4 ms·
I've heard about these attacks but never really had the time to understood what was happening. Some of our junior devs use VS Code, so now we have something to
by Tangurena2 4mo ago
I've heard about these attacks but never really had the time to understood what was happening. Some of our junior devs use VS Code, so now we have something to point them at.
- MeetingsBrowser 4mo agoOnly juniors are suing VSCode? What are others using?
- stronglikedan 4mo agoprob Cursor (also affected). at least that's preferred in my org
- vikramkr 4mo agoPoint them at for what?
- ktm5j 4mo agoVS Code will helpfully warn you when you open a folder that has a git repository.. it asks if you trust the developers since opening the folder could result in bad things happening. So this might not be such a big deal for VS Code users.
- ceejayoz 4mo agoYou know they're just gonna click yes, right? That prompt is just there so they can say "your fault!"
- ktm5j 4mo agoWell, in that case it totally is their fault...
- acdha 4mo agoI think that assumption is very dangerous: if your editor only prompts when you first open the project, it won’t help when that project is compromised later or if you checkout a merge request from someone untrustworthy/compromised and are mentally thinking “my project is safe” even though you’re a single gh/glab command away from that directory having anything an outside party wants.
- ashishb 4mo agoI have been targeted with this attack in the wild where '.vscode/tasks.json' had the auto-run code. I smelled something fishy and never ran it though. https://news.ycombinator.com/item?id=48127469 https://news.ycombinator.com/item?id=48127469