News for hackers. Stuff that matters.

A comment on VSCodium – Libre Open Source Software Binaries of VS Code. Parent comment

Re:VSCodium – Libre Open Source Software Binaries of VS Code by croes on Monday September 04, 2023 @02:47PM (#37383587)
Isn't VSCodium just VSCode without the telemetry code?

So if there is a supply chain risk it's the same for VS Code

[ Parent | on HN ]
Re:VSCodium – Libre Open Source Software Binaries of VS Code by krick on Monday September 04, 2023 @03:08PM (#37383833)
You're missing the point. GP is discussing binaries. I.e., the assumption is that published source code (on Github) is perfectly fine, and then either the (malign) developer is changing the code before compiling it, or the (malign) third party is somehow using some vulnerability to replace the official binaries with compiled code of their own. And then you think that you are using "VSCode without the telemetry code", but in reality you're running a botnet.
[ Parent | on HN ]
Re:VSCodium – Libre Open Source Software Binaries of VS Code by Retr0id on Monday September 04, 2023 @02:53PM (#37383650)
The supply chain does not end at the source code.
[ Parent | on HN ]
Re:VSCodium – Libre Open Source Software Binaries of VS Code by croes on Monday September 04, 2023 @02:55PM (#37383671)
What does VSCodium add?
[ Parent | on HN ]
Re:VSCodium – Libre Open Source Software Binaries of VS Code by jamesgeck0 on Monday September 04, 2023 @03:14PM (#37383893)
If their CI is one day compromised by an attacker, potentially anything.
[ Parent | on HN ]
Re:VSCodium – Libre Open Source Software Binaries of VS Code by croes on Monday September 04, 2023 @03:56PM (#37384324)
Just like MS's CI, and I guess MS is the more valuable target.
[ Parent | on HN ]
Re:VSCodium – Libre Open Source Software Binaries of VS Code by fredoliveira on Monday September 04, 2023 @05:38PM (#37385354)
But one might also assume, the hardest target to actually hit.
[ Parent | on HN ]