Material Theme has been pulled from VS Code's marketplace

https://github.com/material-theme/vsc-material-theme/discussions/1313

by Inityx • 1 year ago

479 372 1 year ago

Another creator gone off the deep end apparently?

reading the review responses by the creator, I don't really trust it anymore. Being rude to others who are concerned over the recent move to closed-source (and without warning!) is pretty disheartening.
So, uh, the guy who made the VS Code Material Theme is threatening everyone who uses it in their products. He seems to have forgotten it was originally licensed under the Apache License, 2.0.. He wiped the commit history to make it look like it was always his weird fake license.

Real messy. It’s always shocking to me how little people realize - or care - how their behavior - especially their treatment of others reflects on them.

ryandrake• 1 year ago

So many people who are otherwise functional in society, for whatever reason just can't play well with others when it comes to online communication. This can be true for both software maintainers and users. People can't just leave their emotions at the door and file a bug report or respond to a help request, without including a little personal jab or passive aggressive snipe. Looking at some of those replies to users, it looks like this guy just couldn't keep himself from including those unnecessary little put downs.

tuesdaynight• 1 year ago

People say that the most part of communication is nonverbal. If that's true, written communication would be heavily impaired by the lacking of all the visual cues that we use to interpret someone's words. I tend to agree with them, but that's just my personal experience.

JTyQZSnP3cQGa8B• 1 year ago

It’s off topic but I don’t believe most people are functional in society. I think they are hiding their shitty behavior to themselves and to others, and their true self comes out once in a while.

They hide it mostly to their family, but other human beings are treated like NPCs.

For example I live in the south of France and people are literally crazy on the road but they still avoid accidents by some kind of miracle. These are people from all sex, color, and age. The good middle-aged white father becomes a fucking moron when his car is turned on. The young new mom who pretends to love her children is speeding on the road like an idiot.

Society accepts that or turns its head the other way not to look at it, but it’s definitely around us and I see it every time I go to work.

aleph_minus_one• 1 year ago

People can't just leave their emotions at the door and file a bug report or respond to a help request, without including a little personal jab or passive aggressive snipe. Looking at some of those replies to users, it looks like this guy just couldn't keep himself from including those unnecessary little put downs.

My consideration on this is:

A lot of software that at least I write privately is rather a manifestation of some deeper values/opinions that I have. So in some sense the software is just the tip of an iceberg, a manifestation of something deeper. The software might isolatedly be independently useful for other people, but this is not is essence. Its essence is the deeper values/opinions that made the software to be created.

In this sense, it is rather the rational thing to expect that most discussions of the software are strongly intertwined with the values/opinions of the programmer, because these form the bottom of the iceberg of the software.

P.S. Just to be clear: I am not the kind of person who does personal jabs or passive aggressive snipes.

david4222• 1 year ago

So many people who are otherwise functional in society, for whatever reason just can't play well with others when it comes to online communication.

So I run a small game that has a couple thousand active users, and part of that is allowing users to chat via written text. The amount of vitriol some users spew just amazes me. If they acted like that in person, I expect they would get punched in the mouth quite often. I also have a suspicion that some of these people are literally mentally ill, and online is basically where they live.

badrequest• 1 year ago

It seems utterly absurd to me that anybody should be able to issue a copyright claim on a collection of colors and fonts. Copyrights are issued to logos and slogans, not design systems.

lelandfe• 1 year ago

If you think that sucks, check out T Mobile trademarking magenta https://www.npr.org/2019/11/25/782723429/t-mobiles-parent-te...

spudlyo• 1 year ago

It seems utterly absurd to me we litigate the ownership of ideas or their expressions, but here we are.

The founder of Bikram Yoga, tried to copyright a sequence of yoga poses, even though similar sequences have existed for for thousands of years. Monster, the energy drink maker, went after business for using the word "monster" in totally unrelated contexts. Disney trademarked "Hakuna Matata" (a Swahili phrase roughly equivalent to "no worries") after using it in The Lion King, prohibiting African businesses from using a common idiom in their own damn language. Don't get me started on Happy Fucking Birthday.

umanwizard• 1 year ago

No, trademarks are issued to logos and slogans.

xeonmc2• 1 year ago

The old commit history can still be accessed here:

https://github.com/material-theme/vsc-material-theme/activit...

joshka12• 1 year ago

This doesn't capture all of it though. There's also a bunch more that you can access by looking at commits in the Pull Requests.

tag2103• 1 year ago

Question bouncing around in my mind reading this, especially with money involved, is why did this not cross the line into criminal fraud?

joshka12• 1 year ago

Because noone has stated an injury and made a complaint about it. It's likely that there's some copyright infringement going on with the current state of the repo (due to lack of the author's adherence to the requirements of the license). That could be subject to a DMCA notice if any of the previous contributors decided to make one.

gosub100• 1 year ago

Conspiracy would be more appropriate, no? Thing is, when you conspire to attack a corporation, you have FBI agents bending over backwards for you and your precious profits. When you conspire to attack a bunch or normal people, you're lucky if anyone does anything at all.

gedy• 1 year ago

While I appreciate he put in a lot of work (thank you for the theme) - Material Design is someone else's work as well..

nonethewiser• 1 year ago

He also seemed to put a lot of work into the license he wrote and updated many times.

compootr• 1 year ago

Reading the commentary, this guy seems unhinged. He thinks he owns literal hex codes

he sucks at tech and has driven away everyone good at it. I don't use his software, but I hope he gets out of this episode soon (and learns he didn't invent material!)

ukuina• 1 year ago

He thinks he owns literal hex codes

Pantone would like a word.

donatj• 1 year ago

Pantone is a lot more than hex codes, it's a whole system of material science for colors.

