3 ms·

You're right, what I'm curious about is how difficult it'd be to sneak a malicious command into some VSCode extension update trough these production dependencie

by krono 4y ago

You're right, what I'm curious about is how difficult it'd be to sneak a malicious command into some VSCode extension update trough these production dependencies, and how far, say, an rm -rf <allthethings> could reach from the trusted project root directory from which it is executed. I'm not a VSCode user myself, but it's pretty much the same story with nvim. edit: I suppose what I'm really getting at, is that, depending on what their security measures look like, the VSCode extension store might be giving some false sense of security.

lstamour 4y ago
A lot of supply chain security relies on trusted actors doing the right thing. It’s similar to how you can trust an ingredients label. I suppose I could mention that on a Mac, I use Objective-See’s tools to watch what programs do in the background. And also on a Mac, you have to grant access to apps first otherwise they can’t normally access files. Of course, that breaks down in reality as most apps are useless if they can’t access files. If you really want a scare, consider that if you compromise an ecosystem package (e.g. npm), you can run on developer machines, CI systems and possibly in production, while if you compromise a VS Code extension, you only get dev machines. If you’re looking for a bit of extra protection, you can run VS Code from a virtual machine or even run it from Docker. Though the usual docker approach, using remote containers extension, still runs on your local computer. There’s GitHub Codespaces or Google Cloud Shell that can run VS Code remotely in a VM, though.
- krono 4y ago
  Most projects I'm involved with require measures that go a bit further still. Got to be honest though, it can be frustrating at times. Just sprinkling bits of awareness around by bringing some of these considerations up whenever I can. It's an uphill battle, although, the general carelessness around extension and dependency use I'm seeing - and that even after all the shit that's been going on in that space - makes it one worth to fight. Edit: Regarding the chain of trust you mention, that one has sort of come and gone, and there is not a whole lot of trust involved in the processes I'm saddled up with.

by krono 4y ago

lstamour 4y ago

A lot of supply chain security relies on trusted actors doing the right thing. It’s similar to how you can trust an ingredients label. I suppose I could mention that on a Mac, I use Objective-See’s tools to watch what programs do in the background. And also on a Mac, you have to grant access to apps first otherwise they can’t normally access files. Of course, that breaks down in reality as most apps are useless if they can’t access files. If you really want a scare, consider that if you compromise an ecosystem package (e.g. npm), you can run on developer machines, CI systems and possibly in production, while if you compromise a VS Code extension, you only get dev machines. If you’re looking for a bit of extra protection, you can run VS Code from a virtual machine or even run it from Docker. Though the usual docker approach, using remote containers extension, still runs on your local computer. There’s GitHub Codespaces or Google Cloud Shell that can run VS Code remotely in a VM, though.

krono 4y ago
Most projects I'm involved with require measures that go a bit further still. Got to be honest though, it can be frustrating at times. Just sprinkling bits of awareness around by bringing some of these considerations up whenever I can. It's an uphill battle, although, the general carelessness around extension and dependency use I'm seeing - and that even after all the shit that's been going on in that space - makes it one worth to fight. Edit: Regarding the chain of trust you mention, that one has sort of come and gone, and there is not a whole lot of trust involved in the processes I'm saddled up with.