5 ms·

@dang Even though the blogpost has some helpful flavor, this GH issue seems much more direct and giving much more straightforward guidance for resolving the iss

• JdeBP 1y ago
  Credit to otterly and Hilift for finding some other better coverage than this semgrep page as well: * https://news.ycombinator.com/item?id=45040126 https://news.ycombinator.com/item?id=45040126 * https://news.ycombinator.com/item?id=45040507 https://news.ycombinator.com/item?id=45040507
  • merb 1y ago
    I do not like these coverages. They always write about VSCode Extension which has basically nothing todo with the bug. It only did run affected programs of course but it's so stupid to even talk about vscode in that case. if you used the affected nx versions you are affected no matter if you used vscode,webstorm, whatever ide of your liking. if you used a not affected nx version nothing happend no matter which vscode version you used.
    • ramimac 1y ago
      Hi! Author here who added the VSCode stat :) I thought it was useful to include because: * it can inform triage, if you use the extension you're more likely to be impacted * because it was VSCode, Workplace Trust actually partially mitigated this in at least 38 cases
      • merb 1y ago
        The vocoder extension does not contain any affected packages, it‘s just misleading
• dang 1y ago
  (We detached this subthread from https://news.ycombinator.com/item?id=45038993 https://news.ycombinator.com/item?id=45038993.) I found the first submission on the story (https://news.ycombinator.com/item?id=45034496 https://news.ycombinator.com/item?id=45034496), which used a github url, and merged the thread into it - more explanation at https://news.ycombinator.com/item?id=45042727 https://news.ycombinator.com/item?id=45042727.
• deleted 1y ago
  [deleted]