5 ms·

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source commun

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially capable of ensuring security and accept the limitations of their offering. Mitigations like running in a VM might protect your dev workstation. But not code you put into production that relies on third parties.

lolinder 2y ago
> Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. It's a flagship IDE produced by one of the most valuable tech companies in the world, released for free as a loss leader in service to very specific corporate goals. When a tech behemoth releases a free IDE as a loss leader and it drives out all of the scrappy open source projects one by one, I think it's reasonable to hold that tech behemoth to tech behemoth standards rather than scrappy open source project standards.
- rat9988 2y ago
  The marketplace isn't operated on a paid contract for vetted extensions. You vet the extensions you use. Most don't, and it's ok. Don't shift the blame and the cost on microsoft though, they don't have to offer it.
  - homebrewer 2y ago
    Yet Mozilla, for all the flak it gets, isn't paid a dime by its users, but does find resources to vet the most popular extensions. Everything I use is checked by them. Raymond Hill (of ublock fame) wasn't really impressed with how it is performed, but it's still much better than nothing (which is what MS apparently does). VSCode is an IDE in name only, it's a glorified text editor, and pretty mediocre one at that. I in "IDE" stands for "integrated", like what you'd expect from JetBrains' products. Or even the real visual studio.
    - nkmnz 2y ago
      What functionality or property makes JetBrains' products an IDE while VSCode isn't? Honest question, I've never used any of their products.
      - mindcrash 2y ago
        As a example: Rider (https://www.jetbrains.com/rider/ https://www.jetbrains.com/rider/) - a IDE - comes with everything you could possibly need to build and compile .NET apps out of the box, while VSCode - a code editor - relies on extensions (and thus mostly the community surrounding VSCode) for this. Or to make things more succinct: * VSCode is a extendable code editor (like vim, neovim, Zed and Sublime) * Jetbrains Rider is a fully equipped Integrated Development Environment (like Microsoft Visual Studio or its direct sibling Jetbrains IntelliJ IDEA) And while extensions are optional within a IDE (and often solely used for increased productivity), more often than not they are a necessity in a code editor to even become productive.
        lolinder 2y ago
        I'm a big JetBrains fan, but this distinction is just silly. If you look at the way that JetBrains IDEs are packaged, the differences between IDEs all come down to extensions—which are enabled by default, which are available to install at all. IntelliJ Ultimate can be made to have all the features of PyCharm with the right extension combo. And occasionally they break out a new IDE by taking an extension and making it no longer available for installation elsewhere (like RustRover). The entire architecture is one of plugins. "Integrated" isn't meant to contrast with a plugin-based system (otherwise JetBrains wouldn't count!), it's meant to contrast with a dev environment built out of a bunch of individual tools and terminal commands run separately.
        pzo 2y ago
        Good point. In the old times if someone had Eclipse but installed plugins for different language than Java we wouldn't suddenly downgrade Eclipse that it is a text editor.
- rafaelmn 2y ago
  > VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. Which is why I'm pretty confident in first party packages and don't install third party plugins from random authors.
- mr_toad 2y ago
  > I think it's reasonable to hold that tech behemoth to tech behemoth standards You’d end up with Apple-style reviews and then people complaining about them. You can’t really win.
LocalH 2y ago
You do realize this is Microsoft we're talking about here? Not merely a couple dudes in their bedroom doing this in their spare time? I guarantee you that a non-zero percentage of the code in VSCode was paid for.
- rat9988 2y ago
  Who ever paid to use the extensions marketplace?
  - LocalH 2y ago
    I meant on the development side, not that end users paid for anything.
    - rat9988 2y ago
      Then why should end users expect anything? Microsoft is already paying for developpers.
      - wildzzz 2y ago
        Then they can pay those developers to sandbox vscode extensions at the very least. I like using vscode sometimes but I'm sure as shit not going to use it if my work bans installing extensions due to security risks.
- CodeWriter23 2y ago
  > You do realize this is Microsoft we're talking about here? Fiscal responsibility: required > Not merely a couple dudes in their bedroom doing this in their spare time? Fiscal responsibility: optional I would also point out, the malware-infested extension we are talking about presents more as the “two guys in a bedroom” model (though possibly a state-sponsored actor).
ajross 2y ago
> Because the open source community lacks the financial resources to vet every single version of every package. I made the point elsewhere, but this seems to fail in the face of Debian and Red Hat and Canonical who have been publishing mostly-secure distros of exclusively open source software for decades now. There's a reason why MS and NPM get caught by this sort of shenanigans, but it's not "open source".
- vlovich123 2y ago
  Because the attack surface is smaller and more difficult to extract value out of. I think it’s been shown time and time again the more motivated your attacker the more difficult it is to defend and very visible popular platforms see more attacks. NPM and MS represent drastically larger platforms.
  - ajross 2y ago
    Uh... no. There is far (far) more code[1] shipped in the package repository of any Linux distro than in all the world's vscode extensions. Are you being serious? NPM arguably gets a little closer, but only a little. No, the reason Linux is safe and modern distributors aren't is the "packaging" step. Debian volunteers package software that they understand to be high quality via existing community consensus. You can't just show up to Fedora and say "ship my junkware app", you need to convince the existing community that your stuff doesn't suck. And that's worked extremely well for decades now, going all the way back to 2BSD being shipped above V7 Unix. The reason MS and NPM et. al. abandoned it isn't just pure experience[2]. They don't want to wait for their repos to fill with good software, they want all the software in it now so that they don't get beaten by whoever their competitors are. And this is the inevitable result. If you allow anyone to distribute software to your users then you allow everyone to distribute software to your users. And everyone includes a lot of bad people. [1] With vastly more capability! The distro ships everything from firmware blobs and kernel drivers up through browser glitz and desktop customization. Talk about "attack surface"!
    - vlovich123 2y ago
vlovich123 2y ago
It presents a risk sure. But your browser sandboxes those extensions. VSCode runs extensions with the same permissions that VSCode itself has.

