VSCode’s SSH agent is bananas

by zdyxry • 1 year ago

737 510 1 year ago

Instead of working with existing remote tools it deploys a comprehensive agent that includes:

A Node.js binary installation. A WebSocket connection back to the VSCode frontend. Extensive system access capabilities.

The VSCode agent has broad permissions including:

File system navigation. File editing capabilities. Shell PTY process creation. Self-persistence abilities.

jazzyjackson• 1 year ago

It’s not clear to me, are these issues on the local or remote vs code instance? If remote, I understand elisp tramp is a lighter touch as far as dependencies go, but is the attack surface all that different? (That is, does the remote node binary have any permissions a user running arbitrary ssh clans wouldn’t?)

The OPs goal was to give an llm keys the kingdom on an ephemeral/throwaway virtual machine, are they saying the sockets opened up by the agent allow it to fiddle with the developer machine it’s meant to be isolated from?

throwanem2• 1 year ago

Emacs Tramp just uses whatever SSH access you already have to a remote host, to copy files back and forth. It may use scp or sftp if the remote host advertises the protocol, but it does not install anything or invent any of its own protocols.

AlotOfReading• 1 year ago

I don't see any reasonable alternatives that can support what VScode does, like running extensions that aren't installed locally. Maybe those features aren't something you want, but they're part of the product feature set.

roland35• 1 year ago

I believe extensions are actually installed on the host itself! At least when I use vs code remotely it shows "install on xxx" for each extension if I haven't installed it yet

dekhn• 1 year ago

One perspective is to think of these as things that a modern OS should provide as a standardized feature, and VSCode is just working around the fact they don't exist. It's crazy to think about but the kernel itself could have a webserver (or other protocol) with encryption and auth that let you directly control the entire machine through EBPF. It could be an entirely different paradigm for client/server remoting. Also a security hole you could drive a death star through.

eru7• 1 year ago

You can have a standardised feature set, without sticking everything into the kernel.

I'm all for the former, but the latter is unnecessary.

otabdeveloper44• 1 year ago

A rootkit built right into the kernel? And apparently this is okay because it's "encrypted"? (Aka impossible to diagnose or monitor.)

Yikes.

1oooqooq• 1 year ago

pretty on par with the dowload the world as dependecies trend.

ilrwbwrkhv2• 1 year ago

Yes vscode is awful. Zed ssh does a far better job. But we are living in an awful world.

sa1• 1 year ago

Zed also downloads a remote agent.

dsissitka• 1 year ago

And toolchains without asking:

https://github.com/zed-industries/zed/issues/12589

rednafi11• 1 year ago

What are you yapping about? Zed does it in the same way.

ilrwbwrkhv2• 1 year ago

It's much lighter

apatheticonion3• 1 year ago

Honestly, I'd love a terminal based editor/IDE that is essentially a shameless clone of VSCode.

nvim showed me that it's possible, with mouse events, right-click context menus, and a rich editing experience. I did genuinely try to transition to nvim but I use my mouse a lot; resizing panels, using the file tree, copy/cut/pasting files in the file browser, tabs, etc.

That's not to say nvim is bad, but after hours of configuration, I personally found myself less productive with it when compared to VSCode - however VSCode is bloated, slow, uses a lot of RAM, and SSH functionality is unreliable.

I actually started writing this as a side project - using Rust, ratatui and a plugin system based on wasm (and dynamic C libs), but you know how side projects go

tiltowait• 1 year ago

I had a similar experience. I liked nvim for simple editing, but not for anything multi-file. And then I found Helix, and I never looked back. I only hop into vscode if I want a Jupyter notebook.

apatheticonion3• 1 year ago

Thanks for the recommendation. Just looked it up, I'll give it a try!

EDIT: https://helix-editor.com/

I love that the homepage has a video showing usage. Such a great way to demonstrate it.

pshc• 1 year ago

Have you tried Zed?

apatheticonion3• 1 year ago

Yes I have. Last time I tried it, it didn't have SSH support (I'm on a MBP so my life involves around remote development tooling).

I'll take a look again

CGamesPlay2• 1 year ago

I do my full-time development work using Neovide (a GUI frontend to nvim) over SSH. As a long-time vim user, this is great for me, but I will freely admit that it is nowhere near as easy to set up as VSCode, and it is also fundamentally a dumb client over SSH, so it suffers from lag spikes. There has been some discussion about what a smart client version of nvim would look like, but it's probably years out: https://github.com/neovim/neovim/issues/24690

asveikau• 1 year ago

I remember many years ago looking into mouse events over terminal and in that time you could only handle clicks, you couldn't track cursor position so dragging would be impossible. So I was curious to hear about someone actually making a usable mouse UI in a terminal.

As I do some googling it seems like there is now better support for that.

krobelus2• 1 year ago

Kakoune has network-transparency - you can run the editor server on a remote system and run editor clients locally, communicating only via Unix socket.

theamk• 1 year ago

Reminds me of Jenkins (the CI system) remote agent.

One would expect a remote agent with well-defined capabilities: read/write/delete files and directories; run the process with stdout/stderr capture; stop the running process started in previous item.

Instead, there is a generic bytecode executor, and Jenkins controller ships out Java bytecode to be executed remotely. Crazy stuff.

pjc50• 1 year ago

Nothing magic about the byte code, it's a compiled bit of the CI script. The whole point of Jenkins is to run arbitrary code on a machine farm.

hiccuphippo• 1 year ago

Maybe they could make a wasm interpreter with well defined limitations. Similar to how Deno does it for Javascript.

chupasaurus• 1 year ago

Task runners have to interpret the tasks one way or the other. Speaking of crazy stuff, Ansible in general ships out Python scripts to be executed remotely.

gopalv• 1 year ago

The way most people learned this is because somewhere in the middle of last year, VSCode's node install stopped working with the old glibc.

https://github.com/microsoft/vscode/issues/201129

Most people who hit this hard pinned their vscode to 1.85 & it took a while till this turned into a simple nag bar on top of their editor.

nooorofe• 1 year ago

it was fixed with workaround, in newer versions, they copy statically compiled nodejs to the server and it works.

kevmo314• 1 year ago

Is the news here that someone bolted an LLM onto that? Extensions always had this degree of access. npm or pip install can also do some pretty nasty stuff with a malicious package.

concerndc1tizen3• 1 year ago

VSCode is an IDE designed to suffocate the open source alternatives, so that they retain full strategic control. Oh, and it also promotes their tech (Copilot, Github, C#, TypeScript). It's a long list of issues.

It works well though, particularly over SSH and devcontainers, although it has severe bugs that they refuse to fix, and it isn't open source so you can't fix it yourself.

I wish software was secure by design, like browsers are. But it just isn't a business priority, because consumers have so little to lose. And enterprise customers have strict environments, separate staging/production environments that reduce blast radius, and so on, so the insecurity is tolerable. Besides, employees can't be trusted anyway, so what's the point of having a very secure IDE if they immediately run curl|sudo bash.

Are there any good web-based alternatives? (like Runpod's openvscode-server)

jeffbee2• 1 year ago

Eclipse theia. It is an almost pixel-perfect ripoff of VS Code that integrates the open source components such as Monaco. It is what you are using if you've ever started a Google Cloud Shell Editor.

TiredOfLife• 1 year ago

Theia embraced the Monaco editor. Are extending it and now are trying to extinguish VS Code.

brabel2• 1 year ago

Amazing that most commenters seem to even be unaware of Eclipse Theia which is basically THE open-source VSCode. They need better marketing (well, being open-source, they'll never have great marketing like MSFT, of course).

PeterStuer2• 1 year ago

After decades of using IDE's from Think Pascal/C, MCL, Borland C++/JBuilder and lots of Visual Studio and mostly PyCharm these days, I was forced to use an Eclipse IDE for a model driven dev project a few years ago.

Worst IDE experience ever and this tainted the 'Eclipse' brand for me forever.

hedora2• 1 year ago

Vscodium is open source, and ssh mode works. I don’t think copilot does.

evilduck• 1 year ago

Cline, Roo, and Continue all work with Codium though, so it's not a big loss.

Arrowmaster• 1 year ago

Since when? Last time I looked the remote ssh plugin wasn't open source and refused to run on forks?

kristopolous3• 1 year ago

this looks like the chromium version of vscode, so long as we're both talking about the same thing: https://vscodium.com/

goldencoralefan• 1 year ago

Zed. It is written in a compiled language and it’s C++ extension doesn’t take down my servers.

jay_kyburz2• 1 year ago

Ohh, interesting to see they have Linux builds available now.

o11c• 1 year ago

Zed was in the news recently for the exact same security flaw.

bongodongobob• 1 year ago

VSCode is great. If it suffocates other products, that's their fault for not being better. MS hate for hate sake is fucking old, do better.

KronisLV3• 1 year ago

I don’t think people like the principle behind it: https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extingu...

Same reason why some people are adamantly against using closed source software though at least https://github.com/VSCodium/vscodium exists.

That said, personally I use OSes like Windows or IDEs like JetBrains sometimes just because they help me get things done, it is what it is.

csdreamer73• 1 year ago

VSCode is an IDE designed to suffocate the open source alternatives, so that they retain full strategic control

What open source alternatives? Atom was a mess that kept breaking. LSP plugins are now used in almost every featureful editor and have really made editing a lot better. You spent more time configuring Vim and Emacs than they saved you. Microsoft made a really good code editor that set a standard and likely took market share from their own (mostly Windows) Visual Studio.

I do not use it anymore because of the creep of closed source plugins (+ they keep breaking my workflow) but I still think it is a great improvement.

I wish software was secure by design, like browsers are.

Someone does not remember (or was not around) for the ActiveX or Flash days.

skydhash3• 1 year ago

You spent more time configuring Vim and Emacs than they saved you

I trade whatever default workflow that VSCode and other IDEs are imposing for a better editing experience. And even the initial time investment is short these days due to the trove of config and tutorials online.

