5 ms·

Am I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk? That is wild. Does this m

by EZ-E 1y ago

Am I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk? That is wild. Does this mean every company is one bad extension install away from having its entire codebase stolen or worse? I naively assumed the extensions were 'sandboxed' to some degree.

delusional 1y ago
These systems rely on downloading and executing much more untrusted software than you could ever imagine. Please dig deeper into this for yourself, I think that's the only way for anyone to truly appreciate the mess we are getting ourselves into.
sshine 1y ago
There is no ACL system in place for VSCode extensions, no. Any extension has full access to execute programs as the user. Your operating system might have some security measures in place.
bravesoul2 1y ago
Even with just internet access an extension could upload your entire codebase. Git extensions for example need this level of access by design. How else could you set a different remote and push all refs:)
pjc50 1y ago
Browser extensions are sandboxed. Editor extensions not at all.
- liveoneggs 1y ago
  but the editor is a browser!
  - alternatex 1y ago
    All the memory usage of a browser with the added benefit of less security :)
  - Sesse__ 1y ago
    This is the allure of shipping software with Electron; you get to use your familiar webdev platform, but with all those pesky security constraints gone. I mean, why else wouldn't you just have people use a web page? (OK, you also get easier access to the Start menu.)
  - jonathanlydall 1y ago
    Being a developer of an Electron application myself, it's probably accurate to say that Electron is a NodeJS application with APIs for interacting with instances of web renderers which themselves use a fork of Chromium to render HTML content.
muzzle 1y ago
I also naively thought that IDE extensions where sandboxed until I worked myself on making extensions. Well, it’s absolutely not and you can access the full filesystem. Which is handy if you are legit, but very permissive & much more a security threat than I imagined. Be careful what extensions you install people :)
- ceejayoz 1y ago
  Being careful won’t save you from the attacks we see with Chrome extensions, where they get bought by a bad actor.
  - deleted 1y ago
    [deleted]
- addandsubtract 1y ago
  VSCode on MacOS asks me if it can access my Download/Documents/etc folder... and if I trust the files in directory X that I just opened. Yet, extensions can just bypass all those safeguards?
  - deleted 1y ago
    [deleted]
  - simonw 1y ago
    I believe extensions inherit the permissions that the editor has already - so if you've given Cursor or VS Code permission to access a folder any extensions they run later can access it too. I agree, this seems bad! Sandboxing is still a very weakly implemented craft for most applications, especially those that run extensions or plugins. (I build a lot of software that runs plugins and has no sandboxing at all, and it really frustrates me. I'm constantly looking out for cross-platform Python-friendly sandboxing tech that might help with this in the future.)
    - TechDebtDevin 1y ago
      Its called a docker container ;)
IshKebab 1y ago
> Does this mean every company is one bad extension install away from having its entire codebase stolen or worse? Yes. > I naively assumed the extensions were 'sandboxed' to some degree. No. This is fairly obvious if you have used more than a few extensions - often they'll ask you to download and install binaries.
ants_everywhere 1y ago
> Am I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk? I honestly thought that was how the Javacsript and Python ecosystems worked? And surely many others.
deleted 1y ago
[deleted]
cosiiine 1y ago
Zed for example will start crawling your home directory and all children if you don’t have a project open. Documents, downloads, etc all uploaded.
- notpushkin 1y ago
  Source?
myaccountonhn 1y ago
See also: the millions of npm packages that get installed are one bad actor away from a disaster.

by EZ-E 1y ago

delusional 1y ago

These systems rely on downloading and executing much more untrusted software than you could ever imagine. Please dig deeper into this for yourself, I think that's the only way for anyone to truly appreciate the mess we are getting ourselves into.

sshine 1y ago

There is no ACL system in place for VSCode extensions, no. Any extension has full access to execute programs as the user. Your operating system might have some security measures in place.

bravesoul2 1y ago

Even with just internet access an extension could upload your entire codebase. Git extensions for example need this level of access by design. How else could you set a different remote and push all refs:)

pjc50 1y ago

Browser extensions are sandboxed. Editor extensions not at all.

liveoneggs 1y ago
but the editor is a browser!
- alternatex 1y ago
  All the memory usage of a browser with the added benefit of less security :)
- Sesse__ 1y ago
  This is the allure of shipping software with Electron; you get to use your familiar webdev platform, but with all those pesky security constraints gone. I mean, why else wouldn't you just have people use a web page? (OK, you also get easier access to the Start menu.)
- jonathanlydall 1y ago
  Being a developer of an Electron application myself, it's probably accurate to say that Electron is a NodeJS application with APIs for interacting with instances of web renderers which themselves use a fork of Chromium to render HTML content.

muzzle 1y ago

I also naively thought that IDE extensions where sandboxed until I worked myself on making extensions. Well, it’s absolutely not and you can access the full filesystem. Which is handy if you are legit, but very permissive & much more a security threat than I imagined. Be careful what extensions you install people :)

ceejayoz 1y ago
Being careful won’t save you from the attacks we see with Chrome extensions, where they get bought by a bad actor.
- deleted 1y ago
  [deleted]
addandsubtract 1y ago
VSCode on MacOS asks me if it can access my Download/Documents/etc folder... and if I trust the files in directory X that I just opened. Yet, extensions can just bypass all those safeguards?
- deleted 1y ago
  [deleted]
- simonw 1y ago
  I believe extensions inherit the permissions that the editor has already - so if you've given Cursor or VS Code permission to access a folder any extensions they run later can access it too. I agree, this seems bad! Sandboxing is still a very weakly implemented craft for most applications, especially those that run extensions or plugins. (I build a lot of software that runs plugins and has no sandboxing at all, and it really frustrates me. I'm constantly looking out for cross-platform Python-friendly sandboxing tech that might help with this in the future.)
  - TechDebtDevin 1y ago
    Its called a docker container ;)

IshKebab 1y ago

> Does this mean every company is one bad extension install away from having its entire codebase stolen or worse? Yes. > I naively assumed the extensions were 'sandboxed' to some degree. No. This is fairly obvious if you have used more than a few extensions - often they'll ask you to download and install binaries.

ants_everywhere 1y ago

> Am I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk? I honestly thought that was how the Javacsript and Python ecosystems worked? And surely many others.

deleted 1y ago

[deleted]

cosiiine 1y ago

Zed for example will start crawling your home directory and all children if you don’t have a project open. Documents, downloads, etc all uploaded.

notpushkin 1y ago
Source?

myaccountonhn 1y ago

See also: the millions of npm packages that get installed are one bad actor away from a disaster.