Telemakhos• 1 year ago

Someone else described him as a lunatic. But, this is a security issue, and you shouldn't assume that someone who is successfully putting malicious code into developers' IDEs around the world is unhinged or a lunatic, but rather cunning and deceptive (or a front for an intelligence agency). It's not paranoid to have such suspicions about someone who is getting malicious code into developers' tools.

Bjartr• 1 year ago

unhinged or a lunatic, but rather cunning and deceptive

These aren't mutually exclusive.

firesteelrain• 1 year ago

So weird that this person took contributions from others then made it closed source. It doesn’t seem right, but not a copyright expert.

schneems• 1 year ago

Speaking generally:

It’s assumed that your contribution will be licensed with the current license (generally). Maintainers can change the license but that wouldn’t affect prior contributions. Basically anything up to that license change would still have the original license. This is what makes forks possible when popular software changes their license.

In order to go back in history and change a license, you need either the consent of your contributors or a document that would grant you the power to do that. A CLA could (but not all CLAs will) grant a maintainer to change a license at will back in time.

Other famous software that has seen a license change: Redis and Terraform. In those cases the license changed but already released software is still available with the old license and that old license allows for forks.

alwayslikethis• 1 year ago

My understanding is that permissive licenses (BSD,MIT) can generally be relicensed. For example you can fork a MIT project under GPL. But to do the same for a GPL project requires agreeement from all copyright owners, or just you if you made everyone sign a CLA. This is the whole point of GPL.

KennyBlanken• 1 year ago

Was Material even his work in the first place?

mook• 1 year ago

Looks like it was, or at least the initial commit was. This was back in 2017.

https://github.com/material-theme/vsc-material-theme/commits...

I'm not sure why the initial commit already says "official", but that's almost a decade ago.

rldjbpin• 1 year ago

just like many open-source projects (primarily maintained by a company) turning their projects non-commercial, a la redhat, terraform

Starlevel004• 1 year ago

What is it about material themes that does this to people? The same kind of thing happened to the IntelliJ one half a decade back.

At least that one wasn't literally just colours.

re-thc• 1 year ago

Just whatever that's popular and has a chance of monetization.

sitkack• 1 year ago

So the possibility of grabbing the golden ring.

do_not_redeem• 1 year ago

Someone uploaded a replacement, Material Theme (But I Won't Sue You)

https://marketplace.visualstudio.com/items?itemName=t3dotgg....

oefrha3• 1 year ago

The original author seemed to talk a lot about funding development/maintenance, so I got curious about what the hell needs to be maintained. I cloned the https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you repo and had a look. Here's a LoC summary:

  ===============================================================================
   Language            Files        Lines         Code     Comments       Blanks
  ===============================================================================
   CSS                     2          142          119            0           23
   TypeScript             32         2026         1650          243          133
  -------------------------------------------------------------------------------
   HTML                    2           59           49            1            9
   |- JavaScript           2            2            2            0            0
   (Total)                             61           51            1            9
  ===============================================================================
   Total                  36         2227         1818          244          165
  ===============================================================================

Among those, 622 lines of TS are hex color definitions for variants in scripts/generator/settings/specific. Most of the rest seems pretty boilerplatey, e.g. look at the 599 lines in scripts/generator/color-set.ts.

So the question remains: what the hell is there to maintain (that takes more than a couple minutes every $godknowshowlong)? I've published and maintained waaaaay more substantial open source projects for years without expectation of any financial contribution.

bad_user3• 1 year ago

There's nothing wrong with building proprietary software of a couple of thousand lines of code, including themes. And people should be able to ask for money in exchange for their work.

What's wrong is the bait and switch, as these projects end up being popular because of their FOSS nature.

gamedever• 1 year ago

it's a problem. As soon as it became easy to ask for money via Patreon or githib sponsorship, etc... tons of people are going to try to get some for minimal effort. It's just the nature of the beast.

theobr5• 1 year ago

hi, maintainer of the fork here

just did a pass and removed everything that was not necessary - it's even less code now lmao

    -------------------------------------------------------------------------------
    Language                     files          blank        comment           code
    -------------------------------------------------------------------------------
    TypeScript                      23             50            169           1307
    Markdown                         6            129              0            224
    YAML                             2              8              6             52
    INI                              1              1              0              7
    -------------------------------------------------------------------------------

    SUM:                            32            188            175           1590
    -------------------------------------------------------------------------------

yellow_lead• 1 year ago

Looks like the creator of the replacement is the tech YouTuber theo (https://m.youtube.com/@t3dotgg)

jmkni• 1 year ago

Just made that connection, I've been watching a lot of his content recently, it's excellent

theobr5• 1 year ago

Oh hey, that's me! Not surprised this guy went kind of insane tbh

bravetraveler2• 1 year ago

The day {n,}vim take away my color schemes, I die. Convenience until it isn't, eh?

iLemming3• 1 year ago

Yeah well, MSFT - the behemoth among evilish corporations, invests vast sums into developing a sophisticated tool with extensive features - more than their combined philanthropic initiatives - and offers it freely to just about anyone. This generosity doesn't seem questionable at all, eh?