After learning Vim, I ditched the files explorer and embrace the buffer workflow instead. Opening many windows at the same time to peek at multiple files, then switching to a new tab only if I don’t want to lose the current windows configuration. Then fuzzy searching for navigation, and using the quickfix list for search and errors. No friction from thought to action.

Another plus for me. I have an emacs session opened for weeks now inside a VM on my desktop to work on a side project. Whatever the computer (laptops or said desktopj, it’s a quick ssh, then resuming the dtach sessiom and my workspace is ready. Multiple files opened (almost all of them), a postgresql REPL, Tasks runners, and a lot of packages (magit, project.el, consult,…) working together to streamline working on code.

makeitdouble3• 1 year ago

What open source alternatives?

This is part of parent's point IMHO.

As VSCode is good enough, there is no oxygen for an open source effort to reinvent that wheel. At some point it will stale long enough that some bigger communities will want to tackle the challenge, but that won't be tomorrow.

I see VSCode as a net positive, but I think it's healthy to keep in mind the embrance->extend bigger picture.

poidos• 1 year ago

You spent more time configuring Vim and Emacs than they saved you.

Doom emacs + Evil is basically free in terms of config time and it’s wonderful.

OtomotO• 1 year ago

You spent more time configuring Vim and Emacs than they saved you

Me? Nope.

I program 8 hours per day on average and my editor works exactly like I want it to, same as my fully customised desktop.

Even if it didn't save me time (which it does), I feel way more comfortable than with the alternatives.

jay_kyburz2• 1 year ago

What open source alternatives?

Kate is great!

Aeolun2• 1 year ago

Zed is now open source. It’s new, and it’s great!

aftbit• 1 year ago

You spent more time configuring Vim and Emacs than they saved you.

Yeah, ten years ago. Now I just use the damn thing and occasionally update my plugins.

At this point, I can hardly use nano, the vim bindings are so deep in my brain.

patrickkidger• 1 year ago

What open source alternatives?

Helix:

https://github.com/helix-editor/helix/

Like vim, but already has an LSP etc out of the box. Things are already there so the config files are minimal.

wkat4242• 1 year ago

Someone does not remember (or was not around) for the ActiveX or Flash days.

"Hey wouldn't it be handy if every webpage can download binary code and run it? Oh and let it talk to every DLL in the system as well. Super handy! What could go wrong?" - Microsoft in 1998 :)

I mean sure we were all a bit naive in the 90s and 00s but did they really not see that coming?

f1shy• 1 year ago

You spent more time configuring Vim and Emacs than they saved you.

Uh? I‘ve always used vim out of the box, and Emacs I got it just like I like by searching the .emacs file of a youtuber who has a configuration I likes. Exactly 1 minute.

m463• 1 year ago

I wish software was secure by design, like browsers are.

I feel this is one of those "repeat it until it is true" marketing things, like "apple believes privacy is a fundamental right"

But really, I think vscode, browsers and apple products only tangentially secure because business goals, features and convenience trump these kinds of broad statements.

I so wish it was otherwise. There are so few islands of common sense in our world and the water level keeps rising.

white-flame• 1 year ago

I think it's more a case that browsers take security into account at the feature design phase, whereas other applications don't. That's actually a huge step in the right direction. Same thing with mobile OSes, which have a very preferable decision to sandbox individual applications, instead of running them with full user permissions & full user data access, like desktop OSes do.

Now, whether the browsers or mobile OSes actually are secure because of that, is a separate thing, but those are good steps to take.

curt15• 1 year ago

Browsers weren't really secure by design until IE first introduced a browser sandbox sometime in the IE8 days and then Chromium came along and set the standard for sandboxing.

otabdeveloper44• 1 year ago

what's the point of having a very secure IDE if they immediately run curl|sudo bash

Docker is a technology that downloads random unsigned tarballs from the Internet and runs them as root. Also it turns off your system firewall in the process, to make all this more "convenient".

Really we have much more low-hanging fruit to pick.

KronisLV3• 1 year ago

They’re working on signing: https://docs.docker.com/engine/security/trust/

They have a rootless mode: https://docs.docker.com/engine/security/rootless/

Firewall situation is mixed: https://docs.docker.com/engine/network/packet-filtering-fire...

It’s a bummer that those aren’t the defaults, but it would directly make things less convenient and therefore make people less likely to use it (same reason why installing various software is still offered as a Bash script that you curl and pipe to your terminal, e.g. Ollama; at least it’s not offered as the only way usually), what a world.

Sophira• 1 year ago

This is pretty much exactly why I've never used Docker up to now, as cool as it seems.

kristopolous3• 1 year ago

"Runpod's openvscode-server"

I searched, couldn't find it. what are you talking about?

kirici2• 1 year ago

I'd guess that there was a mixup:

https://github.com/gitpod-io/openvscode-server

For what it's worth, we have been using code-server instead in prod (prod being internal) for over a year now.

https://github.com/coder/code-server

https://coder.com/docs/code-server/FAQ#whats-the-difference-...

joaomoreno2• 1 year ago

It works well though, particularly over SSH and devcontainers, although it has severe bugs that they refuse to fix, and it isn't open source so you can't fix it yourself.

VS Code dev here. Would you like to share that list of severe bugs? Also, can you clarify what exactly isn't open-source in the entire VS Code with SSH and devcontainers flow? It's disheartening to read this, knowing that this simply isn't true.

larsnystrom2• 1 year ago

Where is the Remote SSH extension code? I always thought that was closed source?

Edit: The reason I think it is closed source is because a StackOverflow answer says so[1]. I’d be very interested in seeing the code if you could link to its repo!

[1] https://stackoverflow.com/a/55979526

Squeeze2664• 1 year ago

The remote development extensions don't appear to be open-source. The marketplace page for the "Remote - SSH" extension will point you to a license that says, among other things, "You may not: work around any technical limitations in the software;". The same page brings you to a github repo for the extension that contains no source code; it claims to be for gathering feedback only. I don't know how you can imply everything about this is open source, maybe I'm not looking in the right place?

joaomoreno2• 1 year ago

This is what posting sleep deprived gets you. I was referring to the cli[0] and server[1] components, which have most of the meat. Sorry for the misunderstanding. That being said, I'd love to know which severe bugs disrupt your usage.

[0] https://github.com/microsoft/vscode/tree/main/cli

[1] https://github.com/microsoft/vscode/tree/main/src/vs/server

Hackbraten3• 1 year ago

Not OP, but I've been trying to get remote development working for years but to no avail. The official response on the GitHub issue [0] in 2019 was:

The "remote" functionality (SSH/WSL/Docker) is currently only available for VS Code proper, not 3rd party builds.
[...] /cc @joaomoreno

Last time I checked, Arch Linux users who have the Arch Linux build of VS Code installed still cannot use remote SSH development nor dev containers. I definitely can't get it working on my own development machines.

[0] https://github.com/microsoft/vscode-remote-release/issues/17...

Hackbraten3• 1 year ago

Speaking of "disheartening": your fellow devs who wrote the Pylance extension decided to mount a ReDoS attack against anyone who opens it in a debugger. I merely tried to investigate an issue that I had. [0] [1]

Being on the receiving end of a deliberate ReDOS attack feels more than disheartening. This is not shedding a good light on the VS Code development team as a whole. This is a despicable act.

[0] https://darmstadt.social/system/media_attachments/files/112/...

[1] https://darmstadt.social/system/media_attachments/files/112/...

cruffle_duffle2• 1 year ago

Just here to say that the editor wars this comment kicked off are classic. It’s comforting to know that some things never change.

/written using pico on my Blackberry RIM. Because physical keyboards matter and pico is easy to use.

spixy• 1 year ago

How does VScode promote C#? I have tried writing C# in it and it was a mess. Visual Studio is much superior.

alternatex2• 1 year ago

VSCode promotes Visual Studio by being terrible at C# development. /s

TeMPOraL2• 1 year ago

I wish software was secure by design, like browsers are.

I don't. Browsers are already close to "security or utility, pick one"[0] if you try to go beyond the TV + form filling appliance experience. I don't want this kind of thinking to leak out to all software I use. Like, I'm happy to be able to write:

    find . -type f [stuff] -exec rg 'foobar' {} +

without worrying about rg (or anything) refusing to run because its vendor didn't set up Access-Control-Allow-Origin header correctly, or similar such bullshit that's just commonplace whenever you try to operate (instead of consuming) or integrate anything on the web. And no, I don't want to have to buy a domain and publicly spell out my computers and get them legit certificates just so they're allowed to talk with each other when physically next to each other and on the same LAN.

I don't want my OS to start looking like Android either, where everything is hidden and nothing is allowed to talk to anything else - i.e. literally the opposite of the promise Android started with.

[0] - Security and usefulness are fundamentally opposing forces. In the limit, the most secure computer system is a dead rock.

alternatex2• 1 year ago

First time I see someone criticize Access-Control-Allow-Origin. You do realize it prevented countless script injection attacks from affecting users? Most of whom are not people who are on the web for the purposes of hacking random integrations.

Also seems like your idea of integration is using someone else's server without permission.

botanical76• 1 year ago

Android has very good reason to have such strict process isolation. For example, that third party calculator app I downloaded shouldn't be able to interface with my bank app. That said, I do feel it (Google) has used security as an excuse to build a walled garden.

How would you do Android differently?

n144q7• 1 year ago

That's a lot of accusations without evidence. VSCode does questionable things, but nowhere near the levels you are describing.

And is there any evidence that VSCode is not secure, by Node.js standard? Has there been significant security incidents that were not handled properly? Has VSCode been neglecting security issues?

No to all those questions, based on my experience. Node.js inherently is loose on permissions -- by default you can do IO/connect to Internet however you want -- but that's not VSCode's fault. Otherwise, VSCode team has been very responsive at handling security issues.

(Saying this as an experienced VSCode user and extension developer.)

nsonha• 1 year ago

Cool theory but no one uses typescript, github or C# because of VSCode. It's a nonsensical narative if you just spend more than a few seconds thinking about it. All those things dominated their niche before VSCode came into the picture.

