7 ms·
Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry a
by fwlr 3y ago
Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.)
“…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies. And this makes it hard to hide malware.” https://borretti.me/article/how-capabilities-work-austral https://borretti.me/article/how-capabilities-work-austral
The original quote talks about a leftpad dependency but it’s a drop-in substitution to apply it here, too. It’s right there in the screenshot:
const https = require(‘http’)
const os = require(‘os’)
Both of those calls ought to error out with “Error: Network capability not provided” and “Error: filesystem capability not provided”, respectively.
- ryanjshaw 3y agoCapabilities can improve the situation significantly but we need to change how we build software too e.g. ".env" files in the project space will still be vulnerable due to the confused deputy problem.
- Gigachad 3y agoYeah, android tried this initially with the permissions system. But literally every app requested every permission and it became completely useless. As a user, you have no way of meaningfully using this info.
- carlmr 3y agoI'd say VSCode is a bit different in who it's aimed at. Only because it doesn't work for a consumer product doesn't mean this wouldn't work for VSCode. Also it might be good to be more specific. E.g. don't ask for all permissions at once, instead if the app starts talking to telemetry.endpoint.com it has to ask for these specific permissions at that point. Then the user can see, hey this is requesting access to this particular server, that seems fishy, let's not proceed.
- Gigachad 3y agoAre VSCode users really that much more diligent? Are you auditing the source code for every extension you install? Do you even know if the github source is the same as whats hosted on the plugins repo? The only real solution I can see is only installing plugins from large trusted entities.
- explaininjs 3y agoFor sketch extensions, download the vsix from the marketplace and extract it (it’s just a zip), then inspect that and load it.
- joshuaissac 3y ago> android tried this initially with the permissions system. But literally every app requested every permission and it became completely useless. Google could have fixed this by allowing the user to give the app mock permissions instead, e.g. empty or randomly-generated storage, fake camera device, randomly-generated contact list, etc. Third-party solutions that allow this have been around for about a decade, but they do not have the reach that Google does.
- deleted 3y ago[deleted]
- ryanjshaw 3y agoUsers here are experienced developers, so I think it's not such a big deal. In context, a theme should never need network or file storage access, so you could upfront block those for that type of extension. You can also have policies like "network access is okay but file system and network access together needs approval".
- brabel 3y agoWhy are you assuming most VSCode users are "experienced developers"? I would think quite the contrary, as the younger crowd is probably much more likely to be using it than more experienced developers.
- ryanjshaw 3y agoFair enough. I think we can agree that the average VS code developer is more technically savvy than the average Android user?
- Gigachad 3y agoI find I very quickly tire of having to think about this. You think "A theme shouldn't require file storage access" and then spend an hour looking up why it does and find out there is actually some strange but totally legitimate reason for it. And every time that happens, you lose a little bit of will to care about what permissions something requested. There used to be a period where many android apps would explain in the description why they needed certain permissions. Those days are over.
- codedokode 3y ago> You think "A theme shouldn't require file storage access" and then spend an hour looking up why it does and find out there is actually some strange but totally legitimate reason for it No. You think it is suspicious and install another theme that doesn't request anything.
- fwlr 3y agoA counter-example where a permissions system mostly still works is Mac apps. They also have to request permissions for things like using the webcam, accessing important areas of the filesystem, reading keyboard input when they’re not the active program, and so on. It might be illustrative that Apple, who usually care a lot about good UX, made this procedure downright painful. When the app is installed it’s fine, but when it tries to use a permissioned resource for the first time that pops up a dialog box. That box is not confirm/deny, but rather sends you to the System Settings window, where you have to find the right category, find the program in that category, select Allow, and then enter your password. It seems like Apple might think the Android permissions system failed in part because they made it too easy to say yes.
- dist-epoch 3y agoI regularly deny various permissions to various Android apps (camera permission, file access, ...) and they degrade gracefully and keep on working.
