https://marketplace.visualstudio.com/items?itemName=t3dotgg....
Because he said so?
I did a thorough combing of the code base when I forked. Just did another audit and still not seeing anything suspicious. Gutting all of the opencollective and changelog code to be 1000% sure.
https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you/p...
> I did a thorough combing of the code base when I forked. Just did another audit and still not seeing anything suspicious.
You could instead "append" your name to the copyright notice though, which is legal.
https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you/c...
- build an open-source thing
- wait till thousands or millions of people are using it
- change the license and close down the source
- implement malicious code
- push an update
- profit! you now have your malware running on millions of systems
Society as a whole could easily avoid this by funding open source/free utilities to the point where malware makers need to spend significant cash to outbid yearly community support, but unfortunately maintaining anything available online for free is a thankless job that barely covers the electricity required to maintain the code.
In this case too, the developers behind the theme seemed to want to monetise their work, which had attained almost 4 million installs, in the past, but found themselves with a rather unwilling customer base. I don't know if they snapped and uploaded something malicious or if they're intentionally making it hard for forks to copy their work, but either way the lesson learned is that if you want to make money you should just abandon your free projects and start something else.
As long as we won't have to pay 2 USD for an extension!
GGs if you want a buck for the VSCode theme you made.
I know I'm in the minority, but I block ads because of memetic hygiene. I don't want to deprive artists but I'm not sitting through adslop for a podcaster's sake.
Disclosure: I work at Google.
Soon, I'm going to need an extension that removes the AI stuff I don't want and didn't ask for.
Using youtube in 2025 is exhausting.
Skipping sponsored sections: https://sponsor.ajay.app/
Remove shorts: https://addons.mozilla.org/en-US/firefox/addon/remove-youtub...
Return dislike: https://www.returnyoutubedislike.com/
Forgot to mention returning the dislike in my original comment.
At least I can use these extensions and get something resembling the service I want to pay for.
Also note that while it takes away the ads, it does nothing about the stalking (which bothers me much more than the adverts themselves) the results from which will be used to serve ads if you cancel in future (and in any case may be made available, directly or otherwise, to third parties, unless that part of the terms has changed).
Netflix 1080p: $18/mo. Netflix 4k: $25/mo. No annual plan.
Youtube Premium, which offers 4k, is $14/mo, or $120/yr for the annual plan (which averages to $12/mo).
UK prices:
Netflix 1080p: £13/mo. Netflix 4k: £19/mo. No annual plan.
Youtube Premium: £12/mo. No annual plan.
It's interesting how in the Youtube Premiums discount over Netflix is smaller in the UK than the US, and how Youtube Premium lacks an annual plan in the UK.
>Also note that while it takes away the ads, it does nothing about the stalking
Does an ad blocker change that?
> Does an ad blocker change that?
In many places, yes. Youtube? Less so, but it depends on which blocker(s) are in play.
A DNS based blocker won't help completely as some of the ad/track related requests are coming from their main domain or sub-domains that are used for other things so can't be blocked wholescale. It will block JS and other resources pulling from *.doubleclick.net though.
A browser/add-on based blocker may do much better by being able to more selectively block resource that are tracking related. It will also be able to block data passed via embedded videos in other sites. They can, and probably do, still track based on what you are actually watching via requests to the main domain, no ad blocker can do much about that without blocking the whole site.
>The Privacy Enhanced Mode of the YouTube embedded player prevents the use of views of embedded YouTube content from influencing the viewer’s browsing experience on YouTube. This means that the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize the YouTube browsing experience, either within your Privacy Enhanced Mode embedded player or in the viewer’s subsequent YouTube viewing experience.
>If ads are served on a video shown in the Privacy Enhanced Mode of the embedded player, those ads will likewise be non-personalized. In addition, the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize advertising shown to the viewer outside of your site or app.
https://support.google.com/youtube/answer/171780?hl=en#zippy...
but no need to single them out.