Any better product can be accused of "trying to suffocate the OSS alternatives". Do Microsoft somehow have the power to make other OSS projects suck?

cratermoon• 1 year ago

Can you say, "RCE"?

jeffbee2• 1 year ago

Other than not being the exact way the author would have done things, what's the issue? If you're afraid your editor will go wild — and this is a possibility for any editor — you should setup your development environment in some type of sandbox. Personally, I host mine in a multipass virtual machine.

smallerize• 1 year ago

Oh and it keeps old copies around after an upgrade. (Maybe this was fixed?) I've had it use up all the disk space on a small VM.

appleaday1• 1 year ago

This is an actual issue can someone write a rust replacement for whatever VSCode is doing and also making sure this works on the open source version (VSCodium) thanks

throwanem2• 1 year ago

Of course, if VS Code can't be run securely on dev endpoints, that's an argument for provisioning Codespaces, right?

kazinator• 1 year ago

"SSH agent" is a confusing term to use here, because it usually stands for a daemon that caches authentication tokens.

rednafi11• 1 year ago

The "VSCode" before "SSH Agent" does the disambiguation fairly well.

bqmjjx0kac• 1 year ago

I, for one, was actually confused.

akvadrako• 1 year ago

Only of you already know what the VSCode agent does and then you don't need the article.

CGamesPlay2• 1 year ago

Agreed, because VSCode does not provide an SSH Agent but does communicate with your local one (their own version of ForwardAgent, complete with the security implications that carries). And the way it does that breaks a popular macOS SSH agent: https://github.com/maxgoedjen/secretive/issues/543

epistasis• 1 year ago

Oh shoot, secretive is one of the few ways I knew of to keep track of each time an SSH key was actually used to auth something. I love using Agent Forwarding but the idea of anybody with root being able to arbitrarily auth stuff gave me a (perhaps unreasonable) feeling of insecurity.

RockRobotRock• 1 year ago

I love secretive.

rednafi11• 1 year ago

I don't know what the alternative would be here. VSCode's SSH edit works surprisingly well, and I stopped fiddling with vim, nano, or micro on my remote machines long ago.

The agent gets out of my way and lets me work in peace. It almost feels like I'm working from my local machine—a huge win in my book.

This could be a security risk, but the development experience is unmatched. I couldn't care less which other editor VSCode is killing, as I mostly don't care about my tools as long as they get out of the way and let me do my job.

spacemanspiff01• 1 year ago

The security risk comes from all those unvetted plugins, that have unrestricted access to the editor.

rednafi11• 1 year ago

Yeah, I'm all in for a more secure option as long as it allows me to do everything that VSCode's SSH agent does. But if the devex goes down the drain because of "security" then I'm good for now.

shipp023• 1 year ago

That's an issue with any plugin system, right? AFAIK no IDE has a plugin system with capabilities or a sandboxed interpreter.

VSCode does have a thing where it's like do you trust the authors of this project. Not sure what it does because I've never had to use it. From StackOverflow[1]:

If you select No, I don't trust the authors, Visual Studio Code will open the workspace in 'restricted mode'. This is the default for all new workspaces. It lets you safely browse through code but disables some editor feature, including debugging, tasks, and many extensions. However, keep in mind that 'restricted mode' is all you need for many use cases.

Actually if restricted mode[2] is any good, vscode might be better at security than most other editors/IDEs.

[1] https://stackoverflow.com/a/67914669/11422647 [2]:https://code.visualstudio.com/docs/editor/workspaces/workspa...

causal4• 1 year ago

Note that your local plugins do not get installed on remote instances without manually doing so

arp2422• 1 year ago

I don't know what the alternative would be here

I'm not sure what features VSCode offers exactly, but I find sshfs works quite well for remote editing of a bunch of stuff. I think it should basically be the same as VSCode?

rednafi11• 1 year ago

One fewer tool to think about. It remembers the connections and instantly gives you access to a full-fledged editor on a remote server. It just works, and I don’t think about it twice, which is a huge win in my book. I’m good with the trade-offs.

sunshowers5• 1 year ago

You really want your LSPs to run on the remote, especially with high-latency connections.

EVa5I7bHFq9mnYK• 1 year ago

VSC allows to debug the remote program, set breakpoints etc. How can you do it with just the editor?

averageRoyalty3• 1 year ago

Absolutely. It worked fine before vscode existed and it will work fine when the next hot button IDE comes along. I'm not sure why people keep reinventing the wheel and creating themselves new problems!

saulrh2• 1 year ago

The alternative is suggested by tramp, which from what I know treats the remote as a network filesystem instead of an execution host. I don't believe that tramp deploys any binaries: it reads and writes bytes over pipes and all meaningful execution happens locally. Notably, it does not achieve persistence, because there's a difference between "VSCode plugins have access while you're SSH'd in" and "VSCode plugins have access forever".

rednafi11• 1 year ago

Persistence is important to me, and making it read-only significantly reduces its usefulness. I regularly SSH into a dev machine to run scripts and update configurations. As long as a tool lets me do that without getting in my way, I'm good with any solution that works.

cobbal• 1 year ago

Running `make' works in tramp, so it can do some form of execution

tubs• 1 year ago

How does tramp make my autocomplete work seem I need to build on the remote machine so all the paths are in that file system?

How does it execute the exact version of clangd that is running on the remote not my local laptop, desktop, or windows machine I’m using to remote in?

How well does it search through files on a slower connection when it has to download every byte of every file?

otabdeveloper44• 1 year ago

I don't know what the alternative would be here.

Emacs' TRAMP is pretty crap but still more reliable and user-friendly than the hot mess of VSCode remote editing.

rednafi11• 1 year ago

Hot mess of VSCode editing

Okay. I have been using VSCode remote session since its inception and it works well for my case.

Also, Vim/Emacs aren’t my cup of tea, so it’s not like that I have many options.

sevensor• 1 year ago

From what I’ve seen, my colleagues using vscode are hampered in ways they don’t recognize because they have no concept of how good things could be. Working with multiple remotes, they’re often completely unaware of which one they’re connected to or what state their connection is in. Their terminals are laggy and session state persistence is inconsistent. It’s just a massively worse experience than tmux + a real text editor. Plus the server is a real pig and they often end up running half a dozen server instances because the server doesn’t terminate properly. And then, half the updates break and they lose an hour because they don’t know how to ssh into the host with a real ssh client and clean up the busted vscode server.

mixmastamyk6• 1 year ago

Me, me, me, got it. Unfortunately there are other folks in the world. ;-)

Students need to focus on fundamentals, not the fanciest automatic whiz-bang tools available. Why we learn arithmetic before allowing calculators.

modeless2• 1 year ago

This is what makes VSCode's remoting features awesome. This is the right architecture. Parts of the editor should run on the client and other parts on the server.

The underlying protocol on that connection can: Wander around the filesystem, Edit arbitrary files, Launch its own shell PTY processes, Persist itself

Yeah that's what SSH access gives you too.

rednafi11• 1 year ago

I was wondering about this too. Once you have SSH access, unless your user is restricted, you can do whatever in the remote system.

All VSCode is doing here is installing node to run the extensions, setting up a WSS connection back the client for realtime communication. I don't see the harm there given the extensive feature set.

fpoling• 1 year ago

One can ssh into untrusted remote host with little risk for local machine security. That is, if the remote site is compromised one cannot use it general to compromise the local machine. At best the attacker can try to exploit bugs in terminal escape sequence handlings or rendering of complex Unicode characters by the local terminal. This is a relatively small attack surface.

With vscode that exposes the local machine to the remote with support of very complex and undocumented protocol it is entirely different story.

Which is a pity especially given that VScode is browser-based and browsers are designed to allow connections to untrusted servers.

I suppose it will be a different story if VScode was designed with remote editing capabilities and treated the local stuff not different from remote. But given that the ssh extension was brought as an after thought with little regards for the local security we have the present unfortunate situation.

roywiggins5• 1 year ago

It's the other way around: the post is saying that the remote VSCode agent can tell the client to just do whatever. That's not how SSH usually works, if an SSH server can pwn a client that's a bug.

Rohansi• 1 year ago

I think it's only necessary because extensions may need to run client side. Not sure if that means the extension needs to be published on their marketplace site.

modeless2• 1 year ago

I don't think this is true and I don't think it's what the post says.

dogmatism• 1 year ago

the answer is in the blog

as always, Emacs

shipp023• 1 year ago

This is going to sound naive but, I don't understand what the security issue is. If you can ssh into a machine and port forward a socket, you already have permission to do all the other things. VSCode's protocol seems to be exposing it in way that's more convenient for them.

How is this a security problem? Is it because someone on the same network as the remote machine but without SSH access can connect the port that is forwarded over SSH?

As a user, I quite like how well VSCode's SSH system works.

schmichael• 1 year ago

I think the difference is that what VSCode is doing is not an SSH Session like you get in a terminal with the ssh command or putty.

VSCode is installing a remote agent on the target machine that happens to use ssh as its transport protocol, and offers to share that transport with the user.

Is this a problem? Not if it only does things you want it to do. However any agent based system exposing an arbitrary API is suddenly a much bigger attack and risk surface area than the well trod (and still fraught) path of emulating a terminal over ssh.

shipp023• 1 year ago

Is it better to programmatically interact with bash to provide the features VSCode does? Do note that I am unwilling to accept an implementation with less features/ease of use!

I can see how writing a custom agent that provides remote access to privileged API's is a bad idea but bash isn't exactly the most secure piece of software in the world.

shitter• 1 year ago

However any agent based system exposing an arbitrary API is suddenly a much bigger attack and risk surface area than the well trod (and still fraught) path of emulating a terminal over ssh.

I can see how this increases local (to the remote system) attack surface, but as long as the agent has the same OS privileges as the user logged in over SSH, what extra remote risk does this introduce?

