Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

351–360 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#351

Post by redwall_hp »

diggan wrote: post #165
oneeyedpigeon wrote: post #125

Earlier quoted context omitted.

People used to pay for ringtones. People pay for all sorts of things that might seem weird to you because people have different tastes.

Heck, iPhone users AFAIK still can't just put their own .wav as a ringtone and need to pay Apple to use songs/sounds as ringtone.

No you don't. You've always been able to take an M4A file (MP4 AAC), rename the extension to be M4R and copy it to your iTunes library.

You can even prepare ringtones on your phone with the iOS version of GarageBand.

https://support.apple.com/en-us/120692

Re: Material Theme has been pulled from VS Code's marketplace

#352

Post by CodeWriter23 »

nkmnz wrote: post #334
homebrewer wrote: post #330

Earlier quoted context omitted.

Yet Mozilla, for all the flak it gets, isn't paid a dime by its users, but does find resources to vet the most popular extensions. Everything I use is checked by them. Raymond Hill (of ublock fame) wasn't really impressed with how it is performed, but it's still much better than nothing (which is what MS apparently does). VSCode is an IDE in name only, it's a glorified text editor, and pretty mediocre one at that. I…

What functionality or property makes JetBrains' products an IDE while VSCode isn't? Honest question, I've never used any of their products.

Paid JetBrains user here. What JetBrains gives you is self-implemented add-ons in their marketplace. These are perceived to have the same level of trust as the base product. Then there is the similar level of “might be malware” or “steal your infoware” from (possibly adapted) open source and third parties available on their marketplace.

Re: Material Theme has been pulled from VS Code's marketplace

#353

Post by redwall_hp »

diggan wrote: post #185
skydhash wrote: post #176

Earlier quoted context omitted.

I don’t remmener the exact steps, but it was fairly easy. You just need a mac (which you can borrow) and an audio editor. But that’s been a few years as I’ve been using the same one for a while now.

> You just need a mac (which you can borrow) Yeah, so only-iPhone users are out of luck since the majority of people don't have a Mac. Last time I used Android you needed the file and the phone itself, you select the audio file and you're done.

You can do it on your phone with GarageBand. Take any audio file, clip it to the desired portion, export as ringtone.

https://support.apple.com/en-us/120692

Re: Material Theme has been pulled from VS Code's marketplace

#354

Post by CodeWriter23 »

LocalH wrote: post #323
CodeWriter23 wrote: post #313

Earlier quoted context omitted.

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…

You do realize this is Microsoft we're talking about here? Not merely a couple dudes in their bedroom doing this in their spare time? I guarantee you that a non-zero percentage of the code in VSCode was paid for.

> You do realize this is Microsoft we're talking about here?

Fiscal responsibility: required

> Not merely a couple dudes in their bedroom doing this in their spare time?

Fiscal responsibility: optional

I would also point out, the malware-infested extension we are talking about presents more as the “two guys in a bedroom” model (though possibly a state-sponsored actor).

Re: Material Theme has been pulled from VS Code's marketplace

#355

Post by _cenw »

isidorn wrote: post #183
galagladi wrote: post #171

Earlier quoted context omitted.

They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...

Thank you. We will security audit this extension today and take action if needed.

Next one: https://marketplace.visualstudio.com/items?itemName=vira-the...

Re: Material Theme has been pulled from VS Code's marketplace

#356

Post by _cenw »

mattmaroon wrote: post #191
_cenw wrote: post #186

Earlier quoted context omitted.

Didn't the author evade a ban? Isn't that enough reason to take this down?

They could at least somewhat automate checks for that sort of thing.

Yep, because there's already another one, our hex code merchant clearly has nothing better to do: https://marketplace.visualstudio.com/items?itemName=vira-the...

Re: Material Theme has been pulled from VS Code's marketplace

#357

Post by qbane »

qbane wrote: post #154
zelphirkalt wrote: post #144

Earlier quoted context omitted.

To me it seems ridiculous, that a theme could even accumulate such things as analytics and even lots of dependencies. A theme is usually something self-contained. And even more ridiculous, that anyone can, as you write, "force uninstall" anything from my machine. So glad I am not a VS Code user. It seems all the typical corporate BS is happening with its marketplace and plugins.

If one can "force uninstall" for safety, then it implies that automatic upgrading an extension with the user's consent is unsafe at the first place.

* without the user's consent

Re: Material Theme has been pulled from VS Code's marketplace

#358

Post by paulddraper »

vlovich123 wrote: post #293
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…

> Help me square this circle

Sure. As a general rule, you get what you pay for.

Re: Material Theme has been pulled from VS Code's marketplace

#359

Post by coffeecantcode »

skyyler wrote: post #290
coffeecantcode wrote: post #274

Earlier quoted context omitted.

Care to share these extensions?

Ad block: https://ublockorigin.com/ Skipping sponsored sections: https://sponsor.ajay.app/ Remove shorts: https://addons.mozilla.org/en-US/firefox/addon/remove-youtub... Return dislike: https://www.returnyoutubedislike.com/ Forgot to mention returning the dislike in my original comment. At least I can use these extensions and get something resembling the service I want to pay for.

Bless you, appreciate the sauce.

Re: Material Theme has been pulled from VS Code's marketplace

#360

Post by ajross »

CodeWriter23 wrote: post #313
vlovich123 wrote: post #293

Earlier quoted context omitted.

Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…

> Because the open source community lacks the financial resources to vet every single version of every package.

I made the point elsewhere, but this seems to fail in the face of Debian and Red Hat and Canonical who have been publishing mostly-secure distros of exclusively open source software for decades now.

There's a reason why MS and NPM get caught by this sort of shenanigans, but it's not "open source".

Post reply on HN