Plenty of bait and switch later free apps turned freemium, or malicious, out there.
Anyway, thank you for the update.
We do not plan to add a permission model in the next 6 months.
I guess Copilot functionality trumps "Security above all else" now.
https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...
Now they are all “copilot” “features”.
AI features is one of the bigger innovations in editors in years, I fully understand the enthusiasm, especially given it can be linked to an earnings model. That said, before AI stuff I would've expected them to push integration with Github and Azure more.
When Microsoft gets bored of VSCode or forces you to only do AI "vibe coding", Emacs will still be there.
New version just came out. The release notes were full of good things.
I still use it for some things, but what we really need is a new, different edition of Emacs that has the same basic architecture but a more modern take on all the stuff that dates from the 1980s.
In contrast, with Emacs I can change any behavior of any function and command - built-in or third-party with amazing granularity. I can change specific parts of a function without rewriting it, and I don't even need to save that - I can just write a piece of Elisp in a scratch buffer, evaluate it, and test it out immediately.
Also, you are completely wrong with your notion that Emacs is outdated. Modern Emacs tools allow you to do things in a way no other editors let you - you can control video playback, read and annotate PDFs, search through your browser history, and automate things with LLMs.
Not to mention that the problem similar to the one being discussed in the thread would never happen in the Emacs world - nobody would ever get to publish a package with obfuscated Elisp code in it. You always will have full control over the code you download to use.
As for the rest, been there and done that, but then you have to invest in your knowledge of Elisp, which has zero other benefits.
git uses "plumbing" and "porcelain" commands, referring to victorian-era plumbing systems. Adobe and other publishing tools use terms like "slug", "gutter", "folio", "pica". Debugging tools use terms like "trap", "dump", "patch". You're annoyed with what Emacs calls "window" and "frame"? And what about Tmux's "pane" and "window"; or "session" - "an ancient" term from the time of timesharing systems? Oh boy, if you afraid of words don't ever try to get into Haskell - those FP-crazies do use some real fancy words for their stuff.
> knowledge of Elisp, which has zero other benefits
The same way the knowledge of sql, or awk, or bash, or vim motions, or ssh, or tmux has zero benefits outside of their respective domains? What are you even talking about? I, for one, get daily gains, benefiting from knowing elisp - anything that has to do with text, just about anything can be automated with ease.
Just the other day - watching my colleague over Zoom, I decided to fix that for my note-taking. It took me fifteen minutes to write a piece of Elisp that OCRs any piece of text from a screenshot. Instead of disrupting my teammates all the time, I would now take a screenshot of a screen area with Flameshot, run my custom command and voilà - the text appears in my editor, and I can quickly grab it and use it in my notes.
I don't know where exactly "you've been" and what "you've done", but it really sounds like you haven't seen modern Emacs in practice. When one sees what people can do these days in it, it's hard not to get impressed.
GTK+ and webkit has been integrated into emacs and it has a package manager now and configuration is still a problem.
- Apple “privacy first” claims are a wash
- Microsoft “security above all else” is bullshit
At the end of the day, all of these are public companies that have one singular purpose: deliver shareholder value at _all_ costs
Your customers don’t matter. Your labor doesn’t matter.
I hate this neoliberal nightmare
What does fucking up customers over profit has to do with political orientation? Any company will do it regardless of who they voted for.
The only sane way to contain the blast radius is to run is to run code-server in a container (or in a VM) and use it through a browser tab.
Luckily, the UI works perfectly, hotkeys and everything. They did an awesome work there.
https://www.wired.com/story/gravy-location-data-app-leak-rtb...
As long as government claims the right to a monopoly on violence, it is reasonable to hold them to far, far higher standards than anyone else, including corporations. There is only so much damage one company or one cartel can do, but with government, the downside is unbounded. As I suspect we're about to see for ourselves.
> Their customer, a government, did the murdering.