TZubiri• 1 year ago

I sometimes kick myself for not being more productive.

But then I see the clusterfucks productive people are doing and it looks like I'm onto something

wg0• 1 year ago

Anyone doing such remote edits on production or even staging systems is past the point of caring about any security implications.

The remote development workflow is intended and should be used for dedicated disposable development machines.

That's the responsibility of the operator and it is not for the tool to take care of.

3abiton• 1 year ago

This is really big. I always thought Vscode ssh capability was just some black magic that the open source community wasn't able to replicat well with vscodium extensions. Yet, it seems the reason why is that MS threw a curve ball with that naming.

0xbs0d2• 1 year ago

I think the latest Jetbrains tools do the same or similar things. They also install their own server on the target machine and connect to that. And I mean it's Jetbrains, so again, closed source tools. But it's not Microsoft so nobody is talking about it I guess.

indigodaddy• 1 year ago

he says in the article, that the agent seems to be just fucking about at will

__MatrixMan__• 1 year ago

...which I've come to expect from Microsoft. Windows scrozzles the efi partition for my other OS every third or fourth time it installs updates. It's like they think they own every computer they have code on.

ydj• 1 year ago

But the author doesn’t give a single example, and so there’s nothing someone else can do to explain why or continue the conversation. The best we got use that he has a vague sense of unease, which I don’t think is very useful.

ajsharp• 1 year ago

This is the relevant part:

The agent runs over port-forwarded SSH. It establishes a WebSockets connection back to your running VSCode front-end. The underlying protocol on that connection can:

- Wander around the filesystem - Edit arbitrary files - Launch its own shell PTY processes - Persist itself

When you ssh into a remote server as a client, afaik that server cannot execute arbitrary code on the client. At a minimum, the client would have to explicitly take action for that to happen.

KTibow• 1 year ago

Is that to say that the server can do things on the client connecting to the server? That doesn't make much sense.

inetknght• 1 year ago

When you ssh into a remote server as a client, afaik that server cannot execute arbitrary code on the client.

...assuming you have X11 forwarding disabled and/or don't have X11 server running on the same system that your client is running on.

Deathmax• 1 year ago

It's helpful for evading detection, because if you've compromised a machine, you can drop in the server binary and it'll have been added to the allowlist for devs to run.

rkagerer2• 1 year ago

One reason it's a problem is because it's very unexpected behavior. Software should follow some sort of pattern that you can develop a reasonable mental model around.

fulafel2• 1 year ago

If you can ssh into a machine and port forward a socket, you already have permission to do all the other things.

Only technically. There are lots of situations where people (or robotic alarm bells) will be miffed if you instal your custom sw stacks, remote shells, "i don't know what these binaries are" etc on some servers you're supposedly just editing config files on.

spudlyo• 1 year ago

There are lots of situations where people will not notice at all. At my last gig, I wrote pretty extensive Ansible manifests that built and configured all my favorite tools on on bog-standard company provided development hosts so I found them cozy for remote work. I took severe liberties with these hosts and nobody batted an eye.

slashdave• 1 year ago

you already have permission to do all the other things

Of course. The problem is that a 3rd party agent can now use your permission to do what it wants, and you will be none the wiser.

IshKebab6• 1 year ago

You're already trusting that third party agent on your own computer. If VSCode itself was malware then it can do anything you can do, including sshing into remote machines and running commands behind your back.

joe913• 1 year ago

How does it differ from just logging into that machine and running code?

gorgoiler• 1 year ago

The agent on the dev server is now a vector back to VS Code on your laptop.

The agent is networked and running all the time so a hole on the dev server’s firewall is now a hole in your laptop’s firewall.

IshKebab6• 1 year ago

There is no security issue. The author seems a bit confused.

dangus2• 1 year ago

Not surprising considering that fly.io is an unreliable mess.

jcgl3• 1 year ago

I think you’re basically right: it’s not a security problem in that it doesn’t inherently traverse any vulnerabilities or security boundaries.

But it is a security problem in the same way that “curl | bash” is a security problem. An even closer equivalence might be something like “curl | bash” in your bashrc.

umanwizard• 1 year ago

I have never seen a compelling explanation for why curl | bash is a security problem.

cryptonector• 1 year ago

A piece of software that is ostensibly trying to help you is gathering information without your knowledge and.. one of these days may upload it to the mothership? That's kinda not ok don't you think?

tptacek3• 1 year ago

I have been for like a month now noodling on a long-form post about a piece of software we've been noodling with for 3-4 years now. Kurt is freaking out, because we haven't written anything on the blog since, like August. Finally I'm like, look, I will write the simplest thing I can come up with. We'll do the opposite of what we've been doing. We'll do anti- effortposts. I bet I can do one in 30 minutes.

I promise, I thought about this less than you have. It's a thing we were tinkering with, and I wrote about it. That's all.

alexgartrell• 1 year ago

More low effort posts please!

tptacek3• 1 year ago

I can't tell you how much I love that this post has generated 156 comments and I have nothing to rebut about any of them. I'm sure they're all right!

scop• 1 year ago

That first paragraph (in your HN comment, not the blog post) would have read better with zero periods.

Glad to see one of my favorite blogs is still active. I was starting to get a little worried.

The first two blogs currently listed, McCord-Valim’s FLAME-Livebook-GPU and your post which has the word “murid”, truly captures the psychological arc of a developer.

Thanks!

tptacek3• 1 year ago

That, or,

https://www.youtube.com/watch?v=DN1Foddvez8

bambax• 1 year ago

Good writing and fun, congrats! Is there a semi-hidden Monty Python reference in the middle?

tomrod2• 1 year ago

Absolutely hilarious. My partner and I have this same conversation every two weeks.

phyzome• 1 year ago

« we’ve decided to just be a blog again, so: we had to learn this, and now you do too. »

This is, indeed, the way.

dunham4• 1 year ago

Thanks for the post. I see now that it's bananas, but I didn't quite get that from the blog post. You list the things this agent can do, but I immediately assumed it went in the other direction, because anything else would be bananas. The statement in the README put it more succinctly for me:

A compromised remote could use the VS Code Remote connection to execute code on your local machine.

I feel like that "security note" should have a CVE number next to it.

DominoTree• 1 year ago

You have definitely covered noodling

rat87• 1 year ago

It seems like ssh may be the problem. I feel like there should be a way to ask for a docker like experience when ssh ing. Tell it to use is specific APIs to prevent process or filesystem access outside a particular folder (possibly allowing system binaries, although that might complicate things and require vscode to push more stuff to client). Basic googling indicates some choot options in the ssh server but nothing is mentioned on 5he ssh client man page.

Although maybe the solution is to download a docker container on the remote (directly if it has access to dockehub or over an ssh connection if it doesn't) then run a docker container mounting the remote directory and connect to it over ssh.

The problem with only syncing files from the subdirectory is that you also want to be able to run &debug on the remote started by vscode. So plugins also need access to remote or to run remotely for some code observation that may be prohibitively expensive if run locally(pre sync of whole subdir)

SoftTalker• 1 year ago

If you’re ssh-ing as a normal user you should only be able to modify files in that users remote home directory. You don’t need all that docker stuff just stop using admin accounts for normal access.

zeckalpha• 1 year ago

There are ways to do this sort of thing with inetd, pam.d, etc.

hughes• 1 year ago

I would be a little nervous about letting people VSCode-remote-edit stuff on dev servers, and apoplectic if that happened during an incident on something in production.

Totally agree that using vscode remote on production servers is insane.

Everything else described as "bananas" sounds like expected functionality.

Salgat• 1 year ago

I wonder what the use case is for this given the security implications. Staging instances that are sufficiently isolated from other environments?

thinkharderdev• 1 year ago

I think the use case is mostly dev servers, either remote machines running in the cloud or docker containers running locally. I don't use VSCode much, but the one thing I do use it for is when I need to do something linux-specific. I spin up a linux VM on my MacBook and use VSCode to remote into the VM.

knallfrosch4• 1 year ago

https://github.com/features/codespaces

All you need is a well-defined .devcontainer file.

Debugging, extensions, collaborative coding, dependant services, OS libraries, as much RAM as you need (as opposed to what you have), specific NodeJS Versions — all with a single click. It's dev-environment-as-code and you can version control it.

amluto6• 1 year ago

VSCode’s entire security model is bananas. As far as I can tell:

The client and its scripts and plugins get unrestricted access to the remote system.

The code you’re editing (if not in restricted mode) gets full access to the system it’s on (which is IMO an unfortunate default but not surprising — it’s really time for development systems to wake up and sandbox the code being developed to at least be limited to its own directory tree, but that’s a different story).

The code you’re editing (if not in restricted mode) and remote plugins (no prompt at all AFAICT) get effectively full access to the client system, subject only to whatever privileges the client itself has. Yes, you read that right, if you Remote-SSH into a machine, that machine immediately owns you. Microsoft knows, and they do not care.

See, for example, https://github.com/microsoft/vscode-remote-release/issues/66...

Spivak• 1 year ago

I mean if VSCode is wrong then Vim and Emacs are condemned to an eternity of hell. I think there's a culture of editors being powerful in this way to a fault, on purpose. I think that's why devs like them— the training wheels, guard rails, seatbelts are all off.

amluto6• 1 year ago

This is, frankly, absurd. I have literally never, in my entire time using VSCode with Remote-SSH, wanted the repository or an extension or anything at all in the whole IDE to have any sort of access to my client machine with the possible exception of reading my VSCode config. No files in my home directory, no network, no anything.

(Some people may like VSCode to forward a port to get a local web browser to target the remote machine. Fine, make that an option. I, personally, prefer to forward the port myself.)

rkagerer2• 1 year ago

Sorry, do you mean to say if I download untrusted code and open it in VSCode to inspect it, said code can pwn my system?

(Forgive me if this question sounds uninformed, I haven't used VSCode much, but if true this would not be behavior I expect from a code editor).

amluto6• 1 year ago

Yes, if you click yes when asked if you trust it.

