Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

311–320 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#311

Post by notwhereyouare »

theobr wrote: post #109

Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…

how is there not a single screenshot of what it looks like either in the repo or on the marketplace page? Or did I just miss them?

Re: Material Theme has been pulled from VS Code's marketplace

#312

Post by 7373737373 »

prmoustache wrote: post #287

Why would a theme contain code in the first place. Shouldn't it just be made of static value containing color codes?

Why would any add-on have more authority than it needs? Oh right - because no currently popular language supports implementing that kind of resource/rights monitoring and control:

https://medium.com/agoric/pola-would-have-prevented-the-even...

An absolute failure of contemporary programming language design.

Software firms need to think harder about what kind of guarantees the languages they use can give them - which part of a project's code can access which (and how many) resources - access to other project components, filesystems, the network, and the amount of process memory and CPU time they are allowed to consume. The current default answer is usually "any place has authority to access everything else, and a simple infinite loop will use up all the system's resources"

Re: Material Theme has been pulled from VS Code's marketplace

#313

Post by CodeWriter23 »

vlovich123 wrote: post #293
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially capable of ensuring security and accept the limitations of their offering.

Mitigations like running in a VM might protect your dev workstation. But not code you put into production that relies on third parties.

Re: Material Theme has been pulled from VS Code's marketplace

#314

Post by balch »

isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Given that it's been automatically removed from all VS Code instance, is there any way to check if it was previously installed? It's concerning that there's now no way to check if a sytem has been compromised by this

Re: Material Theme has been pulled from VS Code's marketplace

#315

Post by jerpint »

davely wrote: post #308
vlovich123 wrote: post #293

Earlier quoted context omitted.

Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…

> you’re running arbitrary third party code on client machines without any form of sandboxing. This is a level of security you would not deploy into Azure, so why is “run arbitrary 3p code on someone else’s machine” appropriate for VSCode? More and more, I am starting to think I need to run my development environment (for both work and personal projects) in a VM. I am on MacOS, so UTM or Parallels would work pretty w…

VSCode in cloud would be great, GitHub tried something similar with GitHub.dev , I haven’t tried it in a while but it didn’t feel quite ready at the time, maybe things have changed

Re: Material Theme has been pulled from VS Code's marketplace

#316

Post by progbits »

bitbasher wrote: post #288
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

I de-obfuscated most of it and didn't see anything malicious. Was there any particular file that was concerning?

Why was there any obfuscated code in the first place?

Re: Material Theme has been pulled from VS Code's marketplace

#317

Post by [deleted] »

bun_at_work wrote: post #295
sigmoid10 wrote: post #168

Curiously, someone on reddit noticed suspicious changes in this extension 7 months ago [1]. Obfuscation in open source is usually an extreme red flag. Microsoft really needs to rethink their security model for vs code extensions. It has simply become way too profitable to target given whatever they are doing against it. For every dev they ban 10 will come with new malicious extensions. [1] https://www.reddit.com/r/vs…

Be careful what you wish for. VS Code is maybe the best product Microsoft has ever released, largely because the extension market. If Microsoft polices the marketplace more, you can probably expect VS Code quality to degrade. Here's my argument: More scrutiny of the marketplace will lead to less extensions overall (the scrutiny process will reduce the number of extensions overall as barrier to entry will be increased…

[deleted]

Re: Material Theme has been pulled from VS Code's marketplace

#318

Post by nmstoker »

vlovich123 wrote: post #293
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…

Remember, this is Microsoft! A friend told me of a fairly major corporate firm that found MSFT had arbitrarily pushed an AI tool to run on their SharePoint, scooping up site data outside of any formal agreement to do so. MSFT are no doubt covered by a general agreement but this seems underhand/inept and yet a remarkably common flaw in their approach (I've seen similar behaviour with Teams apps)

Re: Material Theme has been pulled from VS Code's marketplace

#319

Post by hakaneskici »

jerpint wrote: post #315
davely wrote: post #308

Earlier quoted context omitted.

> you’re running arbitrary third party code on client machines without any form of sandboxing. This is a level of security you would not deploy into Azure, so why is “run arbitrary 3p code on someone else’s machine” appropriate for VSCode? More and more, I am starting to think I need to run my development environment (for both work and personal projects) in a VM. I am on MacOS, so UTM or Parallels would work pretty w…

VSCode in cloud would be great, GitHub tried something similar with GitHub.dev , I haven’t tried it in a while but it didn’t feel quite ready at the time, maybe things have changed

Try https://vscode.dev

You can append a Github repo to the URL to open it: https://vscode.dev/https://github.com/facebook/react

Post reply on HN