3 ms·
VS Code is written in JavaScript, it's inherently insecure. Now add an LLM that's familiar with JavaScript and it can easily escape and do arbitrary things. W
by neuroelectron 2y ago
VS Code is written in JavaScript, it's inherently insecure. Now add an LLM that's familiar with JavaScript and it can easily escape and do arbitrary things. Where's the issue? Programming an IDE completely in JavaScript. It's like writing a text editor in English.
- mardifoufs 2y agoWhy is JavaScript fundamentally insecure? What would be a secure language in your opinion? And how are the issues highlighted in the blogpost related to JavaScript?
- neuroelectron 2y agoYou read the article right? VS Code has inherent security concerns due to the dynamic and unbounded nature of JavaScript combined with the attack surface introduced by its extensibility and web-based architecture. Electron (the JS interpreter used) has a dynamic web-based attack surface. Even if you mapped it out, it can change at any time thanks to the changing nature of JS standards. Furthermore, the security issue with extensions in VS Code is well documented. And the obvious bit is it's executing code sometimes, arbitrary user code and extension code. Telementry, etc. are built in. It's really up to the user to use it in a secured manner. A lot of people just don't consider this.