Earlier quoted context omitted.
Should be added that the malicious part is often done by a third party that takes over an open source project when the original developer doesn't have the time/energy/money to maintain their open source/free work. Many Chrome extensions end up being sold for thousands or just hundreds of dollars because there's no money in them and the dev isn't all that interested. Society as a whole could easily avoid this by fundi…
Every time piracy or Youtube ads come up, HNers grandstand on how they don't even pay a dime to the content creators making the hundreds of hours of videos they watch. GGs if you want a buck for the VSCode theme you made.
Copyright abolitionists are more than happy to embrace no one ever making money off of "software" again.
Re: Material Theme has been pulled from VS Code's marketplace
#306Earlier quoted context omitted.
Hi, owner of the fork here. I did a thorough combing of the code base when I forked. Just did another audit and still not seeing anything suspicious. Gutting all of the opencollective and changelog code to be 1000% sure.
Hi. Please do not replace the original author's copyright notice in the LICENSE file. That is a violation of the Apache License. You could instead "append" your name to the copyright notice though, which is legal. https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you/c...
[flagged]
Re: Material Theme has been pulled from VS Code's marketplace
#307Theo of internet drama fame interjecting himself into the middle of it as always.
Could you elaborate? I have no idea who “Theo of internet drama fame” is.
Re: Material Theme has been pulled from VS Code's marketplace
#308Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…
> you’re running arbitrary third party code on client machines without any form of sandboxing. This is a level of security you would not deploy into Azure, so why is “run arbitrary 3p code on someone else’s machine” appropriate for VSCode?
More and more, I am starting to think I need to run my development environment (for both work and personal projects) in a VM.
I am on MacOS, so UTM or Parallels would work pretty well I think. Sadly, I think my work explicitly forbids us from running VMs or accessing our services from them.
Re: Material Theme has been pulled from VS Code's marketplace
#309Earlier quoted context omitted.
Correct, the author links to it from his github page https://github.com/equinusocio
So, this is pretty weird no? In his GH profile he links his website/portfolio https://astorinomattia.com/ which is actually his surname + name. It doesn't seem to be pretty smart and safe going rogue with such public exposure no? Unless it is a completely fake persona, of course.
It also links to his employer (https://lualtek.io). Maybe someone should let his employer know what their employee is up to :)
Re: Material Theme has been pulled from VS Code's marketplace
#310Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…
> If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself?
I think that's sort of unfair. Of course MS should be relying on the community! That's arguably the best single practice for detecting these kinds of attacks in open source code. Objectively it works rather better even than walled garden environments like the iOS/Android apps stores (which have to be paired with extensive app-level sandboxing and permissions management, something that editor extensions can't use by definition).
The reference case for best practice here is actually the big Linux distros. Red Hat and Canonical and Debian have a long, long track record of shipping secure software. And they did it not on the back of extensive in-house auditing but by relying on the broader community to pre-validate a list of valuable/useful/secure/recommended software which they can then "package".
MS's flaw here, which is shared by NPM and PyPI et. al., is that they want to be a package repository without embracing that kind of upstream community validation. Software authors can walk right in and start distributing junk even though no one's ever heard of them. That has to stop. We need to get back to "we only distribute stuff other people are already using".