But it’s worse: if you download untrusted code onto a remote machine or VM and then open it via VSCode’s SSH feature, it can own your local system.

mixmastamyk6• 1 year ago

I wouldn't expect the remote daemon to have full access. Should be running under the associated user account. However, if installed with privileges (via sudo, etc) to persist long-term, well you get what you asked for.

amluto6• 1 year ago

Compromising your user account is pretty bad. Let's see:

- Often gets your SSH key. Certainly gets to use your SSH agent.

- Can easily persistently compromise your web browser.

- Can trivially exfiltrate all your data.

- Has a good chance of being able to run 'sudo'.

- Can generally break Mac OS's sandboxing. (There's no shortage of examples demonstration that Apple really doesn't try very hard to make Mac OS resist attack by programs that are sort-of-sandboxed.)

- Gets all of your privilges for all of your fancy cloud services: GitHub, your favorite cloud's admin page, your email, slack, etc.

Saying "but it wasn't root" is not much comfort, nor is it even necessarily true.

bhouston• 1 year ago

LLM-generated code is useful in the general case if you know what you’re doing. But it’s ultra-useful if you can close the loop between the LLM and the execution environment (with an “Agent” setup).

Why not just run the agent locally to close the loop? I wrote an agentic coder just in the last week (open sourced it a few hours ago) that runs on the command line:

https://github.com/bhouston/mycoder

Works great and simple. Why this complex SSH setup in the first place?

neuroelectron2• 1 year ago

VS Code is written in JavaScript, it's inherently insecure. Now add an LLM that's familiar with JavaScript and it can easily escape and do arbitrary things. Where's the issue? Programming an IDE completely in JavaScript. It's like writing a text editor in English.

mardifoufs• 1 year ago

Why is JavaScript fundamentally insecure? What would be a secure language in your opinion? And how are the issues highlighted in the blogpost related to JavaScript?

neuroelectron2• 1 year ago

You read the article right?

VS Code has inherent security concerns due to the dynamic and unbounded nature of JavaScript combined with the attack surface introduced by its extensibility and web-based architecture. Electron (the JS interpreter used) has a dynamic web-based attack surface. Even if you mapped it out, it can change at any time thanks to the changing nature of JS standards.

Furthermore, the security issue with extensions in VS Code is well documented. And the obvious bit is it's executing code sometimes, arbitrary user code and extension code. Telementry, etc. are built in. It's really up to the user to use it in a secured manner. A lot of people just don't consider this.

dlx• 1 year ago

As mentioned in other threads, I'd love it if I could use Sublime Text remotely, but am stuck using VSCode simply because of what this setup allows in terms of remote coding. Perhaps a standard too that any editor could use would be amazing -- is there anything else out there that enables this much functionality out there?

sunshowers5• 1 year ago

Former long-time Tramp user, now Zed for the most part + VSCode for a few things. I'll say that neither Tramp, nor running an editor directly on the remote, are nearly as usable on a high-latency connection as Zed or VSCode. I think that generally wins out over the security concerns for me.

midtake• 1 year ago

I am still using Sublime Text, for some reason.

bigstrat2003• 1 year ago

Because Sublime Text is awesome and has yet to be surpassed by other editors, that's why.

toprerules2• 1 year ago

I've reached a level (staff engineer at MAANG) that I consider to be difficult to obtain using plain old Vim, and I've noticed that other high performers tend to still use Vim or Emacs. There's plenty of amazing developers who use VCode, JetBrains, etc. but I think there are certain personality traits - seeks out barriers to entry, likes to demagic tools through exploration, values completely open source, highly tinkerable community driven projects, etc. that explain this phenomenon more than feature set or ease of use.

When I read about how complicated VSCode's remote editing was (which I knew about before this article) it just made me want to use VSCode less. I can just ssh into a machine and use whatever editor is on the machine. VSCode's solution works, but it's also not nearly as elegant or universally applicable, and is more prone to breaking.

Also, Tramp is still quite awful, sorry Emacs users (netrw isn't any better).

qwe----32• 1 year ago

The principal and distinguished engineers on my team used Vim and Emacs :P

IshKebab6• 1 year ago

I would imagine that is more due to age than anything else.

imiric• 1 year ago

I agree that Tramp is not great, but there's a simpler solution that works much better: `watchexec` + `rsync`.

I can set it up to watch specific file paths, and sync exactly what I need. I'm still working on the local FS, so there's no editing delay, I can use all my local tooling, and the syncing takes milliseconds. I can also make it delete files remotely when they're deleted locally. And finally, I always have a local copy once I stop working on the remote machine, which is something I always needed to sync manually with Tramp. Plus, it's editor agnostic.

This VS Code feature would make me nervous, especially now that I know what it does.

8organicbits• 1 year ago

I joined a new team that's very VSCode centric and I've been thinking a lot about why I still prefer vim. My latest observation is that I find all the toolbars and other content filling the screen to be visually noisy. I turned on Copilot and wow it's more toolbars and text is flying into where I'm trying to write. Vim just lets me looks at, think about, and write code. I can't get into "flow" with VSCode.

Oh and since people are citing age in sibling posts, I'm mid-30s. I used emacs in university and switched to vim at my first job. I used IntelliJ for a really gnarly Java project, but otherwise I keep using vim.

regularfry6• 1 year ago

That's exactly what I dislike about vscode. It's so easy to trigger some pop-over that moves or obscures the precise thing you're trying to read.

The only thing really keeping me using it is copilot.

foldr2• 1 year ago

likes to demagic tools through exploration, values completely open source, highly tinkerable community driven projects, etc.

I liked all this stuff when I coded as a hobby. Now that it’s my job, I like VSCode because I never need to tinker with it to any significant extent and I can focus on getting my work done. I fire up vim occasionally if I need to do some fancy regexp munging.

toprerules2• 1 year ago

I don't tinker with Vim. I wrote my config many years ago and I touch it maybe once every few years. Otherwise it's completely rock solid.

I also find it highly amusing when people talk about needing to get work done and Vim, I mean I didn't get staff at one of the highest paying, hardest companies to climb at because I was sitting there tweaking configs instead of having impact. Vim lets me have impact by getting out of my way and letting me do precisely what I need to do wherever I need to do it.

kiitos• 1 year ago

the LLM generates the code, the agent scaffolding runs the code, the code generates errors, the agent feeds it back to the LLM, the process iterates

wait what

cruffle_duffle2• 1 year ago

Cursor does exactly this and it’s pretty wild the first few times it happens. Then you realize it does it only sometimes so you change its “English script prompt” file and make it do a full lint scan so it catches all the linter errors and then you watch it fix something in a wrong way so you stop it and ask WTF it was thinking, and then it apologizes and 50% of the time does the fix the right way and 50% of the time you chase a rabbit hole. Also sometimes it selectively ignores some of your script file prompt so you have to reprint and tell it to fix its script in a way that ensures it understands it… and it does that so you commit the new script document to git (or have it do it)

It’s the future. We live in it.

ak217• 1 year ago

The proper name for this functionality is Visual Studio Code Remote - SSH (https://code.visualstudio.com/docs/remote/ssh), and it's VSCode's killer feature. With this plugin, VSCode is the first IDE to properly implement the remote IDE paradigm.

When VSCode connects to the remote using the plugin, it installs an entire VSCode server - seamlessly to the user every time they connect to a remote - that keeps track of all project facilities, shells, extension accessory runtimes, takes care of embedded or computationally heavy tasks like compiling, building, running project-wide code analysis tools, etc. while keeping all settings, editor windows, and accessory panes local (which is critical for UX and latency). VSCode appropriately partitions responsibilities between the local and the remote, automatically restores IDE infrastructure on the remote as needed, and enforces the partitioning architecturally for all extensions.

This architecture is not an accident - it's rooted in VSCode's origin as a browser-based IDE, and makes use of the LSP and other features that don't exist in Emacs/TRAMP because nobody really thought deliberately about running the extensions at an arm's length from the editor UI in Emacs, using an async protocol that doesn't allow extensions to impact core UI latency. But the flipside is that the "client" part I described above does place a lot of trust in the "server" part, just as you might expect a browser-based application to do.

Whether you consider this architecture bananas or not depends on your security model. It's probably not the best idea to let people SSH to production using this plugin. If you are trying to rely on it to partition a novel AI tool away from part of your infrastructure, yeah, it wasn't really meant for that. The plugin predates agentic AIs by 5+ years. But it's an incredibly powerful and useful feature. I don't think taking cheap shots against it is helpful when the actual bananas thing is trying to use it in a way it was not intended for.

nomendos• 1 year ago

When is the Risc-V support coming?

Aurornis• 1 year ago

Whether you consider this architecture bananas or not depends on your security model.

Knowing about the security risks is good. In all of my use cases I control both client and server machine. The remote SSH capability just lets me use the UI comfortably on my laptop.

amluto6• 1 year ago

VSCode appropriately partitions responsibilities between the local and the remote, automatically restores IDE infrastructure on the remote as needed, and enforces the partitioning architecturally for all extensions.

Excuse me? This:

https://github.com/microsoft/vscode-remote-release/issues/66...

Is the opposite of architecturally enforced appropriate partitioning. This is “we want to make it convenient to use, and we do not care about security or enforcement of the local vs remote split at all.”

laserlight• 1 year ago

Wow. Only a genius could come up with the idea of compromising the localhost security when connecting to a remote host --- and still call the thing SSH.

moondev• 1 year ago

Coda by panic had integrated ssh support for remote editing + terminal. Predates vscode by 7ish years.

https://en.m.wikipedia.org/wiki/Coda_(web_development_softwa...

dangus2• 1 year ago

I think that the author of this blog post doesn't understand what a development environment is! Which isn't a surprise to me considering that fly.io is such a crap service, I'm not shocked they have employees that don't understand development practices.

Remote development environments with this sort of setup are sometimes needed for applications that can't effectively run on your local workstation, or where the server environment is very different than the workstation, or where you want to ensure better consistency than a local workstation can offer.