I mean, when I use Vim and Emacs, the benefits clearly flow to users and the developer community. Back when I paid for the IntelliJ license - I knew exactly how their revenue model worked. Yet whenever I download and use VSCode, I don't really know what's Microsoft's grand plan here, does anyone else do?

bravetraveler2• 1 year ago

Microsoft <3 Open Source /s

not_a_bot_4sho• 1 year ago

Community goodwill is valuable. It's what gets someone to start to think, "this is pretty good, maybe I should try that Azure thing..."

Same reason Xcode is free.

koakuma-chan4• 1 year ago

Nobody is gonna pay for a VSCode theme.

vorpalhex• 1 year ago

I'd pay off the cuff money ($5) if it wasn't paywalled. "Donationware" if you will. I do this with other apps/resources/things including a nice pixel font I like using in images.

I suck at colors and want nice themes. I'm glad people better at this than me take time to make nice things.

But, I don't want to ever manage licenses for my theme. My dotfiles need to fetch it automatically or it's out.

weinzierl2• 1 year ago

People pay for mere color schemes. https://draculatheme.com/

koakuma-chan4• 1 year ago

he's even selling a book lmao

dr_kiszonka• 1 year ago

Over $390k in sales! https://draculatheme.com/open

NetOpWibby3• 1 year ago

I paid for Dracula back when I could stare at dark mode for hours. Now I use Monokai Pro Light (paid for this too).

Free themes are a dime a dozen.

Paid themes means someone's incentivized to keep working on it and adding icons, &c.

dawnerd• 1 year ago

That seems like a special case since you’re buying into a consistent theme across different apps. If it was just vscode that would be a tough sell.

monokai_nl• 1 year ago

That's untrue. I've created https://monokai.pro, to my knowledge the first commercial theme. It's been going strong for years now.

People are willing to pay for nice things. Especially if it takes longer to create it yourself.

A theme is more than a list of colors. Monokai Pro contains custom designed icons and color filters too, and some code logic to sync it all up. It needs continued updates, as editors keep evolving with new UX/UI elements.

NetOpWibby3• 1 year ago

Happy Monokai customer here! I want to make themes using my own palette but nothing supports OKLCH and I don't wanna convert to HEX.

ihateolives• 1 year ago

I paid happily for monokai pro vscode since it was a one time payment. However I will not purchase a subscription for jetbrains intellij because per year it'll cost me the same amount as the intellij idea ultimate and that just doesn't seem like a fair price.

ge96• 1 year ago

I love spectrum been using it for maybe 7 years now

oneeyedpigeon3• 1 year ago

People used to pay for ringtones. People pay for all sorts of things that might seem weird to you because people have different tastes.

diggan3• 1 year ago

Heck, iPhone users AFAIK still can't just put their own .wav as a ringtone and need to pay Apple to use songs/sounds as ringtone.

ryukoposting• 1 year ago

I could see the case for paying for a theme that provides its own icons and works across multiple tools and goes out of its way to support tools that I use. If anyone makes skins for Segger Ozone, I've never heard of them.

I'm comfortable working without any syntax highlighting at all. It's not that I go to the effort of turning it off, I just don't really care that it's there. I used to use Sam as my daily editor - got used to plain black text pretty quick. It's all a matter of preference.

joshka12• 1 year ago

If you do a bit of a repo dive, the repo was initially MIT licensed from its initial commit for at least a couple of years before that license was replaced by Apache 2.0, so there's an argument to be made that that license also applies.

sparkie• 1 year ago

The Apache or MIT license would permit you to continue using it for all versions up to the last commit which used that license. Any later commits under a different license would not be Apache licensed and you would need to follow the new terms if using those newer versions. The new license doesn't prevent you from sharing forks of the older version which was Apache/MIT licensed.

joshka12• 1 year ago

Kinda, it's complicated. When someone other than the owner of the repo contributes code, they own the copyright to that code. When the author changes this repo's license like this they're redistributing the external contributor's copyrighted code. The permission to do so is granted by the Apache 2.0 license and is subject to the conditions of it. Without the permission to distribute the contributed code, the author is engaged in a violation of copyright law. Note the Apache terms:

"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.

This covers not just the users, but also the "author" here who exercises the permissions granted below:

2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
(a) You must give any other recipients of the Work or Derivative Works a copy of this License; and

So let's interpret that. Regardless of the whatever intent to re-license the code exists in the mind of the author, in order to distribute the code which was contributed by others, the only legal means to distribute this code must comply with the requirements of the license. Technically they could remove all code contributions which were contributed by others (I've done this in the past, it's a pain to do right), or seek permission from the others to add additional grants that are not included in the Apache license here (I've seen various projects do the post-facto CLA thing for this). But that has not happened here.

So (in my opinion) the github repo of the author is a currently infringing the copyright of all the other contributors. Any one of whom could enforce it or raise a DMCA take down notification on the repo.

