3 ms·
VSCode doesn’t even provide a framework for enabling that decision making. Sure, you could forgo the use of any plugins, but so much of VScode’s functionality i
by numbsafari 3y ago
VSCode doesn’t even provide a framework for enabling that decision making. Sure, you could forgo the use of any plugins, but so much of VScode’s functionality is derived from plugins, you’d be better off just using notepad.
To be fair, vim and emacs aren’t any better.
Most of our dev tools are based on plug-in models that have zero security model baked in.
- thenerdhead 3y ago> VSCode doesn’t even provide a framework for enabling that decision making. How about notable publisher, verified publisher, # of downloads, rating, reviews, README, GitHub repository, extension icon, project details, repository maintenance, etc?
- numbsafari 3y agoMost of those are social signals, and social engineering is a thing. Sure, you can read the code for every single update for every single plug-in you have to use for VSCode to function. Having a proper set of API boundaries with security guarantees is the right solution. Even “notable publishers” can get hacked. I don’t even understand why it’s an open question, tbh.