Using stuff the corporation made and profited from.
Max Weber died in 1920, get some new economics.
Meanwhile, remind me what corporations built Stalin's infrastructure?
I had to manually delete the extension's folder in %USERPROFILE%\.vscode\extensions and delete the entry from the json (%USERPROFILE%\.vscode\extensions\extensions.json).
VSCode 1.97.2, commit e54c774e0add60467559eb0d1e229c6452cf8447
* Any specifics on the (potential) impact for affected users?
* What they should do to get it removed?
Edit: There does seem to be a little bit more information available over at Bleeping Computer[1], but the precise nature of what the malware does is unclear at this time other than that it may be some type of "supply chain attack". It would be good to hear more about the specifics.
1: https://www.bleepingcomputer.com/news/security/vscode-extens...
Hi Isidor, excited for this! At Open VSX, we'd love to take a look and potentially flag the extension as malicious on our side as well. Are you aware of the version range that the malicious code was included in? I'm asking because https://open-vsx.org does not have any version published since the extension went closed-source.
I downloaded the file, and unzipped it, but on a cursory glance I only see obfuscated code nothing malicious.
[0]: !!!WARNING MAY BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...
At the very least, the author has delusional notions about the greatness of their source code and they worry about piracy, meaning that there is a high probability of stupid bugs and that they would be difficult to notice because of the obfuscation.
Of course in this case the default assumption should be that there is something malicious to hide.
Of course, 'git' is also an insult.
It would never be offensive or used with sexual connotation. It's kind of like the equivalent of wiener.
If you dig into the code on GitHub [1] , you can see it's the same author as the Material Theme. But I'm not sure how the marketplace folks are supposed to track that.
0 external and harmful dependencies
closed source = no more toxic community and youtubers talking shit about things they don't know.
Looks like we're good now.
It doesn't seem to be pretty smart and safe going rogue with such public exposure no? Unless it is a completely fake persona, of course.
Hmmmmm.
The extension file is still available to download directly from MS.[0] (Which, why if you pull it from users are you still allowing downloads first of all.)
I downloaded the file, and unzipped it. On a cursory glance I see obfuscated code but zero "red flag" level code, has anyone seen the malicious code claimed?
[0]: !!!WARNING CLAIMED TO BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...
> A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us.
> As a reminder, the VS Marketplace continuously invests in security
If you’re relying on the community to alert you to the issues in the marketplace, perhaps you’re not investing enough in auditing popular extensions yourself?
I would also suggest that the trust model for VSCode is fundamentally broken - you’re running arbitrary third party code on client machines without any form of sandboxing. This is a level of security you would not deploy into Azure, so why is “run arbitrary 3p code on someone else’s machine” appropriate for VSCode?
While I appreciate the work that the VSCode team does and I use it, the lack of any form of sandboxing has always bothered me.
Mitigations like running in a VM might protect your dev workstation. But not code you put into production that relies on third parties.
VS Code isn't some kind of hobby project by a couple of dudes on laptops with nothing but the best interests of the community at heart. It's a flagship IDE produced by one of the most valuable tech companies in the world, released for free as a loss leader in service to very specific corporate goals.
When a tech behemoth releases a free IDE as a loss leader and it drives out all of the scrappy open source projects one by one, I think it's reasonable to hold that tech behemoth to tech behemoth standards rather than scrappy open source project standards.
Raymond Hill (of ublock fame) wasn't really impressed with how it is performed, but it's still much better than nothing (which is what MS apparently does).
VSCode is an IDE in name only, it's a glorified text editor, and pretty mediocre one at that. I in "IDE" stands for "integrated", like what you'd expect from JetBrains' products. Or even the real visual studio.
Or to make things more succinct:
* VSCode is a extendable code editor (like vim, neovim, Zed and Sublime)
* Jetbrains Rider is a fully equipped Integrated Development Environment (like Microsoft Visual Studio or its direct sibling Jetbrains IntelliJ IDEA)
And while extensions are optional within a IDE (and often solely used for increased productivity), more often than not they are a necessity in a code editor to even become productive.