The operating system controls the security boundaries fully. Your ops team or person who built the remote OS can limit the permissions of your remote connection's user however they'd like. It's like the author of this article forgot how Linux works: you can restrict users from running certain commands or accessing unauthorized directories with trivial ease.

And when it comes to security risks, this is supposed to be a development environment. It's not meant to be used in a produciton system accessed outside the boundaries of your organization.

mfrw• 1 year ago

> VSCode mounts a full-scale invasion

I love to read articles that have a bit of humour(no offence to VScode people); somehow, it seems one can connect more with the writer.

Thank you, kind stranger on the internet. You made me smile when I most needed it :)

bkallus5• 1 year ago

I ran the servers for our networks, binary exploitation, and intro systems programming classes, and this thing is a major annoyance. It is because of this stupid RAT that students do not understand how to use the OpenSSH client.

I've tried a few things to fix this: 1., I set a motd on our class servers asking the students not to use the VSCode remote server plugin. 2. I ran `ncdu /home` in front of the class and demonstrated how, without exception, everyone with >100MB of disk usage on the class server was a VSCode user. 3. I set a user process limit of 45, because the VSCode RAT (somehow) uses ~50 Node processes. When students inevitably ignored the motd and the in-class warning, they hit the process cap and had to ask us to kill their processes in order to get back onto the system. 4. I replaced the process limit with a script that kills all the .vscode-server RATs every 10 seconds.

kalleboo3• 1 year ago

Your comment is bringing back so many memories of being in university and working around the anachronistically strict limits the uni sysadmins had on the network

jaygreco• 1 year ago

Ah yes, one of my favorite skills learned in school was how to work around arbitrary rules made up by cranky sysadmins! I still use it all the time.

The smart kids (whom I’m sure look like they are learning that precious openssh client) are doing their assignment locally or on a free tier VPS with VS Code and scping the thing over when it’s done.

They’re also smart enough to learn openssh when they need it IRL.

darkwater• 1 year ago

And then HN complains that new software is crap that wastes too much resources and new developers don't want to optimize resources...

bkallus5• 1 year ago

I too have these fond memories, and I enjoy passing it on to the next generation :)

causal4• 1 year ago

Can you explain why though? I get that you had to put a lot of effort into blocking VSCode but it's not clear what have VSCode caused to motivate this.

oarsinsync3• 1 year ago

It sounds like they’re operating at larger scales, with a large number of users sharing a resource. Each user spawns 50 processes and consumes 100MB of space if they’re using VSCode. Assuming a low count of 1000 users, that’s 50K running processes and 100GB of space consumed. To enable a text editor.

bkallus5• 1 year ago

SSH is a fundamental protocol. If students can get through our program without learning what SSH is and how to use it, that's a problem.

bogantech3• 1 year ago

Disable TCP forwarding in SSHD

_zoltan_• 1 year ago

who are you to decide what the students can learn or not learn?

joshstrange2• 1 year ago

The provider of the servers? If the students want to use their own server, I’m sure they’re free to do whatever they want. Also VS code has plug-ins that just SFTP the files up.

saghm3• 1 year ago

This isn't something specific to VSCode being popular. When I was in college over a decade ago, there were students using Sublime with an SFTP plugin, coding locally and copying stuff with FileZilla or other similar GUI clients to transfer files (I distinctly remember seeing some program that was named something duck-related but for the life of me I can't remember any other specifics). Sublime in particular could be frustrating in the class I TA'd where they had some assignments to deal with processing some (very basic) machine code to simulate running the tool the class used to assemble and run the code from the (similarly basic) ISA they had been taught, which involved them using hexdump or something similar to understand how the bytes in the files worked, but Sublime "helpfully" would render the object files as as their text representation of the hexdump, with extra spacing for readability and swapped endianness compared to the way the bytes would show up if hexdumped on the school's Linux server. There would always be several students every semester who would show up at office hours unable to figure out why their code that was written to try to read an ASCII string like "AD DE EF BE " but instead would instead find some text they didn't recognize because they didn't think to look at the actual byte values, which would always just happen to start with 0xDE, 0xAD, 0xBE, and 0xEF.

benwaffle• 1 year ago

I distinctly remember seeing some program that was named something duck-related but for the life of me I can't remember any other specifics

cyberduck - https://cyberduck.io/

joshstrange2• 1 year ago

The issue is not about live editing on servers, it’s about running a process out on the server that spawns,according to GP, 50-some processes. VS Code remote editing and Sublime/any SFTP/SCP-style deploy are on completely different levels.

andai• 1 year ago

50 Node processes

Every day we stray further from God.

formerly_proven2• 1 year ago

SELinux exists for precisely these scenarios, use it.

whalesalad2• 1 year ago

[flagged]

bkallus5• 1 year ago

Learning to use a real SSH client is part of the curriculum. If they graduate without this knowledge, we have failed as teachers.

dang• 1 year ago

Could you please stop posting in the flamewar style to HN? There was no need to cross into personal attack here.

https://news.ycombinator.com/newsguidelines.html

sn9• 1 year ago

For those like me who were wondering what "murid" was referring to and had never heard of RAT, it stands for Remote Access Trojan.

fastasucan• 1 year ago

This was a major annoyance, so you descided to become an even bigger one?

collinmanderson• 1 year ago

1., I set a motd on our class servers asking the students not to use the VSCode remote server plugin. ...When students inevitably ignored the motd...

VSCode doesn't show the motd :/

pritambaral• 1 year ago

TFA is light on details, but I have a few choice anecdotes about negative consequences of this:

----

I work on a large C++ codebase that takes quite a lot of CPU and RAM to build. To ease development access, we set-up a beefy VM in the cloud, put LXD in that, and gave every developer an LXD container of their own. Access via SSH was simple: ProxyJump via the LXD host (VM) into you container.

Now, I don't use VSCode, I use Emacs, and my container was setup by me to do everything The Right Way™. Devtools like clangd and clang-format were installed via the OS package manager. Everything Just Worked™. The VSCode users on this team had their own containers, so however their setup was didn't affect me.

Until one of them connected their VSCode to my container. My dev setup broke because their VSC decided to download a Microsoft-built binary of clangd and install it onto the PATH in my container. I was horrified, but the coworker who had (inadvertently) done this didn't see the problem. Their VSC worked just fine. I had to write-off that container of mine and create a new one.

Today, we mandate use of the LLVM-provided clangd extension in VSCode in the team, which does not automatically download anything from the internet. But this habit of "helpfully" auto-downloading LSP servers is apparently still common among VSC extensions. To the point that the Emacs lsp-mode package also offers to do that. Thankfully, it's Emacs, so it's pretty easy to disable that behaviour.

----

As we SSH into machines quite a lot, we strongly discourage per-container SSH keys and strongly encourage SSH Agent Forwarding instead (with per-use confirmation). VS Code found a way to break that too. But we couldn't wait for the VSCode overlords to fix it — we were affected already, and urgently needed a fix — so we looked into what could be happening.

Turns out, VSC hijacks the way your shell loads, all so it can inject arbitrary stuff into the embedded terminal. You think you know how and when bash loads ~/.bash_profile and ~/.bashrc and so on. None of that matters because VSC uses its own homebrew init script for bash. A script that tries to, emulate how bash loads, though not entirely accurately.

If you're building a terminal emulator and you want shell integration, the correct way to do it is to ask your users to load your terminal's support code into their shells. The VSCode way is to never tell the user anything and just silently take over their shell for them.

----

Now, I no longer even try to support VSCode on the team. VSCode users are on their own. I help them setup Vim, NeoVim, Emacs, or even IntelliJ. If they have to have VSC, I might look into Eclipse Theia. But, as far as VSC is concerned, I expect nothing less than this malware-style behaviour and thus refuse to waste my time on it.

causal4• 1 year ago

And I'm guessing none of that was documented. This is the other half of the problem - I can't even know what it's doing without a bunch of reverse engineering

ei625• 1 year ago

It's open source and even has long design documents, better to improve it instead of just complaining about. If your opinion is valid, some others will rewrite to fix it.

eru7• 1 year ago

Complaining is fine, you don't need to read the blog.

I agree that parts of it are open source.

roywiggins5• 1 year ago

The "Remote" bits, and VS Code Server, aren't open source though.

causal4• 1 year ago

This is my biggest issue with it. Security concerns aside, it's difficult to even debug when issues arise because of how opaque it is.

mediumsmart2• 1 year ago

VSCode is a perfect fit for most of the projects it is used for on an internet gone bananas.

dsp_person• 1 year ago

A simple solution is to use bubblewrap locally. Only bind mount specific directories into it and a copy of your vscode config (which you could merge any changes back if you need). Then you can install random extensions and let the AI wreak havoc generally without it leaking to your main system. On arch linux bwrap'ing vscode also seems to work without zypak.

0xbadcafebee3• 1 year ago

What did we learn? That remote code execution is a thing? That misplaced trust in [dev] tools is often regretted? That modern software design is ass? If you've been paying attention, all of that has been obvious.

SSH is a solution from the 90s. It's Telnet with a couple extra features bolted on, and despite being called the "secure" shell, is literally less secure than Telnet+TLS would be. There's so much stupid-yet-glorified bullshit implemented over SSH, because lazy assholes had a tunnel into a server with a user session, and decided "why implement a whole extra protocol for network transport and secure connections for my application? I already have an authenticated user session, in this very specific protocol, computing design, and network architecture. who care if nobody else on the planet but computer nerds have used something like this since 2000? works for me!" Discard the concepts learned from distributed OSes, ignore all the advanced AuthN+Z that had been developed, embrace the shittiest, easiest thing you can.

These "SSH agents" aren't bananas. We refused to get off our stupid lazy asses to build the right tool for the job. So we had to keep shoving more shit into pre-existing tools that were never designed for what we decided to do with it. We have no right to pretend we're surprised.

