Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

321–330 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#321

Post by lolinder »

CodeWriter23 wrote: post #313
vlovich123 wrote: post #293

Earlier quoted context omitted.

Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…

> Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable

VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. It's a flagship IDE produced by one of the most valuable tech companies in the world, released for free as a loss leader in service to very specific corporate goals.

When a tech behemoth releases a free IDE as a loss leader and it drives out all of the scrappy open source projects one by one, I think it's reasonable to hold that tech behemoth to tech behemoth standards rather than scrappy open source project standards.

Re: Material Theme has been pulled from VS Code's marketplace

#322

Post by dspillett »

bad_user wrote: post #77
weinzierl wrote: post #50

Earlier quoted context omitted.

"What's wrong is the bait and switch,[..]" Morally wrong, legally not so much. If it is under a permissive license (and it was MIT originally as others have pointed out) you can always cut a proprietary version. That doesn't take away the right to use the permissively licensed code of course.

> Morally wrong, legally not so much Of course, but then, the legality of it is irrelevant. Free markets work because consumers can exercise their freedom to choose, and in such instances it's easy, given that the reason for why many such projects see wide adoption is their FOSS nature.

> Free markets work because consumers can exercise their freedom to choose

That only works if the consumer is fully informed.

In the case of bait & switch sometimes the switch happens without them being informed and/or without giving them chance to cancel/uninstall/whatever.

Re: Material Theme has been pulled from VS Code's marketplace

#323

Post by LocalH »

CodeWriter23 wrote: post #313
vlovich123 wrote: post #293

Earlier quoted context omitted.

Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…

You do realize this is Microsoft we're talking about here? Not merely a couple dudes in their bedroom doing this in their spare time? I guarantee you that a non-zero percentage of the code in VSCode was paid for.

Re: Material Theme has been pulled from VS Code's marketplace

#325

Post by rat9988 »

lolinder wrote: post #321
CodeWriter23 wrote: post #313

Earlier quoted context omitted.

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…

> Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. It's a flagship IDE produced by one of the most valuable tech companies in the world, released for free as a loss leader in service to very specific corporate…

The marketplace isn't operated on a paid contract for vetted extensions. You vet the extensions you use. Most don't, and it's ok. Don't shift the blame and the cost on microsoft though, they don't have to offer it.

Re: Material Theme has been pulled from VS Code's marketplace

#326

Post by rat9988 »

LocalH wrote: post #323
CodeWriter23 wrote: post #313

Earlier quoted context omitted.

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…

You do realize this is Microsoft we're talking about here? Not merely a couple dudes in their bedroom doing this in their spare time? I guarantee you that a non-zero percentage of the code in VSCode was paid for.

Who ever paid to use the extensions marketplace?

Re: Material Theme has been pulled from VS Code's marketplace

#327

Post by e40 »

zelphirkalt wrote: post #144
theobr wrote: post #109

Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…

To me it seems ridiculous, that a theme could even accumulate such things as analytics and even lots of dependencies. A theme is usually something self-contained. And even more ridiculous, that anyone can, as you write, "force uninstall" anything from my machine. So glad I am not a VS Code user. It seems all the typical corporate BS is happening with its marketplace and plugins.

Isn't the problem that VS Code has no permission model (restricting of them), so all extensions can do anything?

Re: Material Theme has been pulled from VS Code's marketplace

#328

Post by itorcs »

MortyWaves wrote: post #209

Theo of internet drama fame interjecting himself into the middle of it as always.

If the size of your paycheck depends on drama and making a surprised look in a YouTube thumbnail you would possibly insert yourself into the middle of things also

Re: Material Theme has been pulled from VS Code's marketplace

#329

Post by tabony »

e40 wrote: post #327
zelphirkalt wrote: post #144

Earlier quoted context omitted.

To me it seems ridiculous, that a theme could even accumulate such things as analytics and even lots of dependencies. A theme is usually something self-contained. And even more ridiculous, that anyone can, as you write, "force uninstall" anything from my machine. So glad I am not a VS Code user. It seems all the typical corporate BS is happening with its marketplace and plugins.

Isn't the problem that VS Code has no permission model (restricting of them), so all extensions can do anything?

While it is, the same issue exists in Sublime, Vim, Emacs, Gedit, pico/nano[1], IntelliJ, Android Studio, Eclipse, and every editor.

[1] https://threatpost.com/researchers-show-how-popular-text-edi...

I think Xcode may be the exception but Xcode plugins also can’t do much.

Re: Material Theme has been pulled from VS Code's marketplace

#330

Post by homebrewer »

rat9988 wrote: post #325
lolinder wrote: post #321

Earlier quoted context omitted.

> Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. It's a flagship IDE produced by one of the most valuable tech companies in the world, released for free as a loss leader in service to very specific corporate…

The marketplace isn't operated on a paid contract for vetted extensions. You vet the extensions you use. Most don't, and it's ok. Don't shift the blame and the cost on microsoft though, they don't have to offer it.

Yet Mozilla, for all the flak it gets, isn't paid a dime by its users, but does find resources to vet the most popular extensions. Everything I use is checked by them.

Raymond Hill (of ublock fame) wasn't really impressed with how it is performed, but it's still much better than nothing (which is what MS apparently does).

VSCode is an IDE in name only, it's a glorified text editor, and pretty mediocre one at that. I in "IDE" stands for "integrated", like what you'd expect from JetBrains' products. Or even the real visual studio.

Post reply on HN