GitHub confirms breach of 3,800 repos via malicious VSCode extension

Re:GitHub confirms breach of 3,800 repos via malicious VSCod... by larusso on Thursday May 21, 2026 @12:55AM (#48218025)

Most sandbox systems today, take seatbelt from Apple for instance, only strip permissions. If your extensions without internet access calls a tool that needs it, boom access denied or worse, weird network issues.

One would need some kind of ring system where less privileged processes can call higher privileged processes with their own sandbox permissions.

[ Parent | on HN ]

Re:GitHub confirms breach of 3,800 repos via malicious VSCod... by therealdrag0 on Thursday May 21, 2026 @01:52AM (#48218421)

Let the user grant permissions at install time. An error is a success in this scenario.

[ Parent | on HN ]

Re:GitHub confirms breach of 3,800 repos via malicious VSCod... by atq2119 on Thursday May 21, 2026 @02:41PM (#48227206)

Sure, that's the main challenge with building good sandboxing systems. But it's not actually that hard to do when the will to do it is there.

For example, Android already allows you to give apps restricted access to your media. My understanding of the way it works is that the resulting interface for picking photos etc. is not under the control of the app. The app only receives whatever file you picked.

[ Parent | on HN ]