Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Material Theme has been pulled from VS Code's marketplace

github.com

Post reply on HN
Print view View original

91–100 of 424 posts

Re: Material Theme has been pulled from VS Code's marketplace

#91

Post by phyzix5761 »

gamedever wrote: post #84
oefrha wrote: post #29

Earlier quoted context omitted.

The original author seemed to talk a lot about funding development/maintenance, so I got curious about what the hell needs to be maintained. I cloned the https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you repo and had a look. Here's a LoC summary: =============================================================================== Language Files Lines Code Comments Blanks ==========================================…

it's a problem. As soon as it became easy to ask for money via Patreon or githib sponsorship, etc... tons of people are going to try to get some for minimal effort. It's just the nature of the beast.

I think effort is irrelevant. Value is what we really look at when deciding what price to pay. It doesn't matter to most people if it took someone a 1000 hours to produce a loaf of bread. They're not going to pay 100x the price of the bread that took 10 hours to produce. Especially, if the products are mostly indistinguishable.

Re: Material Theme has been pulled from VS Code's marketplace

#92

Post by WhyNotHugo »

isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

The issue to which op links now yields 404. What's up with that?

Re: Material Theme has been pulled from VS Code's marketplace

#93

Post by buttercraft »

isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Just to be clear, which publisher was banned? Maybe I'm being stupid (it's late here) but I'm struggling to track the various parties involved.

Anyway, thank you for the update.

Re: Material Theme has been pulled from VS Code's marketplace

#94

Post by isidorn »

WhyNotHugo wrote: post #92
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

The issue to which op links now yields 404. What's up with that?

I am in European time and I do not know what happened on that post (since I was sleeping). I assume it were some heated arguments between maintainer and community about license/copyrights/open source maintenance.

Re: Material Theme has been pulled from VS Code's marketplace

#95

Post by isidorn »

buttercraft wrote: post #93
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Just to be clear, which publisher was banned? Maybe I'm being stupid (it's late here) but I'm struggling to track the various parties involved. Anyway, thank you for the update.

The publisher Equinusocio was banned.

Re: Material Theme has been pulled from VS Code's marketplace

#96

Post by anakaine »

isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

You might need to chase down reuploads, too.

https://marketplace.visualstudio.com/items?itemName=t3dotgg....

Re: Material Theme has been pulled from VS Code's marketplace

#97

Post by fragmede »

isidorn wrote: post #90
ande-mnoc wrote: post #89

Earlier quoted context omitted.

Will Microsoft consider adding a permission model for extensions?

This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116 We do not plan to add a permission model in the next 6 months.

Given the enormity of the attack surface that has just been exposed, that's disappointing.

Re: Material Theme has been pulled from VS Code's marketplace

#98

Post by theobr »

joshka wrote: post #87
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

Can you please clarify whether the fork also suffers from the same security issues (or engage the fork's owner to ensure that it doesn't https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you )

Hi, owner of the fork here.

I did a thorough combing of the code base when I forked. Just did another audit and still not seeing anything suspicious. Gutting all of the opencollective and changelog code to be 1000% sure.

Re: Material Theme has been pulled from VS Code's marketplace

#99

Post by isidorn »

anakaine wrote: post #96
isidorn wrote: post #79

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…

You might need to chase down reuploads, too. https://marketplace.visualstudio.com/items?itemName=t3dotgg....

Thanks. Our security researchers will review this today and we might take it down. We reached out to the new author and he does not have malicious intent, and agreed that we just take down the new extension if we see something is off.

Re: Material Theme has been pulled from VS Code's marketplace

#100

Post by oefrha »

gamedever wrote: post #84
oefrha wrote: post #29

Earlier quoted context omitted.

The original author seemed to talk a lot about funding development/maintenance, so I got curious about what the hell needs to be maintained. I cloned the https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you repo and had a look. Here's a LoC summary: =============================================================================== Language Files Lines Code Comments Blanks ==========================================…

it's a problem. As soon as it became easy to ask for money via Patreon or githib sponsorship, etc... tons of people are going to try to get some for minimal effort. It's just the nature of the beast.

Asking for money isn’t a problem. The problem is this person went out of their way to extract money by harassing people who rightfully use the open source Apache 2 version, switching the marketplace extension to a closed source version with obfuscated code (likely malicious according to MS), and possibly more, all this for doing a quite small amount of work. That’s after already raising $7.6k, apparently.
Post reply on HN