4 ms·

> For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser hist

> For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys. First, if you don't trust a bit of software, why are you installing it? But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files? If my text editor wasn't able to open and edit those files, I'd consider it extremely broken!

Timber-6539 3y ago
Is VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me. Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about. [0] https://blog.aquasec.com/can-you-trust-your-vscode-extensions https://blog.aquasec.com/can-you-trust-your-vscode-extension... [1] https://www.techradar.com/news/hackers-are-using-malicious-microsoft-vscode-extensions-to-steal-passwords https://www.techradar.com/news/hackers-are-using-malicious-m...
- Karellen 3y ago
  > Is VS Code a text editor? Um, I thought it was? I've not used it, because I'm happy with (neo)vim for my dev needs, but I thought that's what it did? If VS Code isn't used to edit text, what is it for? Edit: (neo)vim and emacs both have 3rd party extension ecosystems, with extensions written in languages that can access the internet, so I'm not sure how that affects your test?
  - Timber-6539 3y ago
    Nano is a good example of a text editor.
codedokode 3y ago
> First, if you don't trust a bit of software, why are you installing it? The more people you trust, the larger is the chance that you get deceived. > But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files? Only with my permission.
codedokode 3y ago
Even if you trust the developer (I don't), there is a chance that there is a bug or vulnerability in the software. Also you need to install different plugins from random anonymous guys from Github, and it is difficult to trust an anonymous person.
- Karellen 3y ago
  > Also you need to install different plugins from random anonymous guys from Github Do I? Strange, I've never noticed needing to do that myself.

Timber-6539 3y ago

Is VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me. Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about. [0] https://blog.aquasec.com/can-you-trust-your-vscode-extensions https://blog.aquasec.com/can-you-trust-your-vscode-extension... [1] https://www.techradar.com/news/hackers-are-using-malicious-microsoft-vscode-extensions-to-steal-passwords https://www.techradar.com/news/hackers-are-using-malicious-m...

Karellen 3y ago
> Is VS Code a text editor? Um, I thought it was? I've not used it, because I'm happy with (neo)vim for my dev needs, but I thought that's what it did? If VS Code isn't used to edit text, what is it for? Edit: (neo)vim and emacs both have 3rd party extension ecosystems, with extensions written in languages that can access the internet, so I'm not sure how that affects your test?
- Timber-6539 3y ago
  Nano is a good example of a text editor.

codedokode 3y ago

> First, if you don't trust a bit of software, why are you installing it? The more people you trust, the larger is the chance that you get deceived. > But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files? Only with my permission.

codedokode 3y ago

Even if you trust the developer (I don't), there is a chance that there is a bug or vulnerability in the software. Also you need to install different plugins from random anonymous guys from Github, and it is difficult to trust an anonymous person.

Karellen 3y ago
> Also you need to install different plugins from random anonymous guys from Github Do I? Strange, I've never noticed needing to do that myself.