News for hackers. Stuff that matters.

A comment on VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads. Parent comment

Re:VSCode Security: Malicious Extensions Detected- More Than... by oofsa on Monday May 22, 2023 @08:47AM (#36030742)
I want that feature too, but in reality, many non-trivial extensions require the execution of binaries such as language servers. Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge. In fact, even an extension to auto-complete paths in .gitignore files requires running a language server written in Rust [1], and it has the real benefit of supporting multiple editors with ease. If the "prettiest java" or "python-vscode" extensions in the article insisted on needing full permissions for Java or Python execution, I believe users would be convinced and end up installing them.

[1] https://github.com/quentinguidee/gitignore-ultimate-vscode

[ Parent | on HN ]
Re:VSCode Security: Malicious Extensions Detected- More Than... by fwlr on Monday May 22, 2023 @09:16AM (#36031033)
This… is a very strong objection and I think you’re right that users would be convinced. I didn’t think capabilities would be a panacea but I did think they would be pretty close, I have to revise that down somewhat.
[ Parent | on HN ]
Re:VSCode Security: Malicious Extensions Detected- More Than... by rascul on Monday May 22, 2023 @08:54AM (#36030814)
A language server for gitignore is not what I was expecting to come across this morning.

https://github.com/quentinguidee/gitignore-ultimate-server

[ Parent | on HN ]
Re:VSCode Security: Malicious Extensions Detected- More Than... by codedokode on Monday May 22, 2023 @09:31AM (#36031227)
> Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge.

This is because most OSes use outdated security model where the app gets all privileges by default and poor users have to build containers to revoke them, that's why there is an overhead.

If the extension only has access to project files then all applications launched by it should inherit its restrictions.

[ Parent | on HN ]
Re:VSCode Security: Malicious Extensions Detected- More Than... by PoignardAzur on Monday May 22, 2023 @10:22AM (#36031816)
Couldn't you just run the language server in webassembly?
[ Parent | on HN ]