421–430 of 488 posts
Earlier quoted context omitted.
I am so, so stressed about Sublime Text... It feels like a massive disaster just waiting to happen. They don't even run their own package marketplace :(
There are so few users of sublime text that it likely isn’t a juicy enough target for these sorts of exploits.
Earlier quoted context omitted.
Thinking a GitHub uptime joke is so creative only one person could have thought of it? Wow.
It’s a word for word copy from the original.
> I'm more surprised hackers found a large enough uptime window to do this.
Certainly not a novel thought. But may I suggest you brush up on https://pbskids.org/games/play/sorting-box/487
Earlier quoted context omitted.
Good point. Any editor is a needless dependency. True developers just scream at the universe and it responds with cosmic radiation that flips the correct bits to form the binary code they intended.
True developers don't leak the keys to their sources just because they need convenience-features from a "free IDE with tons of sexy bells and whistles" .. Features that would, incidentally, be obviated by making just a bit of a better effort to be better managers of the filesystem and ones' source code - and thus: become more competent developers. There is a limit to the positive impact of convenience features in any…
I can assure you I am not.
Earlier quoted context omitted.
The vast majority of devs in the last few years have either been raised as sloppers or transitioned from developers to sloppers. Programming has evolved into a blackbox where fewer than ever people know how a program works, despite the numbers of "programmers" has skyrocketed. Just a few months ago a friend had a job interview(fake one obviously) where he was asked to clone a repo and do some stuff on it. The repo co…
What are “vs code hooks” exactly? A search for that or “VSCode Hooks” isn’t turning up anything for me in Kagi or Google…
I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…
The vast majority of devs in the last few years have either been raised as sloppers or transitioned from developers to sloppers. Programming has evolved into a blackbox where fewer than ever people know how a program works, despite the numbers of "programmers" has skyrocketed. Just a few months ago a friend had a job interview(fake one obviously) where he was asked to clone a repo and do some stuff on it. The repo co…
Earlier quoted context omitted.
There's nothing really special about VSCode here, except that it's really popular. You could just as easily attack Emacs or Vim or Sublime or [...] users by distributing a malicious extension.
You can’t attack them that easily because of the different publication method. Emacs, Vim, and Sublime have a pull model (like linux distros), not a push model. Meaning you add your repos to the package hub, you do not upload an archive to them. The Hub will pull in you changes (or the plugin manager will do so). The only way in is to take over the repo itself.
Earlier quoted context omitted.
Answer: Because the "random stuff" (plugins for VS Code and other IDEs) solves real problems and nothing bad happens most of the time. Almost no manager will sign-off spending time on building stuff in-house if its available "for free". This is also in no way a new thing. How much code was written in notepad++ in the '00ies? Did anyone bother to check if the plugins did sth. malicious? We also used some weird closed-…
"solves real problems and nothing bad happens most of the time." Like Wordpress plugins previously that'll work for now but we're now on the trajectory of relearning that same lesson, because people are automating discovery and exploitation of these extensions and plugins and whatnot around text editors and MCP and so on. Though I suspect we'll first see a torrent of exploitation similar to what was done to Wordpress…
In addition, we need a fundamental change in OS security. It's not OK that every application you run has access to all your files and unfiltered internet access by default.
Earlier quoted context omitted.
True developers don't leak the keys to their sources just because they need convenience-features from a "free IDE with tons of sexy bells and whistles" .. Features that would, incidentally, be obviated by making just a bit of a better effort to be better managers of the filesystem and ones' source code - and thus: become more competent developers. There is a limit to the positive impact of convenience features in any…
Your comment implies that you've somehow misunderstood my comments and thus think that I am using Microsoft's hot garbage text editor with a million plugins. I can assure you I am not.
Earlier quoted context omitted.
The vast majority of devs in the last few years have either been raised as sloppers or transitioned from developers to sloppers. Programming has evolved into a blackbox where fewer than ever people know how a program works, despite the numbers of "programmers" has skyrocketed. Just a few months ago a friend had a job interview(fake one obviously) where he was asked to clone a repo and do some stuff on it. The repo co…
What are “vs code hooks” exactly? A search for that or “VSCode Hooks” isn’t turning up anything for me in Kagi or Google…