3 ms·
> you already have permission to do all the other things Of course. The problem is that a 3rd party agent can now use your permission to do what it wants, and
by slashdave 2y ago
> you already have permission to do all the other things
Of course. The problem is that a 3rd party agent can now use your permission to do what it wants, and you will be none the wiser.
- IshKebab 2y agoYou're already trusting that third party agent on your own computer. If VSCode itself was malware then it can do anything you can do, including sshing into remote machines and running commands behind your back.
- bornfreddy 2y agoVSCode is opensource. Remote ssh agent is not.
- IshKebab 2y agoWhat's that got to do with anything?
- coldtea 2y agothat you can theoritically audit vscode code, but not ssh agent code...
- n144q 2y agoDoes that have anything to do with SECURITY? The train of logic has run way off the rail in this thread.
- Nab443 2y agoVSCode is not if installed with binaries.
- bornfreddy 2y agoAre you saying that the VSCode binaries are not built from the exact source that is available? Or that the opensource license doesn't apply to the version of VSC that is distributed via binaries? I'm using VSCodium myself anyway, but I'm also installing it from binaries (precompiled packages), as is the case with most opensource software I use.
- awwaiid 2y agoNo -- when I ssh somewhere I am NOT giving them (the server) permission to run code on MY computer. When I vscode-remote somewhere then I AM giving them (the server) to run code on MY computer. You don't expect visiting a website to give the website permission to edit your local files, and so similarly some people might expect that if they are remote-editing with vscode they are not giving the remote-server permission to edit their local files either. Best to be aware!
- joe91 2y agoHow does it differ from just logging into that machine and running code?
- roywiggins 2y agoVSCode remotes can execute code on the connecting clients, so a pwned remote server can pwn your local machine.
- joe91 2y agoI mean, yeah, technically true - although you would connect in untrusted mode if you didn't trust the machine where you were editing code. At that point it should only be slightly more dangerous than opening a web page from the remote server. So yeah, if you don't trust the remote machine then I agree - you probably shouldn't use it. But I don't really think that's the use-case they had in mind.
- coldtea 2y agoIn that it's like THAT machine is also logging into your machine, and running code there...