- codedokode 3y agoIf there was a permission dialog with boxes I would gladly check or uncheck them because nowadays I need to write bash scripts, create separate users or build containers for every third-party app. Why doesn't OS include necessary tools?
- marcosdumay 3y ago> But literally every app requested every permission They didn't. Google regrouped and renamed the permissions until every normal thing that every application needed became grouped with rare and powerful capabilities. Except for the ad-based crapware, almost all applications minimize their permissions.
- pfg_ 3y agoAndroid used to ask for all permissions upfront, you have no choice. You want the app? Too bad, it is gets access to your contacts. Now apps have to ask when they need them and they are working on making file permissions more granular as well
- codedokode 3y agoYes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to systemd DNS resolver via DBUS and exporting your keys as DNS requests). Security is a joke in Linux in default configuration. > . It should be an obvious red flag if a [theming addon] were to ask for those dependencies No. Theming addons should not even be able to ask for those privileges.
- capableweb 3y agoAt least there is practiced, hardened and battle-tested tools that are relatively straight-forward to use in Linux-land, like AppArmor. MacOS also recently started investing more into securing the desktops of developers. Windows seems shit out of luck in that regards.
- wcoenen 3y agoI'm not sure whether it does what you want, but Windows has "Windows Sandbox": https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://learn.microsoft.com/en-us/windows/security/threat-pr...
- megous 3y ago> every program you install gets full access to the system It gets your user's privileges when you run it. It's up to you how you run your programs. Also there's no "default Linux configuration". There are many distributions, and they have different defaults and approaches.
- eviks 3y agoMany distros with many approaches, yet not a single one with a convenient security feature that comment is mentioning So it's not "up to me" if the good choice is not practical
- oofsa 3y agoI want that feature too, but in reality, many non-trivial extensions require the execution of binaries such as language servers. Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge. In fact, even an extension to auto-complete paths in .gitignore files requires running a language server written in Rust [1], and it has the real benefit of supporting multiple editors with ease. If the "prettiest java" or "python-vscode" extensions in the article insisted on needing full permissions for Java or Python execution, I believe users would be convinced and end up installing them. [1] https://github.com/quentinguidee/gitignore-ultimate-vscode https://github.com/quentinguidee/gitignore-ultimate-vscode
- rascul 3y agoA language server for gitignore is not what I was expecting to come across this morning. https://github.com/quentinguidee/gitignore-ultimate-server https://github.com/quentinguidee/gitignore-ultimate-server
- fwlr 3y agoThis… is a very strong objection and I think you’re right that users would be convinced. I didn’t think capabilities would be a panacea but I did think they would be pretty close, I have to revise that down somewhat.
- codedokode 3y ago> Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge. This is because most OSes use outdated security model where the app gets all privileges by default and poor users have to build containers to revoke them, that's why there is an overhead. If the extension only has access to project files then all applications launched by it should inherit its restrictions.
- PoignardAzur 3y agoCouldn't you just run the language server in webassembly?
- arthie 3y agoThis is exactly what deno does: https://deno.com/manual@v1.33.4/basics/permissions https://deno.com/manual@v1.33.4/basics/permissions
- explaininjs 3y agoNo, the fundamental uselessness of Deno is that it only supports process based permissions (a fact I initially debated with them over 4 years ago now…). For performance reasons all extensions run in the same process, so that wouldn’t work here.
- ashishbijlani 3y agoPackj [1] flags malicious/risky NPM/PyPI/RubyGems packages by carrying out static analysis and looking for capabilities/permissions (diff from runtime permission enforcement). Supporting VSCode/browser extensions is on our roadmap. Disclaimer: I'm the lead developer. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
- arp242 3y agoIn the context of an editor, this can be bypassed by writing this kind of code to the project, which will be run when the developer runs the project, runs tests, or in some languages even when the project is compiled. A theme probably doesn't need access to the project files, but many extensions do. This is much harder to solve than in e.g. Android.