News for hackers. Stuff that matters.
Re:VSCode remote code execution advisory by dj_mc_merlin on Wednesday December 07, 2022 @03:39AM (#33892073)
Thanks for the answer. That sounds horrible^Hy unproductive, although I suppose some cost must be paid for mass collaboration.

Also out of interest, is the answer to this:

> what do you do when your Linux gets messed up?

indeed just "wait for IT to fix it"? What do you do until then, have lunch?

Re:VSCode remote code execution advisory by pas on Thursday December 08, 2022 @02:06PM (#33911782)
Why would your Linux get messed up?

> That sounds horrible^Hy unproductive

A friend of mine works for BlackRock, they simply work on remote Windows virtual desktops. He is not complaining about speed/efficiency.

A different friend works for ALDI (like Walmart just smaller), he got an issued MacBook (Pro?). When he connected an external USB hard drive the next day (or sooner?) he got an email about it because some automated scanner thing found something suspicious on it.

So at these sizes software development is already inefficient. But mostly because of the complexity. (You know ... https://www.youtube.com/watch?v=y8OnoxKotPQ&t=95s )

Re:VSCode remote code execution advisory by pixl97 on Wednesday December 07, 2022 @08:02AM (#33893854)
When you get struck by a watering hole attack and drag malware inside the corporate network that proceeds to start encrypting everything not only for your own system, but your coworkers around you and an entire team of developers is sitting around twiddling their thumbs while all the systems are restored, that's when we realize playing fast and loose with stuff off the internet can have far reaching effects.

Having something go wrong on your personal system can be an 'oops', having something go wrong in any number of regulated industries can be a 'news generating event'.

Re:VSCode remote code execution advisory by dj_mc_merlin on Thursday December 08, 2022 @07:10AM (#33907013)
> having something go wrong in any number of regulated industries can be a 'news generating event'.

I did say that if you work in a tightly regulated industry, obviously stuff is different. This should be pointed out though! You can't give advice for the medical or financial sector to someone with a 15-person startup that builds low-stake products. It's just not going to be the right advice, as you well know security is a tradeoff. I guarantee that disabling root on dev computers is a huge productivity hit -- you need to be sure of the pros/cons of making that decision.