4 ms·

Using VS Code + Markdown All in One (https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one https://marketplace.visualstudio.com/items?i

• kretaceous 5y ago
  +1. Also, Copy Image to File. Very very handy for snipping and just pasting it in the Markdown document you're editing.
  • cyberge99 5y ago
    This is an incredibly difficult plugin to search for. Can you post a link to it or provide the author's name?
    • InvaderFizz 5y ago
      I was also curious. I found an extension called Markdown Paste[0], by searching for an extension to automatically base64 encode images into markdown in VSCode, which is not how this extension works at all. 0: https://marketplace.visualstudio.com/items?itemName=telesoho.vscode-markdown-paste-image https://marketplace.visualstudio.com/items?itemName=telesoho...
    • cdaven 5y ago
      Not the same extension, but Dendron actually has one: https://marketplace.visualstudio.com/items?itemName=dendron.dendron-paste-image https://marketplace.visualstudio.com/items?itemName=dendron....
      • kevinslin 5y ago
        the reason we have our own extension is because dendron is also available on vscodium and the `paste image` extension was not available there
    • kretaceous 5y ago
      Really sorry! I was not on my laptop so couldn't post an extension link. Here it is: https://marketplace.visualstudio.com/items?itemName=mushan.vscode-paste-image https://marketplace.visualstudio.com/items?itemName=mushan.v...
• krono 5y ago
  Still amazed by the amount of external production dependencies these VSCode extensions all seem to require. I wonder how tight Microsoft's grip is on extension security and how deep any of their automated checks might go. The extension functionality does look great though. I wrote some similar functions in my nvim which I would have really a hard time living without.
  • qbasic_forever 5y ago
    It's no different or worse than the security model of any other text editor or IDE. It runs as your user (unless you're doing something zany like running an admin account), and it can do anything your user can do like launch programs or subprocesses you have access to execute. A vs code extension isn't going to get some unexpected power like root privilege to start messing with your system, opening low ports, etc.
    • krono 5y ago
      You're right, what I'm curious about is how difficult it'd be to sneak a malicious command into some VSCode extension update trough these production dependencies, and how far, say, an rm -rf <allthethings> could reach from the trusted project root directory from which it is executed. I'm not a VSCode user myself, but it's pretty much the same story with nvim. edit: I suppose what I'm really getting at, is that, depending on what their security measures look like, the VSCode extension store might be giving some false sense of security.
      • lstamour 5y ago
        A lot of supply chain security relies on trusted actors doing the right thing. It’s similar to how you can trust an ingredients label. I suppose I could mention that on a Mac, I use Objective-See’s tools to watch what programs do in the background. And also on a Mac, you have to grant access to apps first otherwise they can’t normally access files. Of course, that breaks down in reality as most apps are useless if they can’t access files. If you really want a scare, consider that if you compromise an ecosystem package (e.g. npm), you can run on developer machines, CI systems and possibly in production, while if you compromise a VS Code extension, you only get dev machines. If you’re looking for a bit of extra protection, you can run VS Code from a virtual machine or even run it from Docker. Though the usual docker approach, using remote containers extension, still runs on your local computer. There’s GitHub Codespaces or Google Cloud Shell that can run VS Code remotely in a VM, though.
• oxff 5y ago
  I use VSCode + Foam (wikilinks) + MAIO. It is the best note tool I've found.