3 ms·

If your dev machine contains credentials, like private ssh keys, aws keys, npm auth tokens, github tokens, etc, the compromise still can do some damage. One ve

If your dev machine contains credentials, like private ssh keys, aws keys, npm auth tokens, github tokens, etc, the compromise still can do some damage. One very real benefit that separation gives you is that if you consciously run your email and banking outside of the VM, you now have a VM barrier between those things, meaning the malware now can _only_ steal ssh keys and docker logins and such, not those and your email + banking account password. But really, why stop at just one VM? Why not use Qubes [0] and put your email webbrowser in a different VM from your banking webbrowser, your nodejs development in a different vm from your ruby development? [0]: https://www.qubes-os.org/ https://www.qubes-os.org/

Havoc 6y ago
Interesting concept - didn't know local splitting like that existed. Currently using an ansible/cloud-init approach to spin up VMs on a proxmox server and vscode ssh remote dev in, but I guess it's a case of many ways to skin a cat. SSH keys...yeah was trying to implement a jump server with 2FA but didn't get anywhere with it. VS code ssh remote doesn't seem to like jump servers even without 2FA. Early days though...
- TheDong 6y ago
  FYI, you do lose a small amount of security using vscode remote dev. For example, if the dev server is compromised, vscode offers an api to request the client's clipboard, which may contain sensitive information. If you're using a password manager + browser extension, that does mitigate it quite a bit! It's also possible the remote/local extension API has other issues since it offers a much broader attack surface than, say, just ssh + vim. Clipboards are one of the several security knobs it's hard to get just right when adding layers of security to desktop apps. Qubes does this by having separate clipboards, and requiring specific global hotkeys to move clipboard contents between specific containers [0]. [0]: https://www.qubes-os.org/doc/copy-paste/ https://www.qubes-os.org/doc/copy-paste/

Havoc 6y ago

Interesting concept - didn't know local splitting like that existed. Currently using an ansible/cloud-init approach to spin up VMs on a proxmox server and vscode ssh remote dev in, but I guess it's a case of many ways to skin a cat. SSH keys...yeah was trying to implement a jump server with 2FA but didn't get anywhere with it. VS code ssh remote doesn't seem to like jump servers even without 2FA. Early days though...

TheDong 6y ago
FYI, you do lose a small amount of security using vscode remote dev. For example, if the dev server is compromised, vscode offers an api to request the client's clipboard, which may contain sensitive information. If you're using a password manager + browser extension, that does mitigate it quite a bit! It's also possible the remote/local extension API has other issues since it offers a much broader attack surface than, say, just ssh + vim. Clipboards are one of the several security knobs it's hard to get just right when adding layers of security to desktop apps. Qubes does this by having separate clipboards, and requiring specific global hotkeys to move clipboard contents between specific containers [0]. [0]: https://www.qubes-os.org/doc/copy-paste/ https://www.qubes-os.org/doc/copy-paste/