Mitigations like running in a VM might protect your dev workstation. But not code you put into production that relies on third parties.

Reminder that the Open-VSX extension registry exists: https://open-vsx.org

Idk if they removed the malicious theme (or if they have it at all), but if MS isn't doing anything beyond just responding to user reports, you might as well switch to an open registry that probably does the same level of security work, and avoid giving them yet another monopoly.

I think that's sort of unfair. Of course MS should be relying on the community! That's arguably the best single practice for detecting these kinds of attacks in open source code. Objectively it works rather better even than walled garden environments like the iOS/Android apps stores (which have to be paired with extensive app-level sandboxing and permissions management, something that editor extensions can't use by definition).

The reference case for best practice here is actually the big Linux distros. Red Hat and Canonical and Debian have a long, long track record of shipping secure software. And they did it not on the back of extensive in-house auditing but by relying on the broader community to pre-validate a list of valuable/useful/secure/recommended software which they can then "package".

MS's flaw here, which is shared by NPM and PyPI et. al., is that they want to be a package repository without embracing that kind of upstream community validation. Software authors can walk right in and start distributing junk even though no one's ever heard of them. That has to stop. We need to get back to "we only distribute stuff other people are already using".

More and more, I am starting to think I need to run my development environment (for both work and personal projects) in a VM.

I am on MacOS, so UTM or Parallels would work pretty well I think. Sadly, I think my work explicitly forbids us from running VMs or accessing our services from them.

Sure. As a general rule, you get what you pay for.

https://youtu.be/3wz7YF2as-c

I downloaded the file, and unzipped it, but on a cursory glance I only see obfuscated code nothing malicious.

[0]: !!!WARNING MAY BE MALICIOUS!!! https://marketplace.visualstudio.com/_apis/public/gallery/pu...

- build an open-source thing

- wait till thousands or millions of people are using it

- change the license and close down the source

- implement malicious code

- push an update

- profit! you now have your malware running on millions of systems

I did a thorough combing of the code base when I forked. Just did another audit and still not seeing anything suspicious. Gutting all of the opencollective and changelog code to be 1000% sure.

We do not plan to add a permission model in the next 6 months.

The only sane way to contain the blast radius is to run is to run code-server in a container (or in a VM) and use it through a browser tab.

Luckily, the UI works perfectly, hotkeys and everything. They did an awesome work there.

https://pastebin.com/H5QjS4Bt

https://www.wired.com/story/gravy-location-data-app-leak-rtb...

[0] https://en.wikipedia.org/wiki/Fanny#In_slang

however, I found this from the malware creator's website itself: https://framerusercontent.com/images/G17CYe9tTL2GP1Rw4mUI8YC...

These aren't mutually exclusive.

What's wrong is the bait and switch, as these projects end up being popular because of their FOSS nature.

just did a pass and removed everything that was not necessary - it's even less code now lmao

    -------------------------------------------------------------------------------
    Language                     files          blank        comment           code
    -------------------------------------------------------------------------------
    TypeScript                      23             50            169           1307
    Markdown                         6            129              0            224
    YAML                             2              8              6             52
    INI                              1              1              0              7
    -------------------------------------------------------------------------------

    SUM:                            32            188            175           1590
    -------------------------------------------------------------------------------

https://github.com/material-theme/vsc-material-theme/commits...

I'm not sure why the initial commit already says "official", but that's almost a decade ago.

> I don't use Java I didn't use Java either, but whatever I was using at the moment (Python) could have been anything, if I stayed in my other job or gotten a different one I could very well been using Java and been the one that installed the thing.

>Python script, but I won't use `http.server`. (Incidentally, I don't get very much done.)

Interesting, I use http.server or the Tcp socket server thing, but I consider myself to be in the extreme, there's still people that use Flask (and I do partake ocasionally) or things like Django, Spring, Next,etc... Same with binaries like Apache, Nginx.

I mean you gotta use something, and if you go too far on the deep end, you get the risk of introducing the vulnerabilities yourself, (in addition to the risk of getting nothing done as you mentioned). I know my limits I wouldn't implement cryptography for example.

> "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.

This covers not just the users, but also the "author" here who exercises the permissions granted below:

> 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.

> 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:

> (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and

So let's interpret that. Regardless of the whatever intent to re-license the code exists in the mind of the author, in order to distribute the code which was contributed by others, the only legal means to distribute this code must comply with the requirements of the license. Technically they could remove all code contributions which were contributed by others (I've done this in the past, it's a pain to do right), or seek permission from the others to add additional grants that are not included in the Apache license here (I've seen various projects do the post-facto CLA thing for this). But that has not happened here.

So (in my opinion) the github repo of the author is a currently infringing the copyright of all the other contributors. Any one of whom could enforce it or raise a DMCA take down notification on the repo.

So given that we're talking about material that is in breach of copyright, it's likely that being able to enforce a license on that as a consumer is not really a thing which is possible as the conditions on what must be included bind the person distributing the material not the person receiving it.

The founder of Bikram Yoga, tried to copyright a sequence of yoga poses, even though similar sequences have existed for for thousands of years. Monster, the energy drink maker, went after business for using the word "monster" in totally unrelated contexts. Disney trademarked "Hakuna Matata" (a Swahili phrase roughly equivalent to "no worries") after using it in The Lion King, prohibiting African businesses from using a common idiom in their own damn language. Don't get me started on Happy Fucking Birthday.

So I run a small game that has a couple thousand active users, and part of that is allowing users to chat via written text. The amount of vitriol some users spew just amazes me. If they acted like that in person, I expect they would get punched in the mouth quite often. I also have a suspicion that some of these people are literally mentally ill, and online is basically where they live.

They hide it mostly to their family, but other human beings are treated like NPCs.

For example I live in the south of France and people are literally crazy on the road but they still avoid accidents by some kind of miracle. These are people from all sex, color, and age. The good middle-aged white father becomes a fucking moron when his car is turned on. The young new mom who pretends to love her children is speeding on the road like an idiot.

Society accepts that or turns its head the other way not to look at it, but it’s definitely around us and I see it every time I go to work.

My consideration on this is:

A lot of software that at least I write privately is rather a manifestation of some deeper values/opinions that I have. So in some sense the software is just the tip of an iceberg, a manifestation of something deeper. The software might isolatedly be independently useful for other people, but this is not is essence. Its essence is the deeper values/opinions that made the software to be created.

In this sense, it is rather the rational thing to expect that most discussions of the software are strongly intertwined with the values/opinions of the programmer, because these form the bottom of the iceberg of the software.

P.S. Just to be clear: I am not the kind of person who does personal jabs or passive aggressive snipes.

I've seen literally nothing malicious in it so far.

!!! WARNING CLAIMED MALICIOUS PACKAGE !!!

https://marketplace.visualstudio.com/_apis/public/gallery/pu...

Free themes are a dime a dozen.

Paid themes means someone's incentivized to keep working on it and adding icons, &c.

Same reason Xcode is free.

A git repository is just a Merkle tree.