This is the world we have made. All of you, and me too. Either with your labor or your silent compliance. If it's not SSH, it's politics, commerce, school, and everything else. We live every day in the shit-pile we carved for ourselves, and every day that we don't do something about it, we throw another shovel on the pile. You don't get to sit there shoveling shit and pretend this is a fucking surprise, or crazy. You're holding a shovel.

h4ck_th3_pl4n3t3• 1 year ago

Man, I'm getting hard tinfoil conspiracy vibes from this one. Not everything in life is done with malicious intent. Most of the time it's humans trying to do the best they can come up with under pressure.

Maybe go touch some grass once in a while, it's healthy for the soul.

Also, please make a suggestion on how to build a better SSH protocol. Complaints are kind of useless without constructive criticism.

0xbadcafebee3• 1 year ago

1) I never said it was malicious, 2) humans do not try to do their best (have you looked around lately?), 3) complaints are entirely useful regardless of constructive criticism, they are literally user feedback

regularfry6• 1 year ago

The suggestion was telnet+TLS, right? I'd not come across it before but it's apparently a thing: https://www.ibm.com/docs/en/i/7.5?topic=tls-configuration-de...

zrm2• 1 year ago

It's not the developers who did this, it's the "network security" people. If you block all outgoing ports except for HTTPS and ssh, everything is henceforth going to be tunneled over HTTPS or ssh.

This is also the reason why, if you allow outgoing HTTPS connections, you should as a general rule be allowing all outgoing connections except for SMTP. Because actually malicious traffic is just going to be tunneled over HTTPS anyway and all you're doing is inhibiting the deployment of any new protocols that don't take on the complexity and inefficiency of the tunnel.

encom• 1 year ago

And this is how we end up with clown-maxing abominations like DNS-over-HTTPS.

0xbadcafebee3• 1 year ago

Every place I've ever worked that blocked ports, blocked SSH, it's no exception.

blueflow2• 1 year ago

To the contrary, i find the ssh keypair authentication (and certificates) the best kind of authentication i know. And it integrates with FIDO2 without prior set up.

I wish web logins would be more like what SSH does.

RainyDayTmrw• 1 year ago

Most remote access software has the same patterns as malware, no? It's only a matter of who's driving?

A related anecdote: I watched, in person, a user call into their workplace's offshore IT support, who had honestly no idea what they were doing, and kept poking around aimlessly in a remote desktop session. I remarked that, having watched tech support scam baiting videos, the interactions were honestly indistinguishable, and hopefully the user had dialed the correct number. The user was not amused.

partloyaldemon• 1 year ago

what is the type of application that was hinted as being murid? I couldn't crack that one.

Dibby053• 1 year ago

I think it's RAT (remote access tool)

dig1• 1 year ago

because everybody is using VSCode now

Maybe I'm living under the rock, but I know only 2-3 people that are using VSCode

nsteel2• 1 year ago

It's extremely popular: https://survey.stackoverflow.co/2024/technology#1-integrated...

But anecdotally, nobody in my office uses it.

rs_rs_rs_rs_rs4• 1 year ago

I'll take VSCode "insecure" ssh agent over Emacs Tramp any day of the week because it actually works.

Sometimes you just gotta be pragmatic and use the stuff that works and makes your life easy.

self_awareness• 1 year ago

VSCode remote editing trojan is the only remote editing mechanism that actually works.

Tramp might be good in imagination, but in reality it's just a poor plugin that sometimes works, and even if it works, it's only good for some use cases.

agumonkey• 1 year ago

is murid short for remote access greek horse ?

LoganDark• 1 year ago

I wish the SSH agent weren't so stupid. It spawns so many processes just by existing that it kills a bunch of other stuff on the server. I can only use it on machines without ulimit.

bravura2• 1 year ago

"[LLM-generated code] is ultra-useful if you can close the loop between the LLM and the execution environment (with an “Agent” setup). There’s lots to say about this, but for the moment: it’s a semi-effective antidote to hallucination: the LLM generates the code, the agent scaffolding runs the code, the code generates errors, the agent feeds it back to the LLM, the process iterates."

Okay, so who's doing this today and how?

This question came up recently in the Aider discord and not many had a good answer.

Aider is great but the SDK is weak and second-class, so interacting with the repl frustrates agent-dev.

Sidecar (which can run independently of Aide IDE, not to be confused with Aider), https://github.com/codestoryai/sidecar/ is one agent that was mentioned. Many of that projects issues are auto-responded to by a PR-creating agent.

Anything else I'm missing?

In general, I know how I would build an agentic dev-loop, I'm just looking for a good SDK that handles prompting and diff merging etc. i.e. Aider as an SDK or similar.

skp19952• 1 year ago

Hey I am the coredev on sidecar. The reason you see autogenerated PRs is cause I am using our agents to write the code for the agent lol

The big difference is the complete loop, each PR gets its own VM with the tool chains installed so the agent can run cargo check or cargo tests etc.

We do find the LLMs of today are not the best elite engineers but very very competent junior engineers. It's been a weird but eye opening workflow to use.

bravura2• 1 year ago

I am super interested in sidecar. When will it support o3-mini-high?

I also need an SDK to script it, tbh. What I want is to have actually a few different agents that interact with each other. Do you expose a good SDK?

sklivvz1971• 1 year ago

I am very confused by this post:

1. VSCode uses SSH (with its security profile) and the user can't do anything more with VSCode that they can already do with SSH. If the comparison is between a system without SSH and a system with VSCode and SSH--sure--I understand the concern, but it's an issue with enabling SSH and not VSCode.

2. VSCode can change files and persist? Well, it's a local editor, so yeah, it can change files and persist, that's literally its purpose. If that's an issue, disable editing permissions for the user.

n144q7• 1 year ago

You are not the one who's confused. The author of the article is.

roywiggins5• 1 year ago

The server running at the remote end can execute code on the client. If an SSH server can do that it's a security issue and a bug.

The README does warn about this: "A compromised remote could use the VS Code Remote connection to execute code on your local machine."

https://marketplace.visualstudio.com/items?itemName=ms-vscod...

kreyenborgi2• 1 year ago

Normally on connecting to a remote machine you expect to be able to control that machine, you don't expect that machine to gain control over yours.

PeterStuer2• 1 year ago

"The underlying protocol on that connection can:

Wander around the filesystem Edit arbitrary files Launch its own shell PTY processes Persist itself"

Given that this was the solution, what was the goal?

juliangmp• 1 year ago

”hallucination” is what we call it when LLMs get code wrong; “engineering” is what we call it when people do.

I should print this out, frame it and hang it on the office walls omg

Neywiny2• 1 year ago

It's a bit offensive, tbh. Hallucination is because LLMs can't think and don't operate on facts. To even suggest engineering is that haphazard shows a clear lack of understanding of engineering. I've had LLMs hallucinate entire libraries existing with examples of how to use them. Others have had worse. If a person did that, they're no engineer.

IshKebab6• 1 year ago

That's not exactly true either. Hallucinations are because LLMs aren't trained to be truthful, they're trained to be plausible, which usually coincides with the truth.

Humans have better training, but I've worked with someone who had LLM levels of bullshitting. Straight up made shit up and it worked. I'm still not quite sure why but everyone else was either too polite or oblivious to call him out (apparently that's not an unusual response to proper bullshitters).

Fortunately those people are pretty rare, but it's really a question of degree. The latest LLMs bullshit far less than they used to. Less than that guy I worked with.

hvenev• 1 year ago

For local communication Microsoft Visual Studio Code often uses TCP sockets (bound to localhost) even though UNIX sockets are available. What's more, old versions used to pass the authentication token as a command-line argument, exposing it to all users on the system.

I wonder how many other security disasters it contains that nobody has discovered yet.

kdmtctl• 1 year ago

The first time I've actually checked what kind of bloat VSCode brings to a server, I stopped used it this way. No deep inspection, just in sake of Occam.

Long forgotten mutagen works much cleaner, although requires a bit of a setup.

Retr0id• 1 year ago

The silver lining of all this is that your local vscode instance becomes more of a thin client, with the heavy lifting being done by the remote instance. It's perfect for the "small laptop ssh'd into beefy workstation" use-case, but less so for the "beefy workstation ssh'd into tiny VM/VPS".

If you're doing the latter, I'd recommend using sshfs or some other remote-fs-mount setup, and opening the mounted directory in vscode normally.

faebi• 1 year ago

It's very much the reason vscode is successfull in my opinion. They differences between local and remote development start to disappear. This is especially useful in corporate environments, but not exclusively so. At the same time vscode keeps the input latency as low as reasonably possible. It's not the best in the world, but the most integrated. And the cherry on top is the out of the box connection loss handling. Just reconnect some when later exactly where you left it.

yapyap• 1 year ago

rolled my eyes at the sidenote “”hallucination” is what we call it when LLMs get code wrong; “engineering” is what we call it when people do.”

gtfo

greenchair• 1 year ago

that was the best line!

jFriedensreich• 1 year ago

I found this out the hard way as some servers had a high cpu load and a weird agent that i did not install. After having a heart attack and assuming an intruder i discovered vscode had injected some agent that was stuck walking the servers filesystem and consumed 100% cpu on one core. On the one hand i love how having a server open in vscode feels especially as things like the docker extension work pretty well but on the other hand i really wonder if it requires these nightmarish sacrifices.

wink• 1 year ago

I don't remember, but if it can do ESC-. (which IntelliJ's can't and which I try to use multiple times per week, I'm not learning) it's less bananas than that one, for me.

blakehawkins• 1 year ago

https://github.com/devspace-sh/devspace

Devspace works the same way

dmd• 1 year ago

Unlike Tramp, which lives off the land on the remote connection, VSCode mounts a full-scale invasion

I would argue that "lives off the land" is a poor analogy, and is much more like what VSCode does.

Tramp specifically does not live off the land. It has a supply line back to home base; all its resources come from home.

lupusreal• 1 year ago

Tramp goes into the woods with nothing. Finds a rock and throws it at a rabbit. Finds some sticks and rubs them together to make a fire and cook the rabbit.

