4 ms·

> As far as I can tell, if you use VS Code Remote SSH or remote tunnels, the repository you open can execute code on the remote and the local machine, and the r

> As far as I can tell, if you use VS Code Remote SSH or remote tunnels, the repository you open can execute code on the remote and the local machine, and the remote machine’s configuration can execute code on the local machine You're describing what is a feature of remote tunnels, though. Ability to executing code and commands is the entire point. By default no local code execution is allowed when you open an unknown workspace btw: https://code.visualstudio.com/docs/editor/workspace-trust https://code.visualstudio.com/docs/editor/workspace-trust

amluto 2y ago
> You're describing what is a feature of remote tunnels, though. Ability to executing code and commands is the entire point. Excuse me? Editing code is the entire point. A major, but still secondary, point, is building and running code on the remote machine. Running code on the client is certainly pointy, but I don’t think it’s “the point” at all.
- cassianoleal 2y ago
  > Editing code is the entire point. A major, but still secondary, point, is building and running code on the remote machine. I don't think so. Building and running on the remote are the point. Why would I want to remote somewhere just to edit some text files? Running things on the remote opens up loads of possibilities, from leveraging more powerful hardware to building+running on an architecture different from my local env, including not having to keep a collection of dependencies on my machine and dealing with virtualenvs or whatever is their equivalent in the language I'm coding on.
  - amluto 2y ago
    I think that you and tredre3 are entirely missing the problem — you seem to be assuming that vscode works the way that any sensible person would assume that it works. Of course VS Code runs things remotely. Of course running an untrusted project on a remote machine runs code on the remote machine. This isn’t the problem. The problem is that the remote project can run code on the client front end. You can create a brand new cloud machine, give it no particular permissions, run vscode on your laptop, connect to the remote machine via the remote extension, and load some compromised package npm package, and you expect that the damage is limited to the remote machine. And you would be wrong! The npm package can execute code on your laptop or borrow your ssh credentials, and MS doesn’t even consider this to be a bug! https://github.com/microsoft/vscode-remote-release/issues/6608 https://github.com/microsoft/vscode-remote-release/issues/66...

amluto 2y ago

> You're describing what is a feature of remote tunnels, though. Ability to executing code and commands is the entire point. Excuse me? Editing code is the entire point. A major, but still secondary, point, is building and running code on the remote machine. Running code on the client is certainly pointy, but I don’t think it’s “the point” at all.

cassianoleal 2y ago
> Editing code is the entire point. A major, but still secondary, point, is building and running code on the remote machine. I don't think so. Building and running on the remote are the point. Why would I want to remote somewhere just to edit some text files? Running things on the remote opens up loads of possibilities, from leveraging more powerful hardware to building+running on an architecture different from my local env, including not having to keep a collection of dependencies on my machine and dealing with virtualenvs or whatever is their equivalent in the language I'm coding on.
- amluto 2y ago
  I think that you and tredre3 are entirely missing the problem — you seem to be assuming that vscode works the way that any sensible person would assume that it works. Of course VS Code runs things remotely. Of course running an untrusted project on a remote machine runs code on the remote machine. This isn’t the problem. The problem is that the remote project can run code on the client front end. You can create a brand new cloud machine, give it no particular permissions, run vscode on your laptop, connect to the remote machine via the remote extension, and load some compromised package npm package, and you expect that the damage is limited to the remote machine. And you would be wrong! The npm package can execute code on your laptop or borrow your ssh credentials, and MS doesn’t even consider this to be a bug! https://github.com/microsoft/vscode-remote-release/issues/6608 https://github.com/microsoft/vscode-remote-release/issues/66...