News for hackers. Stuff that matters.

A comment on Visual Studio Code is designed to fracture. Parent comment

Re:Visual Studio Code is designed to fracture by tikkabhuna on Monday September 30, 2024 @08:19AM (#41696317)
> - The VSCode security story is very, very weak. Extensions are not sandboxed. The client, accessing remote repos, is wildly insecure, by design.

This is a big concern for our Infosec team. There is no middle ground between open access to every Extension on the marketplace or locked down and Extensions are installed via local files. The latter being a significant overhead in maintaining VSCode.

[ Parent | on HN ]
Re:Visual Studio Code is designed to fracture by EasyMark on Monday September 30, 2024 @11:42AM (#41698467)
All these same things are true for emacs/vim/CLion plugins as well. You kind of either have to accept the risk cowboy style, do something in the middle (maybe only allow very well known extensions from source you trust), or live without the extensions.
[ Parent | on HN ]
Re:Visual Studio Code is designed to fracture by spacemanspiff01 on Monday September 30, 2024 @08:23AM (#41696345)
Can't you host your own extension marketplace?
[ Parent | on HN ]
Re:Visual Studio Code is designed to fracture by doubled112 on Monday September 30, 2024 @08:40AM (#41696478)
Then you have other problems. Maintaining the store itself, obtaining the extensions people want, and keeping the extensions up to date adds some overhead.

Looks like it should be possible, although I have no experience doing it myself.

https://github.com/coder/code-marketplace

[ Parent | on HN ]
Re:Visual Studio Code is designed to fracture by phillipcarter on Monday September 30, 2024 @09:56AM (#41697118)
Sounds like that's the price your org is willing to pay for your its flavor of Infosec.
[ Parent | on HN ]