Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

411–420 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#411

Post by bitbasher »

bitbasher wrote: post #288
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

I de-obfuscated most of it and didn't see anything malicious. Was there any particular file that was concerning?

I missed it-- it's in the release notes file. I uploaded it to pastebin. It does look malicious.

https://pastebin.com/H5QjS4Bt

Re: Material Theme has been pulled from VS Code's marketplace

#412

Post by vlovich123 »

ajross wrote: post #408
vlovich123 wrote: post #406

Earlier quoted context omitted.

Remember, when we're triggered our reading comprehension goes down and we confuse emotion for facts. Did I say they ship more/less code? No, first I was talking about the user base size and the economic incentives for malicious users. For the most popular package: Debian: ~253K installs per month [1] NPM: ~236M installs per month [2] VSCode: ~158M installs total [3] Obviously VSCode is hard to compare, but the most p…

The "triggered" bit is just flaming. Please stop that. But I'm not following how you get from popularity numbers to "attack surface". The latter is a term of art that reflects the amount of complexity on the "outside" of a software system that can be interacted with by an attacker. It correlates well with "amount of code". I don't see that it has any relation at all to number of installs.

I originally used attack surface imprecisely in terms of how many people you compromise with a single vulnerability. In other words the economic value of the attack. But also in the formal term of art, it's still true that NPM has a larger attack surface with many more weak points than something like Debian has. VSCode is trickier since it's a single application, so may not be from that perspective. However, it is basically running Chrome so it is still quite a large attack surface area.

But sure, let's use "amount of code" as a proxy. Debian has ~123GiB of source code [1] across ~65k packages [2] while NPM has 74 GiB [3] if I'm reading it correctly (other sources say 128 GiB) across 3.3 M packages [4]. Given that JS requires less code than C for equivalent functionality (due to a richer runtime & no memory management), any way you slice it, NPM is a much larger attack surface both in terms of number of opportunities and how valuable the attack is.

[1] https://www.debian.org/mirror/size

[2] https://www.debian.org/doc/manuals/debian-faq/basic-defs.en....

[3] https://replicate.npmjs.com/

[4] https://en.wikipedia.org/wiki/Npm#Registry

Re: Material Theme has been pulled from VS Code's marketplace

#413

Post by sigmoid10 »

bun_at_work wrote: post #295
sigmoid10 wrote: post #168

Curiously, someone on reddit noticed suspicious changes in this extension 7 months ago [1]. Obfuscation in open source is usually an extreme red flag. Microsoft really needs to rethink their security model for vs code extensions. It has simply become way too profitable to target given whatever they are doing against it. For every dev they ban 10 will come with new malicious extensions. [1] https://www.reddit.com/r/vs…

Be careful what you wish for. VS Code is maybe the best product Microsoft has ever released, largely because the extension market. If Microsoft polices the marketplace more, you can probably expect VS Code quality to degrade. Here's my argument: More scrutiny of the marketplace will lead to less extensions overall (the scrutiny process will reduce the number of extensions overall as barrier to entry will be increased…

It took a while, but Microsoft got it pretty much right with Windows Defender. It quietly made all other active scanners obsolete. It's just a question of how much effort they're willing to spend on a free product's infrastructure.

Re: Material Theme has been pulled from VS Code's marketplace

#414

Post by CamperBob2 »

cratermoon wrote: post #398
CamperBob2 wrote: post #369

Earlier quoted context omitted.

But they didn't murder their own customers. Their customer, a government , did the murdering. As long as government claims the right to a monopoly on violence, it is reasonable to hold them to far, far higher standards than anyone else, including corporations. There is only so much damage one company or one cartel can do, but with government, the downside is unbounded. As I suspect we're about to see for ourselves.

Nah, let go of that monopoly on violence claptrap. Governments can't do things without corporations to build stuff for them. > Their customer, a government, did the murdering. Using stuff the corporation made and profited from. Max Weber died in 1920, get some new economics.

The monopoly-on-violence claptrap gets shoved in my face whenever I argue against gun control on the Internet, so now you get a dose of it. Sorry. :)

Meanwhile, remind me what corporations built Stalin's infrastructure?

Re: Material Theme has been pulled from VS Code's marketplace

#415

Post by memsom »

cratermoon wrote: post #228
memsom wrote: post #225

Earlier quoted context omitted.

It's pretty mild, but still offensive in the UK. Your friend was right to believe that much. That everyone thinks it means that? No - the US uses it differently for a region of the body slightly less offensive. It's a bit like spunk, which is also fairly offensive in the UK, and fag, which despite having an offensive meaning in the US, is actually traditionally not offensive here, though the US meaning is known and s…

Remember when fanny packs were a thing?

No, we didn't call them that. Bum bag was the name. Bum being about as profane as fanny in the US, and probably the same thing.

Re: Material Theme has been pulled from VS Code's marketplace

#417

Post by ukFxqnLa2sBSBf6 »

GlacierFox wrote: post #416
ukFxqnLa2sBSBf6 wrote: post #400

Earlier quoted context omitted.

Likewise

lIkEwIse

Never beating the insecurity allegations are you? I don’t know what I did to trigger you but this whole conversation is really sad. The “Reddit level insult” projection is extra sad since I come to this site over Reddit to get away from people like you.

In my personal life I have a lot of health issues (mostly autoimmune diseases) that cause me a lot of pain through out the day. It’s inescapable too so its really hard to cope. Sometimes it’s tolerable other times I’m in a black hole of pain and suffering. But it’s actually heart warming to know despite all my struggles that I’ll never be even half as lonely and miserable as you.

Seriously, grow up.

Re: Material Theme has been pulled from VS Code's marketplace

#418

Post by HelloNurse »

flutas wrote: post #409
HelloNurse wrote: post #393

Earlier quoted context omitted.

Obfuscated code is malicious, even in case it's harmless.

Then never download an Android app, they're obfuscated by default.

Obfuscating Javascript is entirely unnecessary: it signals that the author thinks that they have something to hide.

At the very least, the author has delusional notions about the greatness of their source code and they worry about piracy, meaning that there is a high probability of stupid bugs and that they would be difficult to notice because of the obfuscation.

Of course in this case the default assumption should be that there is something malicious to hide.

Re: Material Theme has been pulled from VS Code's marketplace

#419

Post by ytpete »

joshka wrote: post #111
WhyNotHugo wrote: post #92

Earlier quoted context omitted.

The issue to which op links now yields 404. What's up with that?

https://web.archive.org/web/20250226020241/https://github.co...

Weirdly, this Wayback link is now also a 404. I didn't realize content can retroactively get removed from the archive like that – doesn't that sort of defeat one of its main purposes?
Post reply on HN