Workspace Trust in VS Code

#1

Post by ItalyPaleAle » Tue, Jul 06, 2021, 4:37 PM UTC

Workspace Trust in VS Code
code.visualstudio.com

Re: Workspace Trust in VS Code

#2

Post by swiley » Tue, Jul 06, 2021, 5:23 PM UTC

This is why I don't use editor configurations that execute code from files I open.

I prefer zero trust.

Re: Workspace Trust in VS Code

#3

Post by duped » Tue, Jul 06, 2021, 5:24 PM UTC

Total anecdata but I don't appreciate the nag screen every time I've opened repos that I have either authored or contributed heavily to... I default to "yes I accept in this directory and all directories" which seems very sketchy in general, but is the easiest for me to get my work done.

Re: Workspace Trust in VS Code

#4

Post by sergiomattei » Tue, Jul 06, 2021, 5:33 PM UTC

duped wrote: post #3

Total anecdata but I don't appreciate the nag screen every time I've opened repos that I have either authored or contributed heavily to... I default to "yes I accept in this directory and all directories" which seems very sketchy in general, but is the easiest for me to get my work done.

This happens even in files I just created or when doing `code ~./zshrc`.

It's pretty annoying. I'm a developer, I know what I'm doing. I don't need to be asked whether I trust a Python notebook or not.

Re: Workspace Trust in VS Code

#5

Post by incrudible » Tue, Jul 06, 2021, 5:47 PM UTC

sergiomattei wrote: post #4

duped wrote: post #3

Total anecdata but I don't appreciate the nag screen every time I've opened repos that I have either authored or contributed heavily to... I default to "yes I accept in this directory and all directories" which seems very sketchy in general, but is the easiest for me to get my work done.

This happens even in files I just created or when doing `code ~./zshrc`. It's pretty annoying. I'm a developer, I know what I'm doing. I don't need to be asked whether I trust a Python notebook or not.

> I'm a developer, I know what I'm doing.

famous last words

Re: Workspace Trust in VS Code

#6

Post by nathanaldensr » Tue, Jul 06, 2021, 5:55 PM UTC

Ah, the classic tug of war continues between the principle of least privilege and convenience/productivity. It's safe to say people's opinions are all over the spectrum.

Despite favoring "least privilege" myself, I find the new nag screens overbearing. I think some basic UI reworking can help to alleviate that, though. It's a new feature; they'll get it right within a couple of iterations.

Re: Workspace Trust in VS Code

#7

Post by conceptme » Tue, Jul 06, 2021, 5:58 PM UTC

It's usually a bit silly, yes i trust the author of this directory but I have no clue about the authors under node_modules.

Re: Workspace Trust in VS Code

#8

Post by sdiq » Tue, Jul 06, 2021, 5:58 PM UTC

Based on the first four comments, I see some do not appreciate this unlike me, at least. Just last-night, I was forced to download a zipped folder with source code from a site I was new to. Well, I did appreciate using this new feature because I wasn't sure what I of the 'trustworthiness' of the folder.

Re: Workspace Trust in VS Code

#9

Post by 74B5 » Tue, Jul 06, 2021, 6:14 PM UTC

sdiq wrote: post #8

Based on the first four comments, I see some do not appreciate this unlike me, at least. Just last-night, I was forced to download a zipped folder with source code from a site I was new to. Well, I did appreciate using this new feature because I wasn't sure what I of the 'trustworthiness' of the folder.

>I see some do not appreciate this

It is the same approach to defend off phishing attacks in large corporations: shift the responsibility to the user.

In my opinion, this is just another scream for codified capabilities. Which would be a real solution and not just repeatedly a click away from disaster.

Re: Workspace Trust in VS Code

#10

Post by swiley » Tue, Jul 06, 2021, 6:18 PM UTC

sdiq wrote: post #8

Based on the first four comments, I see some do not appreciate this unlike me, at least. Just last-night, I was forced to download a zipped folder with source code from a site I was new to. Well, I did appreciate using this new feature because I wasn't sure what I of the 'trustworthiness' of the folder.

If I had to download source in zip format I probably wouldn't touch it outside a VM.