So given that we're talking about material that is in breach of copyright, it's likely that being able to enforce a license on that as a consumer is not really a thing which is possible as the conditions on what must be included bind the person distributing the material not the person receiving it.

ahoef• 1 year ago

Discussion has been deleted.

Edit: the whole repo has been put to private.

nguyenkien• 1 year ago

He rename it: https://github.com/Fanny-Theme/fanny-theme-support

Dylan168072• 1 year ago

https://web.archive.org/web/20250226020241/https://github.co...

StrauXX• 1 year ago

The post has been deleted: https://web.archive.org/web/20250226020241/https://github.co...

isidorn8• 1 year ago

Hi - Isidor here from the VS Code team.

A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code.

We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instances that have this extension running. For clarity - the removal had nothing to do about copyright/licenses, only about potential malicious intent.

Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/

As a reminder, the VS Marketplace continuously invests in security. And more about extension runtime trust can be found in this article https://code.visualstudio.com/docs/editor/extension-runtime-...

Thank you!

joshka12• 1 year ago

Can you please clarify whether the fork also suffers from the same security issues (or engage the fork's owner to ensure that it doesn't https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you)

isidorn8• 1 year ago

Thanks for flagging it. Our security researchers will analize it and based on their findings we might remove this one as well.

theobr5• 1 year ago

Hi, owner of the fork here.

I did a thorough combing of the code base when I forked. Just did another audit and still not seeing anything suspicious. Gutting all of the opencollective and changelog code to be 1000% sure.

ande-mnoc• 1 year ago

Will Microsoft consider adding a permission model for extensions?

isidorn8• 1 year ago

This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116

We do not plan to add a permission model in the next 6 months.

_trampeltier• 1 year ago

There will never be some permission model. Like in VBA there is after all this years nothing. VBA would be much less problematic if you could restrict VBA to just one Excel sheet or so

kobalsky• 1 year ago

Security has been overlooked for way too long for me to trust it at this point.

The only sane way to contain the blast radius is to run is to run code-server in a container (or in a VM) and use it through a browser tab.

Luckily, the UI works perfectly, hotkeys and everything. They did an awesome work there.

WhyNotHugo• 1 year ago

The issue to which op links now yields 404. What's up with that?

isidorn8• 1 year ago

I am in European time and I do not know what happened on that post (since I was sleeping). I assume it were some heated arguments between maintainer and community about license/copyrights/open source maintenance.

joshka12• 1 year ago

https://web.archive.org/web/20250226020241/https://github.co...

buttercraft3• 1 year ago

Just to be clear, which publisher was banned? Maybe I'm being stupid (it's late here) but I'm struggling to track the various parties involved.

Anyway, thank you for the update.

isidorn8• 1 year ago

The publisher Equinusocio was banned.

anakaine• 1 year ago

You might need to chase down reuploads, too.

https://marketplace.visualstudio.com/items?itemName=t3dotgg....

isidorn8• 1 year ago

Thanks. Our security researchers will review this today and we might take it down. We reached out to the new author and he does not have malicious intent, and agreed that we just take down the new extension if we see something is off.

Lermatroid• 1 year ago

This is a older pinned version before the license and malware stuff started going down afaik

https://youtu.be/3wz7YF2as-c

rfl890• 1 year ago

Maybe point to the actual reupload instead? https://marketplace.visualstudio.com/items?itemName=fanny.vs...

bagels• 1 year ago

This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?

dark-star• 1 year ago

It's a common theme:

- build an open-source thing

- wait till thousands or millions of people are using it

- change the license and close down the source

- implement malicious code

- push an update

- profit! you now have your malware running on millions of systems

BigParm• 1 year ago

Imagine the amount of infected packages we use every day. Probably 20 different governments see everything we do.

cratermoon5• 1 year ago

why worry about governments so much? You know how many different companies see everything you do? Do you trust all of them?

https://www.wired.com/story/gravy-location-data-app-leak-rtb...

danhau• 1 year ago

Letting you know that VSCode is unable to uninstall the extension. It prompts me to uninstall, but when I confirm the window refreshes and the extension is still there, triggering the same "is problematic" prompt. This is an infinite loop. Same behavior when trying to uninstall the usual way from the extensions panel.

I had to manually delete the extension's folder in %USERPROFILE%\.vscode\extensions and delete the entry from the json (%USERPROFILE%\.vscode\extensions\extensions.json).

VSCode 1.97.2, commit e54c774e0add60467559eb0d1e229c6452cf8447

isidorn8• 1 year ago

Thank you for letting us know. We are investigating.

shdw• 1 year ago

Thank you man, I was getting nuts here trying to uninstall this crap but unable.

filiptronicek• 1 year ago

Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/

Hi Isidor, excited for this! At Open VSX, we'd love to take a look and potentially flag the extension as malicious on our side as well. Are you aware of the version range that the malicious code was included in? I'm asking because https://open-vsx.org does not have any version published since the extension went closed-source.

flutas4• 1 year ago

The extension file is still available to download directly from MS.[0]

I downloaded the file, and unzipped it, but on a cursory glance I only see obfuscated code nothing malicious.

