Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

401–410 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#401

Post by ajross »

vlovich123 wrote: post #397
ajross wrote: post #360

Earlier quoted context omitted.

> Because the open source community lacks the financial resources to vet every single version of every package. I made the point elsewhere, but this seems to fail in the face of Debian and Red Hat and Canonical who have been publishing mostly-secure distros of exclusively open source software for decades now. There's a reason why MS and NPM get caught by this sort of shenanigans, but it's not "open source".

Because the attack surface is smaller and more difficult to extract value out of. I think it’s been shown time and time again the more motivated your attacker the more difficult it is to defend and very visible popular platforms see more attacks. NPM and MS represent drastically larger platforms.

Uh... no. There is far (far) more code[1] shipped in the package repository of any Linux distro than in all the world's vscode extensions. Are you being serious? NPM arguably gets a little closer, but only a little.

No, the reason Linux is safe and modern distributors aren't is the "packaging" step. Debian volunteers package software that they understand to be high quality via existing community consensus. You can't just show up to Fedora and say "ship my junkware app", you need to convince the existing community that your stuff doesn't suck.

And that's worked extremely well for decades now, going all the way back to 2BSD being shipped above V7 Unix. The reason MS and NPM et. al. abandoned it isn't just pure experience[2]. They don't want to wait for their repos to fill with good software, they want all the software in it now so that they don't get beaten by whoever their competitors are.

And this is the inevitable result. If you allow anyone to distribute software to your users then you allow everyone to distribute software to your users. And everyone includes a lot of bad people.

[1] With vastly more capability! The distro ships everything from firmware blobs and kernel drivers up through browser glitz and desktop customization. Talk about "attack surface"!

Re: Material Theme has been pulled from VS Code's marketplace

#402

Post by staticfish »

esperent wrote: post #385
staticfish wrote: post #292

Earlier quoted context omitted.

Yes, in Britain it is, you fanny.

That one is specifically British though. Or perhaps even just English, I can't imagine a Scottish person using it.

So what? The answer to the question is still yes.

Re: Material Theme has been pulled from VS Code's marketplace

#403

Post by nolist_policy »

skrebbel wrote: post #382
Macha wrote: post #213

Earlier quoted context omitted.

oklch should be an incredibly minor to unmeasurable performance hit, even on a 7 year old chromebook. Nor should it affect the displayed output. It's just a better color picker syntax.

7 year old chromebooks don't support olkch.

Not true, Chromebooks receive 8-10 years of updates. Meaning a 7 year old Chromebook runs the latest Chrome with oklch.

Re: Material Theme has been pulled from VS Code's marketplace

#405

Post by Thorrez »

dspillett wrote: post #396
Thorrez wrote: post #391

Earlier quoted context omitted.

US prices: Netflix 1080p: $18/mo. Netflix 4k: $25/mo. No annual plan. Youtube Premium, which offers 4k, is $14/mo, or $120/yr for the annual plan (which averages to $12/mo). UK prices: Netflix 1080p: £13/mo. Netflix 4k: £19/mo. No annual plan. Youtube Premium: £12/mo. No annual plan. It's interesting how in the Youtube Premiums discount over Netflix is smaller in the UK than the US, and how Youtube Premium lacks an a…

> > Also note that while it takes away the ads, it does nothing about the stalking > Does an ad blocker change that? In many places, yes. Youtube? Less so, but it depends on which blocker(s) are in play. A DNS based blocker won't help completely as some of the ad/track related requests are coming from their main domain or sub-domains that are used for other things so can't be blocked wholescale. It will block JS and…

When it comes to embedded videos, that reminds me of youtube-nocookie.com . If the website does an embed using youtube-nocookie.com , that prevents I believe what is being described as "stalking".

>The Privacy Enhanced Mode of the YouTube embedded player prevents the use of views of embedded YouTube content from influencing the viewer’s browsing experience on YouTube. This means that the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize the YouTube browsing experience, either within your Privacy Enhanced Mode embedded player or in the viewer’s subsequent YouTube viewing experience.

>If ads are served on a video shown in the Privacy Enhanced Mode of the embedded player, those ads will likewise be non-personalized. In addition, the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize advertising shown to the viewer outside of your site or app.

https://support.google.com/youtube/answer/171780?hl=en#zippy...

Re: Material Theme has been pulled from VS Code's marketplace

#406

Post by vlovich123 »

ajross wrote: post #401
vlovich123 wrote: post #397

Earlier quoted context omitted.

Because the attack surface is smaller and more difficult to extract value out of. I think it’s been shown time and time again the more motivated your attacker the more difficult it is to defend and very visible popular platforms see more attacks. NPM and MS represent drastically larger platforms.

