4 ms·
> Date reported: 8/24/2022 > Date fixed: 10/11/2022 ONE AND A HALF MONTHS to fix this? Am I reading this right?!? This should have been a same-week emergency
by p-e-w 4y ago
> Date reported: 8/24/2022
> Date fixed: 10/11/2022
ONE AND A HALF MONTHS to fix this? Am I reading this right?!? This should have been a same-week emergency patch.
> Date disclosed: 11/22/2022
So anyone who didn't update VSCode during those 6 weeks is vulnerable to a publicly documented RCE. Lovely.
It's nothing short of insane that we have to treat our text editor as a high-risk potential backdoor that might suddenly open to anyone unless we click the "Check for Updates" button every few hours.
- booi 4y agoSaying Vscode is a text editor is like saying Autocad is a piece of virtual paper. Not exactly a fair assessment. I’m actually surprised there haven’t been more significant issues
- theteapot 4y agoThat we know about. Last I checked VSCode extensions run completely unsandboxed, at least on Linux. It's only a matter of time before a malicious one is discovered.
- jbverschoor 4y agoWIth the current state of software it makes most sense to have each project live in a container / vm. Including all dependencies, and visual code. Unfortunately using visualcode server isn't safe enough either. Something like qubes seems to be the future.. or present if you're running it :-)
- deleted 4y ago[deleted]