VS Code extensions are less secure than browser extensions or even NPM packages

https://www.baldurbjarnason.com/2024/vscode-extensions-are-insecure/

by cdme • 2 years ago

40 8 2 years ago

basil-rash• 2 years ago

Indeed. One should always disable extension auto updating. Besides that, there’s not really any less security than NPM packages. It’s the open secret of the whole industry that we just open ourselves to RCE every day because the alternative (vetting dependencies) is too annoying.

mannycalavera42• 2 years ago

<< If you don't want VS Code to even check for updates, you can set the extensions.autoCheckUpdates setting to false. >>

https://code.visualstudio.com/docs/editor/extension-marketpl...

amluto3• 2 years ago

VS Code everything is comically insecure. As far as I can tell, if you use VS Code Remote SSH or remote tunnels, the repository you open can execute code on the remote and the local machine, and the remote machine’s configuration can execute code on the local machine. And this is essentially by design, and MS doesn’t care.

At least VS Code in a browser is no less secure than the browser itself, at least as far as attacks against the client are concerned.

tredre3• 2 years ago

As far as I can tell, if you use VS Code Remote SSH or remote tunnels, the repository you open can execute code on the remote and the local machine, and the remote machine’s configuration can execute code on the local machine

You're describing what is a feature of remote tunnels, though. Ability to executing code and commands is the entire point.

By default no local code execution is allowed when you open an unknown workspace btw: https://code.visualstudio.com/docs/editor/workspace-trust

amluto3• 2 years ago

You're describing what is a feature of remote tunnels, though. Ability to executing code and commands is the entire point.

Excuse me? Editing code is the entire point. A major, but still secondary, point, is building and running code on the remote machine.

Running code on the client is certainly pointy, but I don’t think it’s “the point” at all.

yoyohello13• 2 years ago

This is the main thing that makes me uneasy about using neovim distributions. So many random extensions get installed.

I always think in the back of my mind "if someone compromised nvm-cmp or something we would all be so screwed". That's why I'm very happy to see the core team trying to bring those essential LSP and Completion packages into neovim core.

VS Code extensions are less secure than browser extensions or even NPM packages

Related Stories