3 ms·

Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.

wyclif 5mo ago
You're assuming they allow it, but it might be against policy.
- baxtr 5mo ago
  I’m pretty sure there is an policy on their internal wiki saying you shouldn’t do that. Problem is: most employees don’t care to read these. Although I’m sure something like this could have been checked for during commit.
  - hhh 5mo ago
    They can enforce it with an MDM. Policy should be enforced where possible not just notified to people.
    - baxtr 5mo ago
      Absolutely agree. But enforcing is so much more effort than creating wiki pages with LLMs.
- danpalmer 5mo ago
  Fair point, I hadn't considered this, but wouldn't they just disallow it? Like, I use a VSCode fork at work, but the enforced extensions store backend is based on an allowlist and extensions need reviewing to be available there.
  - paholg 5mo ago
    When I worked at Amazon, I had to run a special Amazon Linux. But I could just install whatever I wanted. I used emacs with whatever plugins I wanted. Big tech can be suprisingly not locked down!
    - wyclif 5mo ago
      Ah, that must have been AL2023, right? IIRC, it's tightly integrated with internal deployment toolchains like Apollo and Brazil (Amazon's internal package management and build systems).
exitb 5mo ago
It's true. But at the same time, isn't it crazy to conclude that a company should restrict their developers from using their own developer productivity tools and services? If Microsoft devs shouldn't use random VSCode extensions, how could anyone?
21asdffdsa12 5mo ago
Because centralized management of resources is the death of innovation, intrinsic motivation and speed? The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task. The security tax and speeding tickets on everything are a luxury destroying much value.
- seanieb 5mo ago
  Your company getting hacked because of random plugins for emerging or dysfunctional ecosystems that don’t have enterprise management solutions yet is worth it to avoid friction?
  - dust-jacket 5mo ago
    Yes and no. The friction they should have probably had here is: did this employee need access to 3,800 internal repos? I'm with the poster above in believing restricting what you can install makes a lot of things more difficult, but if you're going to take the risk you should be limiting the blast radius.
- gabrielgio 5mo ago
  Move fast, break things, get internal repository leaked and lose all the 9s.
  - dgellow 5mo ago
    Im pretty sure GitHub reliability issues are a result of Microsoft centralized management (i.e migrate everything to azure, the only allowed cloud)
    - gabrielgio 5mo ago
      Tbh, at this point why does it matter if it was MS or not?
      - 5mo ago

wyclif 5mo ago

You're assuming they allow it, but it might be against policy.

baxtr 5mo ago
I’m pretty sure there is an policy on their internal wiki saying you shouldn’t do that. Problem is: most employees don’t care to read these. Although I’m sure something like this could have been checked for during commit.
- hhh 5mo ago
  They can enforce it with an MDM. Policy should be enforced where possible not just notified to people.
  - baxtr 5mo ago
    Absolutely agree. But enforcing is so much more effort than creating wiki pages with LLMs.
danpalmer 5mo ago
Fair point, I hadn't considered this, but wouldn't they just disallow it? Like, I use a VSCode fork at work, but the enforced extensions store backend is based on an allowlist and extensions need reviewing to be available there.
- paholg 5mo ago
  When I worked at Amazon, I had to run a special Amazon Linux. But I could just install whatever I wanted. I used emacs with whatever plugins I wanted. Big tech can be suprisingly not locked down!
  - wyclif 5mo ago
    Ah, that must have been AL2023, right? IIRC, it's tightly integrated with internal deployment toolchains like Apollo and Brazil (Amazon's internal package management and build systems).

exitb 5mo ago

It's true. But at the same time, isn't it crazy to conclude that a company should restrict their developers from using their own developer productivity tools and services? If Microsoft devs shouldn't use random VSCode extensions, how could anyone?

21asdffdsa12 5mo ago

Because centralized management of resources is the death of innovation, intrinsic motivation and speed? The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task. The security tax and speeding tickets on everything are a luxury destroying much value.

seanieb 5mo ago
Your company getting hacked because of random plugins for emerging or dysfunctional ecosystems that don’t have enterprise management solutions yet is worth it to avoid friction?
- dust-jacket 5mo ago
  Yes and no. The friction they should have probably had here is: did this employee need access to 3,800 internal repos? I'm with the poster above in believing restricting what you can install makes a lot of things more difficult, but if you're going to take the risk you should be limiting the blast radius.
gabrielgio 5mo ago
Move fast, break things, get internal repository leaked and lose all the 9s.
- dgellow 5mo ago
  Im pretty sure GitHub reliability issues are a result of Microsoft centralized management (i.e migrate everything to azure, the only allowed cloud)
  - gabrielgio 5mo ago
    Tbh, at this point why does it matter if it was MS or not?
    - 5mo ago