3 ms·
> - The VSCode security story is very, very weak. Extensions are not sandboxed. The client, accessing remote repos, is wildly insecure, by design. This is a bi
by tikkabhuna 2y ago
> - The VSCode security story is very, very weak. Extensions are not sandboxed. The client, accessing remote repos, is wildly insecure, by design.
This is a big concern for our Infosec team. There is no middle ground between open access to every Extension on the marketplace or locked down and Extensions are installed via local files. The latter being a significant overhead in maintaining VSCode.
- spacemanspiff01 2y agoCan't you host your own extension marketplace?
- doubled112 2y agoThen you have other problems. Maintaining the store itself, obtaining the extensions people want, and keeping the extensions up to date adds some overhead. Looks like it should be possible, although I have no experience doing it myself. https://github.com/coder/code-marketplace https://github.com/coder/code-marketplace
- phillipcarter 2y agoSounds like that's the price your org is willing to pay for your its flavor of Infosec.
- EasyMark 2y agoAll these same things are true for emacs/vim/CLion plugins as well. You kind of either have to accept the risk cowboy style, do something in the middle (maybe only allow very well known extensions from source you trust), or live without the extensions.