[0]: !!!WARNING MAY BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...

galagladi• 1 year ago

They are now evading the ban by rebranding the extension to "Fanny Theme": https://marketplace.visualstudio.com/items?itemName=fanny.vs...

preommr• 1 year ago

Is this a troll name? Fanny is a faily well-known slang term[0]

[0] https://en.wikipedia.org/wiki/Fanny#In_slang

stef25• 1 year ago

Correct, the author links to it from his github page https://github.com/equinusocio

isidorn8• 1 year ago

Thank you. We will security audit this extension today and take action if needed.

flutas4• 1 year ago

So is there any proof of the malicious code?

The extension file is still available to download directly from MS.[0] (Which, why if you pull it from users are you still allowing downloads first of all.)

I downloaded the file, and unzipped it. On a cursory glance I see obfuscated code but zero "red flag" level code, has anyone seen the malicious code claimed?

[0]: !!!WARNING CLAIMED TO BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...

bitbasher2• 1 year ago

I de-obfuscated most of it and didn't see anything malicious. Was there any particular file that was concerning?

progbits• 1 year ago

Why was there any obfuscated code in the first place?

bitbasher2• 1 year ago

I missed it-- it's in the release notes file. I uploaded it to pastebin. It does look malicious.

https://pastebin.com/H5QjS4Bt

solomatov• 1 year ago

Is it possible for you to add color theme/icon theme/keymap only extensions, without any executable code? I think, it will improve the security situation a bit. I don't see why the mentioned kinds of extensions should have any code.

vlovich1236• 1 year ago

Help me square this circle:

A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us.
As a reminder, the VS Marketplace continuously invests in security

If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself?

I would also suggest that the trust model for VSCode is fundamentally broken - you’re running arbitrary third party code on client machines without any form of sandboxing. This is a level of security you would not deploy into Azure, so why is “run arbitrary 3p code on someone else’s machine” appropriate for VSCode?

While I appreciate the work that the VSCode team does and I use it, the lack of any form of sandboxing has always bothered me.

bogwog• 1 year ago

I was going to point this weird part of their comment too.

Reminder that the Open-VSX extension registry exists: https://open-vsx.org

Idk if they removed the malicious theme (or if they have it at all), but if MS isn't doing anything beyond just responding to user reports, you might as well switch to an open registry that probably does the same level of security work, and avoid giving them yet another monopoly.

davely• 1 year ago

you’re running arbitrary third party code on client machines without any form of sandboxing. This is a level of security you would not deploy into Azure, so why is “run arbitrary 3p code on someone else’s machine” appropriate for VSCode?

More and more, I am starting to think I need to run my development environment (for both work and personal projects) in a VM.

I am on MacOS, so UTM or Parallels would work pretty well I think. Sadly, I think my work explicitly forbids us from running VMs or accessing our services from them.

ajross4• 1 year ago

If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself?

I think that's sort of unfair. Of course MS should be relying on the community! That's arguably the best single practice for detecting these kinds of attacks in open source code. Objectively it works rather better even than walled garden environments like the iOS/Android apps stores (which have to be paired with extensive app-level sandboxing and permissions management, something that editor extensions can't use by definition).

The reference case for best practice here is actually the big Linux distros. Red Hat and Canonical and Debian have a long, long track record of shipping secure software. And they did it not on the back of extensive in-house auditing but by relying on the broader community to pre-validate a list of valuable/useful/secure/recommended software which they can then "package".

MS's flaw here, which is shared by NPM and PyPI et. al., is that they want to be a package repository without embracing that kind of upstream community validation. Software authors can walk right in and start distributing junk even though no one's ever heard of them. That has to stop. We need to get back to "we only distribute stuff other people are already using".

CodeWriter234• 1 year ago

PSA: every package you install from any package manager from browser extensions to npm/composer etc presents the risk of malware. Because the open source community lacks the financial resources to vet every single version of every package. Demanding this level of security from software provided at no cost that relies on open contributions is wholly unreasonable. If you need that, buy an IDE from a company financially capable of ensuring security and accept the limitations of their offering.

Mitigations like running in a VM might protect your dev workstation. But not code you put into production that relies on third parties.

nmstoker• 1 year ago

Remember, this is Microsoft! A friend told me of a fairly major corporate firm that found MSFT had arbitrarily pushed an AI tool to run on their SharePoint, scooping up site data outside of any formal agreement to do so. MSFT are no doubt covered by a general agreement but this seems underhand/inept and yet a remarkably common flaw in their approach (I've seen similar behaviour with Teams apps)

paulddraper• 1 year ago

Help me square this circle

Sure. As a general rule, you get what you pay for.

fennecfoxy• 1 year ago

Lmao why should they have to spend money auditing random 3rd party extensions that you choose to install? VSC is free, we're not paying for it.

balch• 1 year ago

Given that it's been automatically removed from all VS Code instance, is there any way to check if it was previously installed? It's concerning that there's now no way to check if a sytem has been compromised by this

BtM909• 1 year ago

Doesn't it prompt to uninstall?

shanselman• 1 year ago

False positives suck, and it hurts when it happens.

The publisher account for Material Theme and Material Theme Icons (Equinusocio) was mistakenly flagged and has now been restored. In the interest of safety, we moved fast and we messed up. We removed these themes because they fired off multiple malware detection indicators inside Microsoft, and our investigation came to the wrong conclusion. We care deeply about the security of the VS Code ecosystem, and acted quickly to protect our users.

