News for hackers. Stuff that matters.

A comment on Dozens of malicious PyPI packages discovered targeting developers. Parent comment

Re:Dozens of malicious PyPI packages discovered targeting de... by jiripospisil on Wednesday November 02, 2022 @01:56PM (#33440176)
Sometimes but I wonder to what degree it actually matters. Tasks, debuggers, extensions etc. run in the context of the VM, not the host. The Remote SSH extension turns VS Code into a "thin" client which presents pretty much just the UI.

https://code.visualstudio.com/docs/remote/ssh

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by suchar on Wednesday November 02, 2022 @02:04PM (#33440314)
Readme says: https://marketplace.visualstudio.com/items?itemName=ms-vscod...

> A compromised remote could use the VS Code Remote connection to execute code on your local machine.

So I would say that it might be a bit harder for an attacker to gain access to your local machine, but you should not rely on it, because it's more like security by obscurity.

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by jiripospisil on Wednesday November 02, 2022 @02:16PM (#33440486)
Well damn. I was under the impression that the communication channel uses/accepts only well defined VSCode specific messages related to the UI...
[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by collinmanderson on Thursday November 03, 2022 @11:30AM (#33452557)
Darn. Maybe the solution is to use vs-code client in the browser? Like vscode.dev or https://github.com/coder/code-server ? It limits what keyboard shortcuts and extensions are available, but at least it's in a secure sandbox on the client side.
[ Parent | on HN ]