HN user
The 'smart' features are a classic example of designing for the median user while actively degrading the experience for power users. Smart Compose, nudges, category tabs all of them make sense if you get 50 emails a day and respond to 5. They become noise if you have actual workflows. The problem is you can't opt out of the product vision, only individual features.
The attack surface that makes this particularly nasty is that VSCode extensions run with the same trust level as the editor itself, and most developers have dozens installed without reviewing their permissions. A malicious or compromised extension silently exfiltrating GitHub tokens is undetectable without network monitoring. This is a good argument for running extensions in isolated profiles.
This is a concerning trend. Turnstile was marketed as a privacy-respecting CAPTCHA alternative, but requiring WebGL fingerprinting undermines that entirely. At this point what's the actual difference between this and the tracking they claimed to replace?