5 ms·

This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116 https://github.com/microsoft/vscode/issues/52116 We do not plan to add

This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116 https://github.com/microsoft/vscode/issues/52116 We do not plan to add a permission model in the next 6 months.

fragmede 2y ago
Given the enormity of the attack surface that has just been exposed, that's disappointing.
- Aeolun 2y ago
  This isn’t really exposed so much as exploited. This was always possible.
  - fragmede 2y ago
    you're right. it's not new. https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-with-millions-of-installs-discovered/ https://www.bleepingcomputer.com/news/security/malicious-vsc...
yukIttEft 2y ago
> We do not plan to add a permission model in the next 6 months. I guess Copilot functionality trumps "Security above all else" now. https://blogs.microsoft.com/blog/2024/05/03/prioritizing-security-above-all-else/ https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...
- misnome 2y ago
  Yeah, the vscode release notes used to be lists of interesting new things and novel improvements. Now they are all “copilot” “features”.
  - Cthulhu_ 2y ago
    TBH, no criticism on the developers, but the VS Code release notes haven't been interesting or relevant to how I used the editor for years. I think I checked out when they added a terminal client to it and it dominated the release notes for ages. AI features is one of the bigger innovations in editors in years, I fully understand the enthusiasm, especially given it can be linked to an earnings model. That said, before AI stuff I would've expected them to push integration with Github and Azure more.
    - dingnuts 2y ago
      This is why I use Emacs and it's why I didn't stop using Emacs when Sublime Text II, then Atom, then VSCode became popular. When Microsoft gets bored of VSCode or forces you to only do AI "vibe coding", Emacs will still be there. New version just came out. The release notes were full of good things.
      - adamc 2y ago
        Well, I used Emacs for 15-20 years. It has problems of its own -- mostly that it is effectively locked into an antediluvian view of how editors work, and that to use it effectively you end up maintaining large and complex configuration files. I still use it for some things, but what we really need is a new, different edition of Emacs that has the same basic architecture but a more modern take on all the stuff that dates from the 1980s.
        zitterbewegung 2y ago
        XEmacs Tried to do that, it has been attempted to rewrite the backend of emacs into Rust twice, Guile has tried to interpret emacs lisp twice. The biggest problem is basically how large the user base is and the ability of people to want to perform the port so actually improving the editor is more likely. GTK+ and webkit has been integrated into emacs and it has a package manager now and configuration is still a problem.
        iLemming 2y ago
- xyst 2y ago
  [flagged]
  - FpUser 2y ago
    [flagged]
    - agos 2y ago
      this is not about who they vote for, it's the system that is neoliberal in that allows and incentivizes only maximum profit and puts very little barriers
    - account42 2y ago
      Political orientation determines what we let companies get away with.

fragmede 2y ago

Given the enormity of the attack surface that has just been exposed, that's disappointing.

Aeolun 2y ago
This isn’t really exposed so much as exploited. This was always possible.
- fragmede 2y ago
  you're right. it's not new. https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-with-millions-of-installs-discovered/ https://www.bleepingcomputer.com/news/security/malicious-vsc...

yukIttEft 2y ago

> We do not plan to add a permission model in the next 6 months. I guess Copilot functionality trumps "Security above all else" now. https://blogs.microsoft.com/blog/2024/05/03/prioritizing-security-above-all-else/ https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...

misnome 2y ago
Yeah, the vscode release notes used to be lists of interesting new things and novel improvements. Now they are all “copilot” “features”.
- Cthulhu_ 2y ago
  TBH, no criticism on the developers, but the VS Code release notes haven't been interesting or relevant to how I used the editor for years. I think I checked out when they added a terminal client to it and it dominated the release notes for ages. AI features is one of the bigger innovations in editors in years, I fully understand the enthusiasm, especially given it can be linked to an earnings model. That said, before AI stuff I would've expected them to push integration with Github and Azure more.
  - dingnuts 2y ago
    This is why I use Emacs and it's why I didn't stop using Emacs when Sublime Text II, then Atom, then VSCode became popular. When Microsoft gets bored of VSCode or forces you to only do AI "vibe coding", Emacs will still be there. New version just came out. The release notes were full of good things.
    - adamc 2y ago
      Well, I used Emacs for 15-20 years. It has problems of its own -- mostly that it is effectively locked into an antediluvian view of how editors work, and that to use it effectively you end up maintaining large and complex configuration files. I still use it for some things, but what we really need is a new, different edition of Emacs that has the same basic architecture but a more modern take on all the stuff that dates from the 1980s.
      - zitterbewegung 2y ago
        XEmacs Tried to do that, it has been attempted to rewrite the backend of emacs into Rust twice, Guile has tried to interpret emacs lisp twice. The biggest problem is basically how large the user base is and the ability of people to want to perform the port so actually improving the editor is more likely. GTK+ and webkit has been integrated into emacs and it has a package manager now and configuration is still a problem.
      - iLemming 2y ago
xyst 2y ago
[flagged]
- FpUser 2y ago
  [flagged]
  - agos 2y ago
    this is not about who they vote for, it's the system that is neoliberal in that allows and incentivizes only maximum profit and puts very little barriers
  - account42 2y ago
    Political orientation determines what we let companies get away with.