News for hackers. Stuff that matters.

A comment on VSCode remote code execution advisory. Parent comment

Re:VSCode remote code execution advisory by ar_lan on Tuesday December 06, 2022 @11:53PM (#33890744)
Nix would be a good solution to this. Have a corporate cache for all installed software with approved versions that folks can pin their environments to.

Ticketing still needs to be in place, but it can also be a managed repository that can be audited/reviewed by IT team as well - tickets could be as simple as a Pull request.

[ Parent | on HN ]
Re:VSCode remote code execution advisory by pixl97 on Wednesday December 07, 2022 @08:23AM (#33894037)
Working with large financial clients I've seen that most companies have systems somewhat like this already. Reviewed software is internally available for download off an intranet site, and some kind of request system exists if you need a newer version and you'll get an update on when it's available.
[ Parent | on HN ]