This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116

We do not plan to add a permission model in the next 6 months.

> We do not plan to add a permission model in the next 6 months.

I guess Copilot functionality trumps "Security above all else" now.

https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...

Yeah, the vscode release notes used to be lists of interesting new things and novel improvements.

Now they are all “copilot” “features”.

TBH, no criticism on the developers, but the VS Code release notes haven't been interesting or relevant to how I used the editor for years. I think I checked out when they added a terminal client to it and it dominated the release notes for ages.

AI features is one of the bigger innovations in editors in years, I fully understand the enthusiasm, especially given it can be linked to an earnings model. That said, before AI stuff I would've expected them to push integration with Github and Azure more.

This is why I use Emacs and it's why I didn't stop using Emacs when Sublime Text II, then Atom, then VSCode became popular.

When Microsoft gets bored of VSCode or forces you to only do AI "vibe coding", Emacs will still be there.

New version just came out. The release notes were full of good things.

Well, I used Emacs for 15-20 years. It has problems of its own -- mostly that it is effectively locked into an antediluvian view of how editors work, and that to use it effectively you end up maintaining large and complex configuration files.

I still use it for some things, but what we really need is a new, different edition of Emacs that has the same basic architecture but a more modern take on all the stuff that dates from the 1980s.

It's not "a problem," it's a difference in philosophy. Sure, VSCode comes accessible out of the box with minimal configuration needed and a GUI-first settings interface. But that comes with its own price - your config is more restricted in what you can do and fragmented across json files, settings menus, and extension options.

In contrast, with Emacs I can change any behavior of any function and command - built-in or third-party with amazing granularity. I can change specific parts of a function without rewriting it, and I don't even need to save that - I can just write a piece of Elisp in a scratch buffer, evaluate it, and test it out immediately.

Also, you are completely wrong with your notion that Emacs is outdated. Modern Emacs tools allow you to do things in a way no other editors let you - you can control video playback, read and annotate PDFs, search through your browser history, and automate things with LLMs.

Not to mention that the problem similar to the one being discussed in the thread would never happen in the Emacs world - nobody would ever get to publish a package with obfuscated Elisp code in it. You always will have full control over the code you download to use.

Yeah, I'm not wrong. Its terminology is antique.

As for the rest, been there and done that, but then you have to invest in your knowledge of Elisp, which has zero other benefits.

> Its terminology is antique

git uses "plumbing" and "porcelain" commands, referring to victorian-era plumbing systems. Adobe and other publishing tools use terms like "slug", "gutter", "folio", "pica". Debugging tools use terms like "trap", "dump", "patch". You're annoyed with what Emacs calls "window" and "frame"? And what about Tmux's "pane" and "window"; or "session" - "an ancient" term from the time of timesharing systems? Oh boy, if you afraid of words don't ever try to get into Haskell - those FP-crazies do use some real fancy words for their stuff.

> knowledge of Elisp, which has zero other benefits

The same way the knowledge of sql, or awk, or bash, or vim motions, or ssh, or tmux has zero benefits outside of their respective domains? What are you even talking about? I, for one, get daily gains, benefiting from knowing elisp - anything that has to do with text, just about anything can be automated with ease.

Just the other day - watching my colleague over Zoom, I decided to fix that for my note-taking. It took me fifteen minutes to write a piece of Elisp that OCRs any piece of text from a screenshot. Instead of disrupting my teammates all the time, I would now take a screenshot of a screen area with Flameshot, run my custom command and voilà - the text appears in my editor, and I can quickly grab it and use it in my notes.

I don't know where exactly "you've been" and what "you've done", but it really sounds like you haven't seen modern Emacs in practice. When one sees what people can do these days in it, it's hard not to get impressed.

XEmacs Tried to do that, it has been attempted to rewrite the backend of emacs into Rust twice, Guile has tried to interpret emacs lisp twice. The biggest problem is basically how large the user base is and the ability of people to want to perform the port so actually improving the editor is more likely.

GTK+ and webkit has been integrated into emacs and it has a package manager now and configuration is still a problem.

before copilot the first item in their release notes was always accessibility, which I though was a very nice touch. Now Copilot took the prime spot

Never believe the marketing from big tech

- Apple “privacy first” claims are a wash

- Microsoft “security above all else” is bullshit

At the end of the day, all of these are public companies that have one singular purpose: deliver shareholder value at _all_ costs

Your customers don’t matter. Your labor doesn’t matter.

I hate this neoliberal nightmare

>"I hate this neoliberal nightmare"

What does fucking up customers over profit has to do with political orientation? Any company will do it regardless of who they voted for.

this is not about who they vote for, it's the system that is neoliberal in that allows and incentivizes only maximum profit and puts very little barriers

Political orientation determines what we let companies get away with.

Given the enormity of the attack surface that has just been exposed, that's disappointing.

This isn’t really exposed so much as exploited. This was always possible.

you're right. it's not new. https://www.bleepingcomputer.com/news/security/malicious-vsc...

There will never be some permission model. Like in VBA there is after all this years nothing. VBA would be much less problematic if you could restrict VBA to just one Excel sheet or so

Security has been overlooked for way too long for me to trust it at this point.

The only sane way to contain the blast radius is to run is to run code-server in a container (or in a VM) and use it through a browser tab.

Luckily, the UI works perfectly, hotkeys and everything. They did an awesome work there.