I understand that the "Equinusocio" extensions author's frustration and intense reaction, and we hear you. It's bad but sometimes things like this happen. We do our best - we're humans, and we hope to move on from this We will clarify our policy on obfuscated code and we will update our scanners and investigation process to reduce the likelihood of another event like this. These extensions are safe and have been restored for the VS Code community to enjoy.

LINKS: Material Theme https://marketplace.visualstudio.com/items?itemName=Equinuso... Material Theme Icons https://marketplace.visualstudio.com/items?itemName=Equinuso...

Again, we apologize that the author got caught up in the blast radius and we look forward to their future themes and extensions. We've corresponded with him to make these amends and thanked him for his patience.

Scott Hanselman and the Visual Studio Code Marketplace Team - @shanselman

KronisLV• 1 year ago

I'm quite happy that nowadays most tools have competently made themes out of the box, so that if someone wants to minimize risks from something like this and keep the extensions/addons they install to a minimum, that's pretty viable.

Of course, it's also nice that it's possible to theme the software to such a degree and improve usability and accessibility in some cases, just that the feature requests about limiting permissions need to be addressed.

oneeyedpigeon3• 1 year ago

I find it curious that themes can be a security risk at all. Clearly, they consist of more than just the colour codes and don't definitions one might assume. Maybe the theming system needs to be tightened.

theobr5• 1 year ago

Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)"

The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic.

Out of an abundance of precaution, I've taken the following action on my fork:

1. I have the VS Code team auditing it as we speak, and I've given them full permission to immediately pull it from the marketplace & force uninstall it from users if they find ANYTHING malicious.

2. I have audited the code base thoroughly (nothing seemed malicious)

3. I have removed ALL code related to changelogs, analytics, Open Collective and html rendering.

The only thing that seemed slightly concerning was the html + sanity loader for changelogs, so I gutted it entirely. Two PRs removed almost all the deps and over 7,000loc (mostly package-lock)

Repo is here if anyone else would like to audit https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you

zelphirkalt• 1 year ago

To me it seems ridiculous, that a theme could even accumulate such things as analytics and even lots of dependencies. A theme is usually something self-contained. And even more ridiculous, that anyone can, as you write, "force uninstall" anything from my machine. So glad I am not a VS Code user. It seems all the typical corporate BS is happening with its marketplace and plugins.

qbane2• 1 year ago

If one can "force uninstall" for safety, then it implies that automatic upgrading an extension with the user's consent is unsafe at the first place.

bmicraft• 1 year ago

Try Qt themes, they're binaries compiled from C++ code :)

knowitnone• 1 year ago

yeah. I hope you leave malicious code running on your computers to prove your point.

e402• 1 year ago

Isn't the problem that VS Code has no permission model (restricting of them), so all extensions can do anything?

c048• 1 year ago

Thank you

thatgerhard• 1 year ago

thank you!

notwhereyouare• 1 year ago

how is there not a single screenshot of what it looks like either in the repo or on the marketplace page? Or did I just miss them?

drywipes• 1 year ago

it's ugly, don't worry.

however, I found this from the malware creator's website itself: https://framerusercontent.com/images/G17CYe9tTL2GP1Rw4mUI8YC...

joshka12• 1 year ago

@dang can you please update the link to the archive link

throw16180339• 1 year ago

HN doesn't have callouts. If you want dang to see your comment, email hn@ycombinator.com.

dang• 1 year ago

Usually it's better to put an archive link in the comments, not at the top, so the original domain isn't obscured. I've pinned the archive link to the top now (and detached this subthread from https://news.ycombinator.com/item?id=43181471).

(As throw16180339 said, please email hn@ycombinator.com with these things - that's the only way to be (mostly) sure I'll see it.)

globular-toast• 1 year ago

100s of people disrupted because Microsoft remotely changed the colours in their editor? Come on, people, you need to own your own tools.

bunbun69• 1 year ago

100s

Source?

disrupted

Source?

GlacierFox2• 1 year ago

What even is this comment? The extension has been deemed to have malicious code in it so it's been pulled. It's been remotely removed from users who have signed in to Code and I'm thankful for that. Should I be furious?

TZubiri3• 1 year ago

One of the things I love about the internet is learning how different people can be, I perceive it as different than me but I assume everyone has their quirks.

In this case, this is one of the most extreme instances of people installing lots of dependencies. The moment I realized something was different in me was left pad, I already felt that couldn't be me.

The log4j incident hit me different, it COULD have easily been me. A security vulnerability is like death or a terminal illness in my eyes. Successful companies that scale do so without incidents, If you are running a company and you have a vuln you are out of the race. So I tightened up a lot after that.

I realize something similar with sex I just can't fathom putting my whole life on the line just to have sex with somebody and then have nothing to show for it, no relationship, nothing.

And today we see this, people are really risking their companies, their reputation, their pride to have pretty colors on their IDE.

I used to fight it, try to convince people, of course I still keep the pride of being different and weary, but in the end, you will likely be fine, and I only hold a statistical advantage, both are valid strategies of going about life I guess.

wizzwizz44• 1 year ago

The log4j incident hit me different, it COULD have easily been me.