"Integrated" isn't meant to contrast with a plugin-based system (otherwise JetBrains wouldn't count!), it's meant to contrast with a dev environment built out of a bunch of individual tools and terminal commands run separately.
How you know that?
Which is why I'm pretty confident in first party packages and don't install third party plugins from random authors.
You’d end up with Apple-style reviews and then people complaining about them. You can’t really win.
Fiscal responsibility: required
> Not merely a couple dudes in their bedroom doing this in their spare time?
Fiscal responsibility: optional
I would also point out, the malware-infested extension we are talking about presents more as the “two guys in a bedroom” model (though possibly a state-sponsored actor).
I made the point elsewhere, but this seems to fail in the face of Debian and Red Hat and Canonical who have been publishing mostly-secure distros of exclusively open source software for decades now.
There's a reason why MS and NPM get caught by this sort of shenanigans, but it's not "open source".
No, the reason Linux is safe and modern distributors aren't is the "packaging" step. Debian volunteers package software that they understand to be high quality via existing community consensus. You can't just show up to Fedora and say "ship my junkware app", you need to convince the existing community that your stuff doesn't suck.
And that's worked extremely well for decades now, going all the way back to 2BSD being shipped above V7 Unix. The reason MS and NPM et. al. abandoned it isn't just pure experience[2]. They don't want to wait for their repos to fill with good software, they want all the software in it now so that they don't get beaten by whoever their competitors are.
And this is the inevitable result. If you allow anyone to distribute software to your users then you allow everyone to distribute software to your users. And everyone includes a lot of bad people.
[1] With vastly more capability! The distro ships everything from firmware blobs and kernel drivers up through browser glitz and desktop customization. Talk about "attack surface"!
For the most popular package:
Debian: ~253K installs per month [1]
NPM: ~236M installs per month [2]
VSCode: ~158M installs total [3]
Obviously VSCode is hard to compare, but the most popular Debian package would need 52 years to achieve the total VSCode numbers so I'm sure it's safe to say VSCode beats Debian significantly on installs and NPM wins even more convincingly.
Ok, but let's take a look at how much code is shipping which was your metric:
Debian: 242k submissions per month for amd64 [4]
NPM: ~50k new non-spam packages per month, ~800k new version submissions per month [5]
VSCode: No data available
I don't know how VSCode compares, but clearly NPM beats Debian which makes sense because of how open it is and more importantly how many orders of magnitude there are JS developers vs Linux developers and how much more frequently they update their packages because the overhead is lower for creating a submission.
It's really easy to forget that the number of JS developers or people using IDEs is much larger than the number of Linux users. So NPM still beats Debian on this front. As for the security assumption and how good a job maintainers are doing, I'm not so sure on that either. The xz utils backdoor into SSH was found by a Microsoft employee (i.e. the community) not by Debian maintainers. It's not hard to imagine that the lack of notable security issues (particularly attempts recorded) actually indicates very little review, not that there's a higher bar because the maintainers are more talented or have better incentives for "reasons" - there's a reason Chrome was perceived as having better security than IE (it did - architecture was better) and STILL they see regular successful attacks bypassing all the mitigations.
Again, to reiterate in case the above got you triggered again - NPM & VScode have significantly more users than Debian and that creates economic incentives for attackers. The capabilities of a vulnerability matter less unless you're a state actor because capabilities do not track economic results as strongly. This has so much evidence it shouldn't even need this kind of explanation. Remember when people said that Mac had better security? Well turns out Apple is dealing with all the same vulnerability and spam issues on a closed down system when their popularity went up; again, economic incentives.
[1] https://popcon.debian.org/main/by_inst
[2] https://www.npmjs.com/package/lodash
[3] https://marketplace.visualstudio.com/items?itemName=ms-pytho...
