from a quick deobfuscation of some of the code, i can't see anything wrong with it? i think this is just a case of obfuscated code being against the VS Code guidelines. the guy clearly wanted people to buy his pro version so maybe that's why he obfuscated all the code in the extension
Material Theme has been pulled from VS Code's marketplace
371–380 of 424 posts
Re: Material Theme has been pulled from VS Code's marketplace
#372Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
Given that it's been automatically removed from all VS Code instance, is there any way to check if it was previously installed? It's concerning that there's now no way to check if a sytem has been compromised by this
Doesn't it prompt to uninstall?
Re: Material Theme has been pulled from VS Code's marketplace
#373I found the malicious javascript (messages.js) file and put it in a Pastebin for anyone to analyze https://pastebin.com/yY1X0LiD obviously its obfuscated by the guy originally
Isn't it about release-notes.js? There are quite a few files in there that are obfuscated. So far I haven't found anything super bad, it looks like a sanity.io client of some sorts, but there could be some stuff hidden in there as it's seems like quite a big JS bundle.
Re: Material Theme has been pulled from VS Code's marketplace
#374Earlier quoted context omitted.
Of course not. What makes you believe that? The MIT license is not very long, and it contains this sentence: > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Which clearly state that you can't remove that license to put your own.
> What makes you believe that? Probably the sublicense wording that many techies confuse with relicensing. Also sloppy wording in discussions like HN where "relicense" is sometimes used as a shortcut for "combined with a compatibly-licensed work in a larger work that can be used under the whole-work license".
If you're the sole copyright owner, of course you can.
That is not the case with other licenses.
Re: Material Theme has been pulled from VS Code's marketplace
#375Earlier quoted context omitted.
Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…
> If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I think that's sort of unfair. Of course MS should be relying on the community! That's arguably the best single practice for detecting these kinds of attacks in open source code. Objectively it works rather better even than walled garden environments like the…
I think you missed the part where I’m asking why the extensions aren’t sandboxed whereas they do invest into sandboxing when it comes to renting out their own machines in the cloud. Even browsers try to do sandboxing of extensions. It’s a jarring disconnect and VSCode is well beyond the prototype stage at mass adoption - the lack of sandboxing is confusing and worrying.
Re: Material Theme has been pulled from VS Code's marketplace
#376Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
how is there not a single screenshot of what it looks like either in the repo or on the marketplace page? Or did I just miss them?
it's ugly, don't worry.
however, I found this from the malware creator's website itself: https://framerusercontent.com/images/G17CYe9tTL2GP1Rw4mUI8YC...
Re: Material Theme has been pulled from VS Code's marketplace
#377Earlier quoted context omitted.
Help me square this circle: > A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. > As a reminder, the VS Marketplace continuously invests in security If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself? I wou…
PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…
It presents a risk sure. But your browser sandboxes those extensions. VSCode runs extensions with the same permissions that VSCode itself has.
Re: Material Theme has been pulled from VS Code's marketplace
#378It appears Microsoft released their 'detailed announcement' - it's just a one-sentence fragment in a Markdown file: https://github.com/microsoft/vsmarketplace/blob/main/Removed...
I'm increasingly suspecting there was nothing actually wrong with the extension, and Theo and others may have simply demolished an open-source developer's reputation primarily because they found him difficult to collaborate with.
This is nuts.
Re: Material Theme has been pulled from VS Code's marketplace
#379Earlier quoted context omitted.
I meant on the development side, not that end users paid for anything.
Then why should end users expect anything? Microsoft is already paying for developpers.
Then they can pay those developers to sandbox vscode extensions at the very least. I like using vscode sometimes but I'm sure as shit not going to use it if my work bans installing extensions due to security risks.
Re: Material Theme has been pulled from VS Code's marketplace
#380The day {n,}vim take away my color schemes, I die. Convenience until it isn't, eh?
Yeah well, MSFT - the behemoth among evilish corporations, invests vast sums into developing a sophisticated tool with extensive features - more than their combined philanthropic initiatives - and offers it freely to just about anyone. This generosity doesn't seem questionable at all, eh? I mean, when I use Vim and Emacs, the benefits clearly flow to users and the developer community. Back when I paid for the Intelli…
Community goodwill is valuable. It's what gets someone to start to think, "this is pretty good, maybe I should try that Azure thing..."
Same reason Xcode is free.