Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

391–400 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#391

Post by Thorrez »

dspillett wrote: post #285
Thorrez wrote: post #252

Earlier quoted context omitted.

With Youtube at least, you can buy Youtube premium, so you don't have to sit through Youtube ads without needing an ad blocker (though you'll still have to sit through any ads the Youtuber directly adds into the video itself). Disclosure: I work at Google.

At £12/month YT Premium feels rather expensive for what we'd get out of it (though we have considered it for our Dad who uses it for music and train videos a lot) compared to other subscription services. Also note that while it takes away the ads, it does nothing about the stalking (which bothers me much more than the adverts themselves) the results from which will be used to serve ads if you cancel in future (and in…

US prices:

Netflix 1080p: $18/mo. Netflix 4k: $25/mo. No annual plan.

Youtube Premium, which offers 4k, is $14/mo, or $120/yr for the annual plan (which averages to $12/mo).

UK prices:

Netflix 1080p: £13/mo. Netflix 4k: £19/mo. No annual plan.

Youtube Premium: £12/mo. No annual plan.

It's interesting how in the Youtube Premiums discount over Netflix is smaller in the UK than the US, and how Youtube Premium lacks an annual plan in the UK.

>Also note that while it takes away the ads, it does nothing about the stalking

Does an ad blocker change that?

Re: Material Theme has been pulled from VS Code's marketplace

#392

Post by rldjbpin »

firesteelrain wrote: post #8

So weird that this person took contributions from others then made it closed source. It doesn’t seem right, but not a copyright expert.

just like many open-source projects (primarily maintained by a company) turning their projects non-commercial, a la redhat, terraform

Re: Material Theme has been pulled from VS Code's marketplace

#393

Post by HelloNurse »

flutas wrote: post #273
filiptronicek wrote: post #160

Earlier quoted context omitted.

> Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/ Hi Isidor, excited for this! At Open VSX, we'd love to take a look and potentially flag the extension as malicious on our side as well. Are you aware of the version range that the malicious code was included in? I'm asking because https://open-vsx.org does not have any version published since the extension went closed-sou…

The extension file is still available to download directly from MS.[0] I downloaded the file, and unzipped it, but on a cursory glance I only see obfuscated code nothing malicious. [0]: !!!WARNING MAY BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...

Obfuscated code is malicious, even in case it's harmless.

Re: Material Theme has been pulled from VS Code's marketplace

#394

Post by registeredcorn »

isidorn wrote: post #158
danhau wrote: post #145

Earlier quoted context omitted.

Letting you know that VSCode is unable to uninstall the extension. It prompts me to uninstall, but when I confirm the window refreshes and the extension is still there, triggering the same "is problematic" prompt. This is an infinite loop. Same behavior when trying to uninstall the usual way from the extensions panel. I had to manually delete the extension's folder in %USERPROFILE%\.vscode\extensions and delete the e…

Thank you for letting us know. We are investigating.

Any update on this? I am not directly impacted, but am unsure about others in my company. Assuming that they may be:

* Any specifics on the (potential) impact for affected users?

* What they should do to get it removed?

Edit: There does seem to be a little bit more information available over at Bleeping Computer[1], but the precise nature of what the malware does is unclear at this time other than that it may be some type of "supply chain attack". It would be good to hear more about the specifics.

1: https://www.bleepingcomputer.com/news/security/vscode-extens...

Re: Material Theme has been pulled from VS Code's marketplace

#395

Post by Hikikomori »

_cenw wrote: post #355
isidorn wrote: post #183

Earlier quoted context omitted.

Thank you. We will security audit this extension today and take action if needed.

Next one: https://marketplace.visualstudio.com/items?itemName=vira-the...

new main features:

0 external and harmful dependencies

closed source = no more toxic community and youtubers talking shit about things they don't know.

Looks like we're good now.

Re: Material Theme has been pulled from VS Code's marketplace

#396

Post by dspillett »

Thorrez wrote: post #391
dspillett wrote: post #285

Earlier quoted context omitted.

At £12/month YT Premium feels rather expensive for what we'd get out of it (though we have considered it for our Dad who uses it for music and train videos a lot) compared to other subscription services. Also note that while it takes away the ads, it does nothing about the stalking (which bothers me much more than the adverts themselves) the results from which will be used to serve ads if you cancel in future (and in…

US prices: Netflix 1080p: $18/mo. Netflix 4k: $25/mo. No annual plan. Youtube Premium, which offers 4k, is $14/mo, or $120/yr for the annual plan (which averages to $12/mo). UK prices: Netflix 1080p: £13/mo. Netflix 4k: £19/mo. No annual plan. Youtube Premium: £12/mo. No annual plan. It's interesting how in the Youtube Premiums discount over Netflix is smaller in the UK than the US, and how Youtube Premium lacks an a…

> > Also note that while it takes away the ads, it does nothing about the stalking

> Does an ad blocker change that?

In many places, yes. Youtube? Less so, but it depends on which blocker(s) are in play.

A DNS based blocker won't help completely as some of the ad/track related requests are coming from their main domain or sub-domains that are used for other things so can't be blocked wholescale. It will block JS and other resources pulling from *.doubleclick.net though.

A browser/add-on based blocker may do much better by being able to more selectively block resource that are tracking related. It will also be able to block data passed via embedded videos in other sites. They can, and probably do, still track based on what you are actually watching via requests to the main domain, no ad blocker can do much about that without blocking the whole site.

Re: Material Theme has been pulled from VS Code's marketplace

#397

Post by vlovich123 »

ajross wrote: post #360
CodeWriter23 wrote: post #313

Earlier quoted context omitted.

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially…

> Because the open source community lacks the financial resources to vet every single version of every package. I made the point elsewhere, but this seems to fail in the face of Debian and Red Hat and Canonical who have been publishing mostly-secure distros of exclusively open source software for decades now. There's a reason why MS and NPM get caught by this sort of shenanigans, but it's not "open source".

Because the attack surface is smaller and more difficult to extract value out of. I think it’s been shown time and time again the more motivated your attacker the more difficult it is to defend and very visible popular platforms see more attacks. NPM and MS represent drastically larger platforms.

Re: Material Theme has been pulled from VS Code's marketplace

#398

Post by cratermoon »

CamperBob2 wrote: post #369
cratermoon wrote: post #368

Earlier quoted context omitted.

They certainly aided and abetted. See IBM.

But they didn't murder their own customers. Their customer, a government , did the murdering. As long as government claims the right to a monopoly on violence, it is reasonable to hold them to far, far higher standards than anyone else, including corporations. There is only so much damage one company or one cartel can do, but with government, the downside is unbounded. As I suspect we're about to see for ourselves.

Nah, let go of that monopoly on violence claptrap. Governments can't do things without corporations to build stuff for them.

> Their customer, a government, did the murdering.

Using stuff the corporation made and profited from.

Max Weber died in 1920, get some new economics.

Re: Material Theme has been pulled from VS Code's marketplace

#399

Post by GlacierFox »

ukFxqnLa2sBSBf6 wrote: post #384
GlacierFox wrote: post #383

Earlier quoted context omitted.

https://www.mikeleake.net/wp-content/uploads/2023/01/DpQ9YJl...

Feeling insecure today?

Come on. You can think of something better to say than that I'm sure of it. That's a Reddit level response...
Post reply on HN