lolinder 2y ago

> Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. It's a flagship IDE produced by one of the most valuable tech companies in the world, released for free as a loss leader in service to very specific corporate goals. When a tech behemoth releases a free IDE as a loss leader and it drives out all of the scrappy open source projects one by one, I think it's reasonable to hold that tech behemoth to tech behemoth standards rather than scrappy open source project standards.

rat9988 2y ago
The marketplace isn't operated on a paid contract for vetted extensions. You vet the extensions you use. Most don't, and it's ok. Don't shift the blame and the cost on microsoft though, they don't have to offer it.
- homebrewer 2y ago
  Yet Mozilla, for all the flak it gets, isn't paid a dime by its users, but does find resources to vet the most popular extensions. Everything I use is checked by them. Raymond Hill (of ublock fame) wasn't really impressed with how it is performed, but it's still much better than nothing (which is what MS apparently does). VSCode is an IDE in name only, it's a glorified text editor, and pretty mediocre one at that. I in "IDE" stands for "integrated", like what you'd expect from JetBrains' products. Or even the real visual studio.
  - nkmnz 2y ago
    What functionality or property makes JetBrains' products an IDE while VSCode isn't? Honest question, I've never used any of their products.
    - mindcrash 2y ago
      As a example: Rider (https://www.jetbrains.com/rider/ https://www.jetbrains.com/rider/) - a IDE - comes with everything you could possibly need to build and compile .NET apps out of the box, while VSCode - a code editor - relies on extensions (and thus mostly the community surrounding VSCode) for this. Or to make things more succinct: * VSCode is a extendable code editor (like vim, neovim, Zed and Sublime) * Jetbrains Rider is a fully equipped Integrated Development Environment (like Microsoft Visual Studio or its direct sibling Jetbrains IntelliJ IDEA) And while extensions are optional within a IDE (and often solely used for increased productivity), more often than not they are a necessity in a code editor to even become productive.
      - lolinder 2y ago
        I'm a big JetBrains fan, but this distinction is just silly. If you look at the way that JetBrains IDEs are packaged, the differences between IDEs all come down to extensions—which are enabled by default, which are available to install at all. IntelliJ Ultimate can be made to have all the features of PyCharm with the right extension combo. And occasionally they break out a new IDE by taking an extension and making it no longer available for installation elsewhere (like RustRover). The entire architecture is one of plugins. "Integrated" isn't meant to contrast with a plugin-based system (otherwise JetBrains wouldn't count!), it's meant to contrast with a dev environment built out of a bunch of individual tools and terminal commands run separately.
        pzo 2y ago
        Good point. In the old times if someone had Eclipse but installed plugins for different language than Java we wouldn't suddenly downgrade Eclipse that it is a text editor.
rafaelmn 2y ago
> VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. Which is why I'm pretty confident in first party packages and don't install third party plugins from random authors.
mr_toad 2y ago
> I think it's reasonable to hold that tech behemoth to tech behemoth standards You’d end up with Apple-style reviews and then people complaining about them. You can’t really win.