That couldn't be me, because I don't use Java, PHP, Windows APIs, or `xdg-open`. The closest I come to Java-esque "include ALL THE BATTERIES" is the occasional Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)

TZubiri3• 1 year ago

(Incidentally, I don't get very much done.) Lol, that's definitely part of the tradeoff of security in life.
I don't use Java I didn't use Java either, but whatever I was using at the moment (Python) could have been anything, if I stayed in my other job or gotten a different one I could very well been using Java and been the one that installed the thing.
Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)

Interesting, I use http.server or the Tcp socket server thing, but I consider myself to be in the extreme, there's still people that use Flask (and I do partake ocasionally) or things like Django, Spring, Next,etc... Same with binaries like Apache, Nginx.

I mean you gotta use something, and if you go too far on the deep end, you get the risk of introducing the vulnerabilities yourself, (in addition to the risk of getting nothing done as you mentioned). I know my limits I wouldn't implement cryptography for example.

Cthulhu_4• 1 year ago

A theme is fine - Google has been pushing Material for a while now, after all, so if you come from Google land the colours are familiar and preferred to you, same with themes like Solarized and whatnot.

That said, I do agree that dependency management and reliance is a Problem these days. left-pad was the camel that broke the proverbial camel's back for many people, and it made people realise how ridiculous dependencies in at least NodeJS land has become. It was already silly in Java land since the 2000s, but more from the layers of abstraction and overhead that frameworks like Spring add (which is ironic because Spring was originally conceived to be a lightweight alternative to J2EE, but that's a thread on its own).

I know the general community atmosphere in the Go ecosystem is adverse to adding dependencies and frameworks; it has a good standard library which was complete enough and which isn't yet fully bogged down by design by committee like Java and JS were (to their credit things are moving again), and its users are like "you know, plain Go is good enough", so they are much less likely to add frameworks or DSLs like assertion libraries.

I'd like to know if the same thing is happening in the Rust ecosystem, I've never ventured there before.

Macha2• 1 year ago

It had not occurred to me that a VS Code Theme was a full blown extension, since I've never installed one. I wonder if a lot of people have a mental model of a VS Code theme as a collection of CSS files, which should be relatively safe (even including those that install them).

Narishma• 1 year ago

The same thing is happening in Rust. Try to compile any random app and it pulls dozens if not hundreds of dependencies.

Alifatisk2• 1 year ago

Can anyone help point out where in the repo the malicious part was? Can't find it.

Found the obfuscated code here https://web.archive.org/web/20250226020241/https://github.co...

Eikon• 1 year ago

https://archive.is/SFH7m

GlacierFox2• 1 year ago

Looks like he's responded to it here. Delusional maniac? (Also, don't download and install that file he links)

https://github.com/material-theme/vsc-material-theme/discuss...

Retr0id• 1 year ago

I downloaded it to take a look, all the js is obfuscated via https://github.com/javascript-obfuscator/javascript-obfuscat...

Alifatisk2• 1 year ago

Is there any archive to that discussion? It's now deleted and couldn't find it on archive.is

lil-dev2• 1 year ago

In VS Code linux is very annoying the message that appears as a notification "We have uninstalled..." I try to remove the extension and after a few seconds it appears again and again. I think I have to use another IDE for today, fix this guys. PLS

wlonkly• 1 year ago

It might be Settings Sync trying to restore it?

lil-dev2• 1 year ago

it is very annoying the message that appears in VS Code linux, "We have uninstalled 'equinusocio..." please guys fix this. I have tried to uninstall the extension but magically it appears again, for today I have to use another IDE because of how annoying it is...

valsaven• 1 year ago

I did the following (it might help you too): 1. Close VS Code 2. Go to `C:\Users\USER\.vscode\extensions` 3. Delete the folder with that extension 4. Open extensions.json, find and delete the block related to that extension, then save the file 5. That’s it

kirillragozin• 1 year ago

Can confirm this works :)

dev1ycan• 1 year ago

Oh no... anyways. I use dark high contrast... guaranteed to work on any IDE (and) you don't get this.

thih9• 1 year ago

This HN submission now links to a 404 on github.

Is the original source code still uploaded somewhere?

jackmhny• 1 year ago

https://archive.is/SFH7m

manuelmoreale• 1 year ago

I think the guy simply renamed and moved everything here? https://github.com/Fanny-Theme/fanny-theme-support

meerita• 1 year ago

I got a message today saying the theme has malicious content and it was removed from my VS Code.

sigmoid102• 1 year ago

Curiously, someone on reddit noticed suspicious changes in this extension 7 months ago [1]. Obfuscation in open source is usually an extreme red flag. Microsoft really needs to rethink their security model for vs code extensions. It has simply become way too profitable to target given whatever they are doing against it. For every dev they ban 10 will come with new malicious extensions.

[1] https://www.reddit.com/r/vscode/comments/1eq40o2/has_the_mat...

bun_at_work• 1 year ago

Be careful what you wish for.

VS Code is maybe the best product Microsoft has ever released, largely because the extension market. If Microsoft polices the marketplace more, you can probably expect VS Code quality to degrade.

Here's my argument: More scrutiny of the marketplace will lead to less extensions overall (the scrutiny process will reduce the number of extensions overall as barrier to entry will be increased). Less extensions available will create an incentive for Microsoft to add features to VS Code directly. The more features MS adds, the more bloated VS Code will become.

So then, more security auditing in the extensions marketplace will lead to a more bloated VS Code.

