4 ms·
The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues ha
by fg137 5mo ago
The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this.
I mean, I understand that it is hard to sandbox Node.js applications, but apparently Microsoft has put way more effort into their Copilot slop than security.
[0] https://github.com/microsoft/vscode/issues/52116 https://github.com/microsoft/vscode/issues/52116
[1] https://news.ycombinator.com/item?id=42979994 https://news.ycombinator.com/item?id=42979994
[2] https://news.ycombinator.com/item?id=46855527 https://news.ycombinator.com/item?id=46855527
- zx8080 5mo ago> but apparently Microsoft has put way more effort into their Copilot slop than security. Your security or their money (selling Copilot to enterprise customers): what would they choose, hmm? Surprise!
- ozim 5mo agoWhy would you sandbox extension? Just don’t install crap maybe.
- Hackbraten 5mo agoAny good, benign extension can be taken over and weaponized with malware.
- pixl97 5mo agoThis mans security onion has one layer.
- Gigachad 5mo agoEven if you don't install crap, the latest strategy is attacking the developer of one of the extensions or their build process so you can push a malware update to an otherwise legitimate extension.
- fhn 5mo agothanks for the sage advice. Next time you are infected with the flu you should just don't breath maybe.
- bbor 5mo agoI am so, so stressed about Sublime Text... It feels like a massive disaster just waiting to happen. They don't even run their own package marketplace :(
- tstrimple 5mo agoThere are so few users of sublime text that it likely isn’t a juicy enough target for these sorts of exploits.
- Atotalnoob 5mo agoYou don’t have to be an idiot to be hacked. A legit extension can be sold or compromised due to no fault of the engineer Don’t attack individuals for mistakes of a system.