311–320 of 359 posts
Will they revisit the decision to not add a permission model to VSCode extensions? https://news.ycombinator.com/item?id=43181789
how would that be enforced? unless extensions now be required to be WASM blobs, or otherwise using some very simple runtime. (ie. not JS/Node) I think we learned this with the JVM (applets) and the Flash player.
Unfortunately if it was from a compromised extension this is going to be more justification for creating closed environments like what Google is doing with android and Apple has already done with iPhone.
The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like. I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an obser…
I don't see why this wouldn't fit on status.github.com. Social media posts were literally called "status updates" at some point.
The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like. I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an obser…
Are you from 2015? Companies have been announcing stuff on Twitter for a decade, and the rest of social media has been regurgitating Twitter posts for almost as long. Newspapers routinely quote Twitter. All that happened before they even renamed it to X. I’m not saying it’s a good idea. I am saying it somehow became the single source of truth for the Internet with all that entails.
Earlier quoted context omitted.
Who the heck follows Github on Snapchat, TikTok, YouTube, Pinterest, Instagram, Reddit, Facebook, WeChat? Wherever they posted, there’s at this time two articles on the Hacker News front page. Sounds like they have reached their audience.
It's to point out how comparatively small X is. It's in the same ballpark as Pinterest and Quora. Github decided not to use email (which every Github customer has), their sites, or their otherwise active BlueSky.
That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.
Earlier quoted context omitted.
As a developer or security researcher, you're able to download and run GitHub Enterprise Server. I'm not sure having access to the full source code makes a meaningful difference for most of GitHub's surface area, given it's largely Ruby.
LLMs can't really parse compiled code to find exploits, maybe code in scripting languages (python, js, etc) even if minified. So I don't quite agree with you, having access to the source can definitely help find exploits even in pre-LLM days.
For a while the key was literally:
> This obfuscation is intended to discourage GitHub Enterprise customers from making modifications to the VM. We know this 'encryption' is easily broken.
Unfortunately if it was from a compromised extension this is going to be more justification for creating closed environments like what Google is doing with android and Apple has already done with iPhone.
Why not simply have both? This does not have to be an either-or decision. Have a default repository with vetted extensions, but leave the option to install from other sources open.
For consumer it's kind of already like this in a way, there are "verified" extension providers.
Overall, I think this is just going to lead to a lot more scrutiny. I'm sure one of the first things asked when this was discovered was how can it be prevented and I'm sure one of the first answers was get VsCode to lock down extensions. Enterprises love the easy answers
Earlier quoted context omitted.
I installed Zed on a work machine at a well-known software company and a week later they forced me to reimage my machine because they got some alert that the app was attempting to access browser credentials :( No shade on Zed, sometimes in-house security tools just don't like new software.
> they got some alert that the app was attempting to access browser credentials :( That sounds pretty specific.
No idea how that related to what I was told by the sec people shortly afterwards.