All that said, it would be nice if there were better security controls in the extensions marketplace, I just don't trust Microsoft to do anything in a way that actually improves their products for the people who use them.

homebrewer3• 1 year ago

You do not have to police everything, copy what Mozilla is doing: pass the top X extensions through manual audits (including looking at code diffs on every update) and mark them as trusted. Maybe also add a giant warning "this extension may steal your stuff" when installing everything else.

sigmoid102• 1 year ago

It took a while, but Microsoft got it pretty much right with Windows Defender. It quietly made all other active scanners obsolete. It's just a question of how much effort they're willing to spend on a free product's infrastructure.

hemant1041• 1 year ago

Rip.

TaurenHunter• 1 year ago

This appears to be the original source code, before the change to the license and suspicious code:

https://github.com/Dramaga11/vsc-material-theme

MortyWaves3• 1 year ago

Theo of internet drama fame interjecting himself into the middle of it as always.

chroma• 1 year ago

Could you elaborate? I have no idea who “Theo of internet drama fame” is.

MortyWaves3• 1 year ago

Essentially an internet personality. While they sometimes make interesting points, mostly on X, Twitch, and YouTube, he often seems to interject himself into a lot of things needlessly. Before this Material thing, it was that Wordpress incident.

MortyWaves3• 1 year ago

Here’s some more insight https://x.com/1mortrix/status/1897389705005879461?s=46

itorcs• 1 year ago

If the size of your paycheck depends on drama and making a surprised look in a YouTube thumbnail you would possibly insert yourself into the middle of things also

makizar• 1 year ago

Aha, he's way ahead of you: https://www.youtube.com/watch?v=3wz7YF2as-c

tempaccount420• 1 year ago

This whole thing makes him look like a vulture. Just let the theme die or let someone make a better one from scratch.

The reason he forked it in the first place is, as he said himself, because he's famous.

mannotcool• 1 year ago

I found the malicious javascript (messages.js) file and put it in a Pastebin for anyone to analyze https://pastebin.com/yY1X0LiD

obviously its obfuscated by the guy originally

kevlened• 1 year ago

This code is harmless. We may need a copy of the actual, shipped extension from vscode.

https://pastebin.com/T998ZstM

flutas4• 1 year ago

Here's a copy of it to download directly from MS...

I've seen literally nothing malicious in it so far.

!!! WARNING CLAIMED MALICIOUS PACKAGE !!!

https://marketplace.visualstudio.com/_apis/public/gallery/pu...

codeptualize• 1 year ago

Isn't it about release-notes.js? There are quite a few files in there that are obfuscated. So far I haven't found anything super bad, it looks like a sanity.io client of some sorts, but there could be some stuff hidden in there as it's seems like quite a big JS bundle.

hassleblad23• 1 year ago

Noo.. please bring it back.

lifeplusplus• 1 year ago

Maybe there should be pool fund. Say you contribute $20 a year to it, and it gets distributed to all extensions you have monthly

rmac• 1 year ago

the "we took this down for security" is such a tempting _acceptable_ form of censorship.

My bank does this for my suspicious transactions, with a near %100 false positive rate.

Capricorn24812• 1 year ago

You're saying your bank is censoring something you do when it flags a transaction? For me it's just flagging big purchases I don't normally make.

Seems common sense and usually remedied by a text to a bot.

pro1233212• 1 year ago

anybody knows how to remove that pop up?

pro1233212• 1 year ago

how to remove that pop up which keeps coming?

jpb01042• 1 year ago

Are these the same developers? https://plugins.jetbrains.com/plugin/8006-material-theme-ui

Brainspackle• 1 year ago

I am wondering this too!

EDIT: Did some research and looks like it is different code by different developers, so we should be good.

jpb01042• 1 year ago

Thanks for digging in.

prmoustache• 1 year ago

Why would a theme contain code in the first place. Shouldn't it just be made of static value containing color codes?

7373737373• 1 year ago

Why would any add-on have more authority than it needs? Oh right - because no currently popular language supports implementing that kind of resource/rights monitoring and control:

https://medium.com/agoric/pola-would-have-prevented-the-even...

An absolute failure of contemporary programming language design.

Software firms need to think harder about what kind of guarantees the languages they use can give them - which part of a project's code can access which (and how many) resources - access to other project components, filesystems, the network, and the amount of process memory and CPU time they are allowed to consume. The current default answer is usually "any place has authority to access everything else, and a simple infinite loop will use up all the system's resources"

user99999999• 1 year ago

“Can’t wait to see the Netflix documentary about this”

wbakst• 1 year ago

original link here is now broken

bstsb• 1 year ago

from a quick deobfuscation of some of the code, i can't see anything wrong with it? i think this is just a case of obfuscated code being against the VS Code guidelines. the guy clearly wanted people to buy his pro version so maybe that's why he obfuscated all the code in the extension

withinrafael• 1 year ago

It appears Microsoft released their 'detailed announcement' - it's just a one-sentence fragment in a Markdown file: https://github.com/microsoft/vsmarketplace/blob/main/Removed...

I'm increasingly suspecting there was nothing actually wrong with the extension, and Theo and others may have simply demolished an open-source developer's reputation primarily because they found him difficult to collaborate with.

This is nuts.

Material Theme has been pulled from VS Code's marketplace

Related Stories