RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by 8organicbits on Tuesday December 21, 2021 @05:29AM (#29635953)

> Does it fix the issues? Yes.

> Do I think there are other security issues here and we can bypass this? Also, yes.

> Do I want to spend more time doing free work for a company with a 2.5 TRILLION market cap? Hell, no.

Troubling.

[ Parent | on HN ]

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by SamuelAdams on Tuesday December 21, 2021 @08:40AM (#29637253)

Not really all that troubling, all the author is saying is that he wants to get paid for their work.

Either Microsoft or other future vendors can actually honor an established bug bounty program, or the author can sell his findings to the highest bidder. Or the author can simply not spend time and energy finding bugs in the first place.

[ Parent | on HN ]

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by 8organicbits on Tuesday December 21, 2021 @09:40AM (#29637748)

Don't miss the middle statement; the author thinks there are further attacks here, even with the fix. Others can also find and then choose to report/sell at their own discretion.

[ Parent | on HN ]

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by oaiey on Tuesday December 21, 2021 @08:56AM (#29637376)

Highest bidder is unethical and illegal.

But does not change the monetary reality

[ Parent | on HN ]

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by rajin444 on Tuesday December 21, 2021 @09:22AM (#29637591)

Pass a law that requires companies to pay black market value for bug bounties. It’s also unethical for big corporations to exploit the US oligarchy to get these fixes for free.

[ Parent | on HN ]

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by shukantpal on Tuesday December 21, 2021 @09:40AM (#29637751)

There’s no exploitation going on.

[ Parent | on HN ]

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by artful-hacker on Tuesday December 21, 2021 @01:51PM (#29640627)

How is it illegal?

[ Parent | on HN ]