LocalH 2y ago

You do realize this is Microsoft we're talking about here? Not merely a couple dudes in their bedroom doing this in their spare time? I guarantee you that a non-zero percentage of the code in VSCode was paid for.

rat9988 2y ago
Who ever paid to use the extensions marketplace?
- LocalH 2y ago
  I meant on the development side, not that end users paid for anything.
  - rat9988 2y ago
    Then why should end users expect anything? Microsoft is already paying for developpers.
    - wildzzz 2y ago
      Then they can pay those developers to sandbox vscode extensions at the very least. I like using vscode sometimes but I'm sure as shit not going to use it if my work bans installing extensions due to security risks.
CodeWriter23 2y ago
> You do realize this is Microsoft we're talking about here? Fiscal responsibility: required > Not merely a couple dudes in their bedroom doing this in their spare time? Fiscal responsibility: optional I would also point out, the malware-infested extension we are talking about presents more as the “two guys in a bedroom” model (though possibly a state-sponsored actor).

ajross 2y ago

> Because the open source community lacks the financial resources to vet every single version of every package. I made the point elsewhere, but this seems to fail in the face of Debian and Red Hat and Canonical who have been publishing mostly-secure distros of exclusively open source software for decades now. There's a reason why MS and NPM get caught by this sort of shenanigans, but it's not "open source".

vlovich123 2y ago
Because the attack surface is smaller and more difficult to extract value out of. I think it’s been shown time and time again the more motivated your attacker the more difficult it is to defend and very visible popular platforms see more attacks. NPM and MS represent drastically larger platforms.
- ajross 2y ago
  Uh... no. There is far (far) more code[1] shipped in the package repository of any Linux distro than in all the world's vscode extensions. Are you being serious? NPM arguably gets a little closer, but only a little. No, the reason Linux is safe and modern distributors aren't is the "packaging" step. Debian volunteers package software that they understand to be high quality via existing community consensus. You can't just show up to Fedora and say "ship my junkware app", you need to convince the existing community that your stuff doesn't suck. And that's worked extremely well for decades now, going all the way back to 2BSD being shipped above V7 Unix. The reason MS and NPM et. al. abandoned it isn't just pure experience[2]. They don't want to wait for their repos to fill with good software, they want all the software in it now so that they don't get beaten by whoever their competitors are. And this is the inevitable result. If you allow anyone to distribute software to your users then you allow everyone to distribute software to your users. And everyone includes a lot of bad people. [1] With vastly more capability! The distro ships everything from firmware blobs and kernel drivers up through browser glitz and desktop customization. Talk about "attack surface"!
  - vlovich123 2y ago

vlovich123 2y ago

It presents a risk sure. But your browser sandboxes those extensions. VSCode runs extensions with the same permissions that VSCode itself has.