I honestly can't even tell if it's real. Like sure everything looks correct, but I just can't shake the feeling that this is just something picked up from reddi

I honestly can't even tell if it's real. Like sure everything looks correct, but I just can't shake the feeling that this is just something picked up from reddit and turned into a story. Either way the prevalence of these is so widespread that you can no longer avoid it by being "smart". Sandbox everything, run vscode in a limited-access box and use the remote development features vscode already has. Run it on another machine if you can. Use hardware keys (yubikey, token2). Use socket-based authentication. It's hard and a worse dx experience, but there really isn't any other way unless you never touch public libraries or don't use vscode. At bare minimum use a simple jail such as bwrap to strip access to most of the sensitive credentials and limit persistant access. -- This is probably a hallucinated story based on a real incident. (another post by same author: https://medium.com/bean-bag-scientist/report-01-running-a-full-size-ai-model-on-aws-under-1-1553414e4ea1 https://medium.com/bean-bag-scientist/report-01-running-a-fu...)