4 ms·

is this already blocked by default in most corporate environments? it seems this opens up a easy way to exfilarate corporate data (without detection?) correct

is this already blocked by default in most corporate environments? it seems this opens up a easy way to exfilarate corporate data (without detection?) correct me if I am wrong please attacker (or a cooperating employee) can browse and download any files from target machine inside corporate network by opening the generated vscode.dev/tunnel URL from a browser on any device anywhere in the world ?

1letterunixname 3y ago
Yep. A place I worked forked VSCode as it's recommended IDE. VSCode can prevent installation of all but allowlisted extensions by policy. They used an extensive review process for third-party extensions because some components are necessary to run remotely in the development environment instead of on the local machine with the VSCode UI. Random thought: Since there are N editors and M languages, that's N x M plugins. Surely there's a better way to reduce the effort involved.
- eddythompson80 3y ago
  > Random thought: Since there are N editors and M languages, that's N x M plugins. Surely there's a better way to reduce the effort involved. Yeah, it’s called LSP. The core of most plugins is just an lsp that’s shared between vim, neovim, emacs, vscode, sublime, etc. all the editor needs is to support generic lsp, or have a generic lsp plugin like vim/emacs. For example if you look at neovim, you just load the actual lsp and wire it up to the editor in lua. That’s more or less the majority of the “extension code” for something like sublime or vscode (plus some other niceties)
  - 1letterunixname 3y ago
    You're making a dishonest leap here. Language server protocol doesn't create a universal plugin.
    - eddythompson80 3y ago
      What do you mean by a universal plugin?
      - 1letterunixname 3y ago
        LSP doesn't automatically add all possible language support features to all editors using a common API without any extra effort. It gives things like code completion, syntax, and refactoring help, but these are only some of the pieces of language support that each editor must provide rather than a complete solution.
- TeMPOraL 3y ago
  > VSCode can prevent installation of all but allowlisted extensions by policy. Companies using that are probably the reason for, or at least a big motivator for, the feature in question. Lots of developer creativity is spent on working around corporate "security" practices that otherwise prevent work from being done.
  - 1letterunixname 3y ago
    How well would it work to allow every plugin to be used on confidential systems and protected without any sort of review? There's no way to denylist the way out of preventing a keylogger or malicious look-alike plugin retroactively. I think you're painting with a broad brush lacking nuance or understanding the concerns involved.
    - TeMPOraL 3y ago
      I'm painting with a broad brush indeed, as all my nuance has been lost dealing with bullshit like being able to 5x my coding speed by (ab)using my "local admin" rights to discover which magic folders are on the Windows Defender exclusions list, hardcoded by corporate policy, and moving all my stuff there, while seeing requests to kindly just allow us to add our stuff to exclusions locally rejected with responses like "nope, and surely we can resolve the slowdown this causes by reimbursing you for a cooling pad for your laptop".
      - 1letterunixname 3y ago
        Well, that's all well-and-good. You have to deal with the possible and the permitted rather than than complain about how you would do things your way. It's not your company and not your risk. Any time you break legitimate security rules you're putting your job and the jobs of everyone else at risk should there be a massive breach. No one in corporate uses WD because it's unmanaged. OTOH, MDE P1+VM is a steaming pile of shit that arbitrarily deletes things on untold millions of end-user devices because of the way Microsoft doesn't do properly risk management (canary) for new definitions.

1letterunixname 3y ago

Yep. A place I worked forked VSCode as it's recommended IDE. VSCode can prevent installation of all but allowlisted extensions by policy. They used an extensive review process for third-party extensions because some components are necessary to run remotely in the development environment instead of on the local machine with the VSCode UI. Random thought: Since there are N editors and M languages, that's N x M plugins. Surely there's a better way to reduce the effort involved.

eddythompson80 3y ago
> Random thought: Since there are N editors and M languages, that's N x M plugins. Surely there's a better way to reduce the effort involved. Yeah, it’s called LSP. The core of most plugins is just an lsp that’s shared between vim, neovim, emacs, vscode, sublime, etc. all the editor needs is to support generic lsp, or have a generic lsp plugin like vim/emacs. For example if you look at neovim, you just load the actual lsp and wire it up to the editor in lua. That’s more or less the majority of the “extension code” for something like sublime or vscode (plus some other niceties)
- 1letterunixname 3y ago
  You're making a dishonest leap here. Language server protocol doesn't create a universal plugin.
  - eddythompson80 3y ago
    What do you mean by a universal plugin?
    - 1letterunixname 3y ago
      LSP doesn't automatically add all possible language support features to all editors using a common API without any extra effort. It gives things like code completion, syntax, and refactoring help, but these are only some of the pieces of language support that each editor must provide rather than a complete solution.
TeMPOraL 3y ago
> VSCode can prevent installation of all but allowlisted extensions by policy. Companies using that are probably the reason for, or at least a big motivator for, the feature in question. Lots of developer creativity is spent on working around corporate "security" practices that otherwise prevent work from being done.
- 1letterunixname 3y ago
  How well would it work to allow every plugin to be used on confidential systems and protected without any sort of review? There's no way to denylist the way out of preventing a keylogger or malicious look-alike plugin retroactively. I think you're painting with a broad brush lacking nuance or understanding the concerns involved.
  - TeMPOraL 3y ago
    I'm painting with a broad brush indeed, as all my nuance has been lost dealing with bullshit like being able to 5x my coding speed by (ab)using my "local admin" rights to discover which magic folders are on the Windows Defender exclusions list, hardcoded by corporate policy, and moving all my stuff there, while seeing requests to kindly just allow us to add our stuff to exclusions locally rejected with responses like "nope, and surely we can resolve the slowdown this causes by reimbursing you for a cooling pad for your laptop".
    - 1letterunixname 3y ago
      Well, that's all well-and-good. You have to deal with the possible and the permitted rather than than complain about how you would do things your way. It's not your company and not your risk. Any time you break legitimate security rules you're putting your job and the jobs of everyone else at risk should there be a massive breach. No one in corporate uses WD because it's unmanaged. OTOH, MDE P1+VM is a steaming pile of shit that arbitrarily deletes things on untold millions of end-user devices because of the way Microsoft doesn't do properly risk management (canary) for new definitions.