[4] https://popcon.debian.org/
[5] https://blog.sandworm.dev/state-of-npm-2023-the-overview
But I'm not following how you get from popularity numbers to "attack surface". The latter is a term of art that reflects the amount of complexity on the "outside" of a software system that can be interacted with by an attacker. It correlates well with "amount of code". I don't see that it has any relation at all to number of installs.
But sure, let's use "amount of code" as a proxy. Debian has ~123GiB of source code [1] across ~65k packages [2] while NPM has 74 GiB [3] if I'm reading it correctly (other sources say 128 GiB) across 3.3 M packages [4]. Given that JS requires less code than C for equivalent functionality (due to a richer runtime & no memory management), any way you slice it, NPM is a much larger attack surface both in terms of number of opportunities and how valuable the attack is.
[1] https://www.debian.org/mirror/size
[2] https://www.debian.org/doc/manuals/debian-faq/basic-defs.en....
Reminder that the Open-VSX extension registry exists: https://open-vsx.org
Idk if they removed the malicious theme (or if they have it at all), but if MS isn't doing anything beyond just responding to user reports, you might as well switch to an open registry that probably does the same level of security work, and avoid giving them yet another monopoly.
More and more, I am starting to think I need to run my development environment (for both work and personal projects) in a VM.
I am on MacOS, so UTM or Parallels would work pretty well I think. Sadly, I think my work explicitly forbids us from running VMs or accessing our services from them.
You can append a Github repo to the URL to open it: https://vscode.dev/https://github.com/facebook/react
I think that's sort of unfair. Of course MS should be relying on the community! That's arguably the best single practice for detecting these kinds of attacks in open source code. Objectively it works rather better even than walled garden environments like the iOS/Android apps stores (which have to be paired with extensive app-level sandboxing and permissions management, something that editor extensions can't use by definition).
The reference case for best practice here is actually the big Linux distros. Red Hat and Canonical and Debian have a long, long track record of shipping secure software. And they did it not on the back of extensive in-house auditing but by relying on the broader community to pre-validate a list of valuable/useful/secure/recommended software which they can then "package".
MS's flaw here, which is shared by NPM and PyPI et. al., is that they want to be a package repository without embracing that kind of upstream community validation. Software authors can walk right in and start distributing junk even though no one's ever heard of them. That has to stop. We need to get back to "we only distribute stuff other people are already using".
Sure. As a general rule, you get what you pay for.
The publisher account for Material Theme and Material Theme Icons (Equinusocio) was mistakenly flagged and has now been restored. In the interest of safety, we moved fast and we messed up. We removed these themes because they fired off multiple malware detection indicators inside Microsoft, and our investigation came to the wrong conclusion. We care deeply about the security of the VS Code ecosystem, and acted quickly to protect our users.
I understand that the "Equinusocio" extensions author's frustration and intense reaction, and we hear you. It's bad but sometimes things like this happen. We do our best - we're humans, and we hope to move on from this We will clarify our policy on obfuscated code and we will update our scanners and investigation process to reduce the likelihood of another event like this. These extensions are safe and have been restored for the VS Code community to enjoy.
LINKS: Material Theme https://marketplace.visualstudio.com/items?itemName=Equinuso... Material Theme Icons https://marketplace.visualstudio.com/items?itemName=Equinuso...
Again, we apologize that the author got caught up in the blast radius and we look forward to their future themes and extensions. We've corresponded with him to make these amends and thanked him for his patience.
Scott Hanselman and the Visual Studio Code Marketplace Team - @shanselman
A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code.
We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instances that have this extension running. For clarity - the removal had nothing to do about copyright/licenses, only about potential malicious intent.
Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/
As a reminder, the VS Marketplace continuously invests in security. And more about extension runtime trust can be found in this article https://code.visualstudio.com/docs/editor/extension-runtime-...
Thank you!