3 ms·

WARNING for Cursor users: Cursor is currently stuck using an outdated snapshot of the VSCode Marketplace, meaning several extensions within Cursor remain affect

by ndr 1y ago

WARNING for Cursor users: Cursor is currently stuck using an outdated snapshot of the VSCode Marketplace, meaning several extensions within Cursor remain affected by high-severity CVEs that have already been patched upstream in VSCode. As a result, Cursor users unknowingly remain vulnerable to known security issues. This issue has been acknowledged but remains unresolved: https://github.com/getcursor/cursor/issues/1602#issuecomment https://github.com/getcursor/cursor/issues/1602#issuecomment... Given Cursor's rising popularity, users should be aware of this gap in security updates. Until the Cursor team resolves the marketplace sync issue, caution is advised when using certain extensions. I've flagged it here, apologies for the repost: https://news.ycombinator.com/item?id=43609572 https://news.ycombinator.com/item?id=43609572

bix6 1y ago
Is there a list of extensions to avoid?
nicce 1y ago
> Until the Cursor team resolves the marketplace sync issue, caution is advised when using certain extensions. Isn’t the issue with Microsoft’s legal barriers? This may take years. https://www.reddit.com/r/programming/comments/1jrl2zw/microsoft_has_released_their_own_agent_mode_so/ https://www.reddit.com/r/programming/comments/1jrl2zw/micros...
- TiredOfLife 1y ago
  No it's an issue with Cursor using another companies infrastructure without permission. Think reselling access to somebody's Netflix account you just happened to guess password.
  - ndr 1y ago
    Either way it sounds pretty bad for those of us who really love using Cursor.
    - TiredOfLife 1y ago
      You pay at least 20$ a month. Ask them to fix.
  - falcor84 1y ago
    I don't think Microsoft are concerned about the infrastructure costs (if they did, they probably would allow people to have local windows users). What they want is to control the ecosystem, and they are bothered about others looking to use their supposedly open source software independently from them.
    - TiredOfLife 1y ago
      The relevant plugins were never open source Also you can make as much local windows users as you want (in theory up to about 1,073,741,823 practically about 16 thousand).
      - falcor84 1y ago
        Maybe I can make them after I sign in, but Microsoft have made it extremely difficult to set up a new Windows installation with only a local user. As for the non-open-source plugins, maybe I'm too jaded, but I can't help but see it as step 2 in Embrace,Extend, Extinguish.

by ndr 1y ago

bix6 1y ago

Is there a list of extensions to avoid?

nicce 1y ago

> Until the Cursor team resolves the marketplace sync issue, caution is advised when using certain extensions. Isn’t the issue with Microsoft’s legal barriers? This may take years. https://www.reddit.com/r/programming/comments/1jrl2zw/microsoft_has_released_their_own_agent_mode_so/ https://www.reddit.com/r/programming/comments/1jrl2zw/micros...

TiredOfLife 1y ago
No it's an issue with Cursor using another companies infrastructure without permission. Think reselling access to somebody's Netflix account you just happened to guess password.
- ndr 1y ago
  Either way it sounds pretty bad for those of us who really love using Cursor.
  - TiredOfLife 1y ago
    You pay at least 20$ a month. Ask them to fix.
- falcor84 1y ago
  I don't think Microsoft are concerned about the infrastructure costs (if they did, they probably would allow people to have local windows users). What they want is to control the ecosystem, and they are bothered about others looking to use their supposedly open source software independently from them.
  - TiredOfLife 1y ago
    The relevant plugins were never open source Also you can make as much local windows users as you want (in theory up to about 1,073,741,823 practically about 16 thousand).
    - falcor84 1y ago
      Maybe I can make them after I sign in, but Microsoft have made it extremely difficult to set up a new Windows installation with only a local user. As for the non-open-source plugins, maybe I'm too jaded, but I can't help but see it as step 2 in Embrace,Extend, Extinguish.