VSCode doesn't look around for rabbits, sticks, or rocks. It brings an RV with a fully stocked pantry and kitchen.

pjmlp• 1 year ago

As someone that always favoured X Windows, and mastered enough vi when (X)Emacs wasn't available on the development server/production system, never bothered with tramp.

Likewise with VSCode, now 30 years later, one of the few plus of it being Electron based, and having started its life as browser based app, is that the browser has replaced my X Windows session.

So don't really care how much bananas the SSH agent happens to be.

cedws2• 1 year ago

This is a perfect use case for unveil(): you have a program that wants to operate on a specific directory (your repo), and never outside of it.

sph• 1 year ago

Dev tools are written with people running macOS. They already have trouble following XDG instead of polluting one's home directory, imagine asking them to use unveil.

Also AFAIK unveil is an OpenBSD thing. Does VSCode even do BSDs? chroot is POSIX and none of the junior devs employed by Microsoft are aware of it.

cedws2• 1 year ago

Of course, I meant this is an argument for other operating systems to implement a similar syscall. Maybe NT/Darwin have something similar that I'm not aware of.

opliko• 1 year ago

The more I learn about how VSCode works the more it seems like it's held together with duct tape and the most cursed ideas a JS developer could come up with.

Even just from the SSH extension - the workspace URIs have two formats: essentially just the hostname and hex-encoded JSON documents. The latter case happens when additional info is needed, e.g. specific username, or... The hostname includes an uppercase letter.

Which is actually necessary because when they're saved to recent workspaces they're lowercased for whatever reason.

The SSH connections also support configuring extensions that are to be installed on the server, but don't go too crazy with it or you won't be able to connect to Windows hosts, since they're passing them ass command line arguments via CMD, which has a 8191 character limit (they're using CMD to call... PowerShell...).

fujinghg• 1 year ago

It’s shit and string. Gone back to vim.

bayindirh5• 1 year ago

Give Eclipse a go?

Vaslo• 1 year ago

Almost no one using VS Code can use vim.

giantg22• 1 year ago

I don't know, I found VS Code to be nicer than Eclipse. I've never had a need for SSH through an IDE, so I can't speak to that. Usually I'd just SSH through putty and use Vi if I need to do stuff on the server.

nickstinemates• 1 year ago

This is for remote dev, where the code you're editing exists on a remote environment vs. Local to your disk.

dataviz1000• 1 year ago

The more I learn about how VSCode works ...... duct tape

The most unfortunate few lines. [0]

I wish Microsoft would hire me for a couple months to do nothing but sit in a corner by myself untangling this mess.

[0] https://github.com/microsoft/vscode/blob/6dbde2a3ed308f88164...

catlifeonmars• 1 year ago

I like it because it’s really easy to extend the editor with custom language support/tooling if you know JavaScript/Typescript. Providing custom completions, diagnostics, etcetera. I can also provide custom Go to definitions for cross-language support.

bitlad• 1 year ago

Security has two aspects:

Objective security - things like do not open mongodb server with default passwords to internet etc. which are definitely bad.

Subjective security - blogs and consultants saying something is bad and do not have objectivity to back it. It may not be a bad things, ugly sure, but it would need lot of context.

It could be bananas, ugly etc. but may not bit a big deal. Sure things, go wrong white remote editing. Did I bring a server down, you could do the same while VI thinking it UAT but it turns out to prod or rm a mount.

Are millions of orgs doing this day-in day-out? yep.

bloopernova4• 1 year ago

I'm DevOps and don't pretend to understand good code layout in large projects, but why would you keep a "printTime" function in remote extension management code?

https://github.com/microsoft/vscode/blob/c9e7e1b72f80b12ffc0...

(Genuine question, I'm puzzled!)

righthand3• 1 year ago

You don’t know/care and the reviewer doesn’t care. The code was probably written by an llm helping enforce the not-caring.

bloopernova4• 1 year ago

Are you OK? I just asked a question, which implies that I cared enough to at least ask.

MarkSweep• 1 year ago

Did you try searching in the file to see where the function is called? It’s used in some log messages.

bloopernova4• 1 year ago

I'm not really asking about its function, more its location. I figured stuff like that belonged in /lib/ utility code so it could be reused consistently across the codebase.

Basically I'm not a great programmer so when I see stuff that I am unsure of, I ask so I can learn.

wiradikusuma• 1 year ago

Maybe it's because I'm an old dog, but I was a long-time user of Eclipse before settling on IntelliJ, and I don't understand what's the fuss about VSCode.

Compared to IntelliJ, VSCode feels "messy" (I don't know how to describe it).

I'm trying to convert myself, though, because I need to work on a less powerful machine (from MacBook Pro to MacBook Air). Any tip from successful IntelliJ -> VSCode convert?

noodletheworld• 1 year ago

Well, I’m not going to go into the arguments about using or not; but if you are serious about the switch put something like key promoter on to learn the new shortcuts.

Most of the inertia that stops people changing is just muscle memory. Once you fix that, it’s fine.

Also, if you write plugins, check out the plugin guide. Maintaining IntelliJ plugins has driven me away; once you start writing vscode plugins you’ll find it a good reason to stay.

knallfrosch4• 1 year ago

I switched from VSC to IntelliJ. I installed plugins to make the keyboard shortcuts and the colour scheme match.

Other than that, you'll just have to accept that any first-party support from IntelliJ will require 1–3 plugins. 3 for Java, Docker, 3 plugins for React, npm, Prettier, SonarLint, Copilot, database, Gitlens, Maven — don't be surprised if a single project becomes usable only after 20+ plugins.

mdaniel4• 1 year ago

from IntelliJ will require 1–3 plugins. 3 for Java, Docker, 3 plugins for React, npm, Prettier, SonarLint, Copilot, database, Gitlens, Maven

How old is your copy of IJ that you need to download the Maven plugin? To the very best of my knowledge, every one of these in the "plugins" directory ships with IJ and is not something one needs to download from the JetBrains marketplace: https://github.com/JetBrains/intellij-community/tree/idea/25...

I obviously can't link to the GitHub repo for IJ Ultimate but the DataGrip behavior is similarly bundled. What may be up for hair-splitting is that think they do use the concept of plugins as an update mechanism. That is: I don't think one could download a copy of IJ Ultimate that doesn't speak Java, Docker, npm, database, or Maven. But they do use plugins such that one could acquire a bug-fix to (e.g.) the Docker plugin without having to re-download the whole IJ

mixmastamyk6• 1 year ago

A newish Air is relatively powerful, should be able to run an IDE. As always make sure you have at least 16GB RAM minimum.

api• 1 year ago

I’ve been using Zed for some time and like it a lot. Much faster and lighter than VSCode and works great for Rust and C/C++. Haven’t tried it with JS or other languages yet. Took a little customization to get it how I want it, but not hard.

I might buy Zed’s cloud stuff just to support them even though I don’t need it.

neilsimp1• 1 year ago

because everybody is using VSCode now

Are they though? I don't have numbers right now to back this up but last I remember, people were leaving VS Code, not moving to it.

nsteel2• 1 year ago

I'm sure there's some bias here but the best numbers currently available show it's still staggering https://survey.stackoverflow.co/2024/technology/#1-integrate...

You're going to have to provide a source of you want to claim otherwise.

notpushkin• 1 year ago

they’ll iterate on your system configuration just as happily on the Git project you happen to be working in

Ehhh... no they won’t? Unless you give them access, of course.

fsh• 1 year ago

The VSCode agent is so bloated that it tends to OOM raspberrypi pies. Truly remarkable for a piece of software whose job it is to forward some text.

IshKebab6• 1 year ago

It's extensions that do that. VSCode with no extensions is very light.

__jonas• 1 year ago

Truly remarkable for a piece of software whose job it is to forward some text

That is not its job. It's job is to run a whole IDE on a remote host, turning the local host into a thin client. This includes language servers, extensions etc. all being shifted to run on the remote machine – if you want to forward some text, there are significantly lighter options.

alexwasserman• 1 year ago

murid, noun, Any member of the Muroidea superfamily of rodents.

RAT, a remote access tool/trojan.

woahperson2• 1 year ago

Works great for me, idk what you all are doing wrong

woahperson2• 1 year ago

This functionality has worked great for me as a web developer working on huge websites. I have not experienced any issues

openplatypus• 1 year ago

If any of you are recommending sshfs or a like you really don't understand the benefits of full VS Code SSH Remote environment.

You can effectively run whole development (LSP, docker, compiler, files) on remote like it is on your local machine.

You can turn any underpowered legacy machine or a thin client to a full featured workstation.

There is tons of horrible plugins that scream security threat in VS Code market place. The SSH Remote or VS Tunnel ain't one of them.

krobelus2• 1 year ago

You can effectively run whole development (LSP, docker, compiler, files) on remote like it is on your local machine.

the same is possible with any other editor that implements a client/server model, and it can be done without giving the server the ability to execute code on the client

blueflow2• 1 year ago

You can effectively run whole development (LSP, docker, compiler, files) on remote like it is on your local machine.

This has always been possible with ssh+tmux. And before tmux was popular, people used gnu screen.

averageRoyalty3• 1 year ago

If any of you are recommending sshfs or a like you really don't understand the benefits of full VS Code SSH Remote environment.

Or we don't need them. Most peoples workflow is send file to remote, trigger remote. There are definitely other cases that this plugin may be more suitable for, but the trade offs for most people (which I suspect the majority of developers don't understand) are not very good.

advael• 1 year ago

My days of not trusting a single thing microsoft controls are certainly coming to a middle

koakuma-chan• 1 year ago

because everybody is using VSCode now, and, in particular, they’re using forks of VSCode that generate code with LLMs

:crylaugh: :crylaugh: :crylaugh:

nyoomboom• 1 year ago

Thank you for this - it dissolved an assumption I had about vscode ssh - that it was similar to Tramp

VSCode’s SSH agent is bananas

Related Stories