Uh... no. There is far (far) more code[1] shipped in the package repository of any Linux distro than in all the world's vscode extensions. Are you being serious? NPM arguably gets a little closer, but only a little. No, the reason Linux is safe and modern distributors aren't is the "packaging" step. Debian volunteers package software that they understand to be high quality via existing community consensus. You can't…

Remember, when we're triggered our reading comprehension goes down and we confuse emotion for facts. Did I say they ship more/less code? No, first I was talking about the user base size and the economic incentives for malicious users.

For the most popular package:

Debian: ~253K installs per month [1]

NPM: ~236M installs per month [2]

VSCode: ~158M installs total [3]

Obviously VSCode is hard to compare, but the most popular Debian package would need 52 years to achieve the total VSCode numbers so I'm sure it's safe to say VSCode beats Debian significantly on installs and NPM wins even more convincingly.

Ok, but let's take a look at how much code is shipping which was your metric:

Debian: 242k submissions per month for amd64 [4]

NPM: ~50k new non-spam packages per month, ~800k new version submissions per month [5]

VSCode: No data available

I don't know how VSCode compares, but clearly NPM beats Debian which makes sense because of how open it is and more importantly how many orders of magnitude there are JS developers vs Linux developers and how much more frequently they update their packages because the overhead is lower for creating a submission.

It's really easy to forget that the number of JS developers or people using IDEs is much larger than the number of Linux users. So NPM still beats Debian on this front. As for the security assumption and how good a job maintainers are doing, I'm not so sure on that either. The xz utils backdoor into SSH was found by a Microsoft employee (i.e. the community) not by Debian maintainers. It's not hard to imagine that the lack of notable security issues (particularly attempts recorded) actually indicates very little review, not that there's a higher bar because the maintainers are more talented or have better incentives for "reasons" - there's a reason Chrome was perceived as having better security than IE (it did - architecture was better) and STILL they see regular successful attacks bypassing all the mitigations.

Again, to reiterate in case the above got you triggered again - NPM & VScode have significantly more users than Debian and that creates economic incentives for attackers. The capabilities of a vulnerability matter less unless you're a state actor because capabilities do not track economic results as strongly. This has so much evidence it shouldn't even need this kind of explanation. Remember when people said that Mac had better security? Well turns out Apple is dealing with all the same vulnerability and spam issues on a closed down system when their popularity went up; again, economic incentives.

[1] https://popcon.debian.org/main/by_inst

[2] https://www.npmjs.com/package/lodash

[3] https://marketplace.visualstudio.com/items?itemName=ms-pytho...

[4] https://popcon.debian.org/

[5] https://blog.sandworm.dev/state-of-npm-2023-the-overview

Re: Material Theme has been pulled from VS Code's marketplace

#408

Post by ajross »

vlovich123 wrote: post #406
ajross wrote: post #401

Earlier quoted context omitted.

Uh... no. There is far (far) more code[1] shipped in the package repository of any Linux distro than in all the world's vscode extensions. Are you being serious? NPM arguably gets a little closer, but only a little. No, the reason Linux is safe and modern distributors aren't is the "packaging" step. Debian volunteers package software that they understand to be high quality via existing community consensus. You can't…

Remember, when we're triggered our reading comprehension goes down and we confuse emotion for facts. Did I say they ship more/less code? No, first I was talking about the user base size and the economic incentives for malicious users. For the most popular package: Debian: ~253K installs per month [1] NPM: ~236M installs per month [2] VSCode: ~158M installs total [3] Obviously VSCode is hard to compare, but the most p…

The "triggered" bit is just flaming. Please stop that.

But I'm not following how you get from popularity numbers to "attack surface". The latter is a term of art that reflects the amount of complexity on the "outside" of a software system that can be interacted with by an attacker. It correlates well with "amount of code". I don't see that it has any relation at all to number of installs.

Re: Material Theme has been pulled from VS Code's marketplace

#409

Post by flutas »

HelloNurse wrote: post #393
flutas wrote: post #273

Earlier quoted context omitted.

The extension file is still available to download directly from MS.[0] I downloaded the file, and unzipped it, but on a cursory glance I only see obfuscated code nothing malicious. [0]: !!!WARNING MAY BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...

Obfuscated code is malicious, even in case it's harmless.

Then never download an Android app, they're obfuscated by default.

Re: Material Theme has been pulled from VS Code's marketplace

#410

Post by e40 »

tabony wrote: post #329
e40 wrote: post #327

Earlier quoted context omitted.

Isn't the problem that VS Code has no permission model (restricting of them), so all extensions can do anything?

While it is, the same issue exists in Sublime, Vim, Emacs, Gedit, pico/nano[1], IntelliJ, Android Studio, Eclipse, and every editor. [1] https://threatpost.com/researchers-show-how-popular-text-edi... I think Xcode may be the exception but Xcode plugins also can’t do much.

I think Emacs and Vim will be lower probability targets than VS Code, though.
Post reply on HN