Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

481–488 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#481

Post by hahn-kev »

jakemm wrote: post #336

There is a Feature request from 2018 that I have been following for a long time to ask for VSCode Sadbox. I do not understand how Microsoft is not putting it up in priority. https://github.com/microsoft/vscode/issues/52116

Sadly the LSP pattern means that most extensions launch their own process so there's limited sandboxing options there. Sure not every extension needs its own process, but if most of them do then there's very limited benefit from permissions or sandboxing. As nice as the LSP is, the design basically means any IDE wanting to use common ones need to let extensions include and start their own processes.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#482

Post by ozim »

stogot wrote: post #161
ozim wrote: post #91

Earlier quoted context omitted.

It is also company behind NuGet. Guess what they did a year ago. They removed 700 or so packages from NuGet proactively but those turned out to be false positives. It is hard to do the right things.

It is hard for Microsoft to do the right things* FTFY

Continued devils advocate.

It is hard to do right things at their scale and when you do the right thing other division might actively work against you.

There was this „how companies work” image where MSFT was each division pointing guns at each other.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#483

Post by galkk »

salawat wrote: post #220
miki123211 wrote: post #173

Earlier quoted context omitted.

Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.

Never let a crisis go to waste, huh? We've had the solution to shit like this, and it's called the SecurityManager in Java. No one wants to configure the damn thing, but it is there. Also, auditing the code you pull in . Yeah. Reading code sucks. Yeah. It's a lotta work. But if you don't check, you don't effing know. All y'all want the fun of unprotected sex (rawdogging the ecosystem) and are starting to get burned b…

No, it doesn't have Security manager https://docs.oracle.com/en/java/javase/17/docs/api/java.base...

and the fact that you mention it means that you haven't used it too, because the tools are screaming in logs that it is deprecated.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#484

Post by tstrimple »

bbor wrote: post #421
tstrimple wrote: post #199

Earlier quoted context omitted.

There are so few users of sublime text that it likely isn’t a juicy enough target for these sorts of exploits.

10% of developers use Sublime Text

What an absolutely ridiculous claim to make.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#486

Post by rrvsh »

no-name-here wrote: post #309
camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

> … use Code Server in a docker container … I'm guessing you're referring to https://coder.com/docs/code-server ?

most likely - used this for 6 months before dropping vs code and loved it if you don't mind using the browser

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#487

Post by wyclif »

paholg wrote: post #302
danpalmer wrote: post #274

Earlier quoted context omitted.

Fair point, I hadn't considered this, but wouldn't they just disallow it? Like, I use a VSCode fork at work, but the enforced extensions store backend is based on an allowlist and extensions need reviewing to be available there.

When I worked at Amazon, I had to run a special Amazon Linux. But I could just install whatever I wanted. I used emacs with whatever plugins I wanted. Big tech can be suprisingly not locked down!

Ah, that must have been AL2023, right? IIRC, it's tightly integrated with internal deployment toolchains like Apollo and Brazil (Amazon's internal package management and build systems).

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#488

Post by [deleted] »

no-name-here wrote: post #282
cwnyth wrote: post #184

Earlier quoted context omitted.

I've stayed with Sublime, often to the derision of VSCode addicts. I love to see the "VSCode is perfect" uncritical thinkers get theirs.

Sublime also has packages. https://packagecontrol.io Sublime's de facto package control repository is handled by an Uber engineer and father of 5 in his spare time, not someone currently at Sublime per https://packagecontrol.io/about / https://packagecontrol.io/say_thanks and his linked site. VS Code Marketplace seems to have a number of protections in place: https://code.visualstudio.com/docs/configure/extensions/ex…

[deleted]
Post reply on HN