5 ms·

The article says they use open-vsx, which is managed by the Eclipse foundation. It's not really anything to do with cursor, other than the fact they're allowing

by worble 1y ago

The article says they use open-vsx, which is managed by the Eclipse foundation. It's not really anything to do with cursor, other than the fact they're allowing you access to the only other vscode marketplace that all the forks use.

btown 1y ago
The biggest "reveal" here is that open-vsx has far less effective anti-fraud measures than the end users of Cursor, Windsurf, etc. expect. It seems that an attacker was able to easily manipulate download counts, placing their malicious extension high in search results. And this is far from the first open-vsx vulnerability in the past month. See: https://blog.koi.security/marketplace-takeover-how-we-couldve-taken-over-every-developer-using-a-vscode-fork-f0f8cf104d44 https://blog.koi.security/marketplace-takeover-how-we-couldv... which describes how open-vsx was installing arbitrary packages and running their build scripts in a privileged environment. And the instructions to report malicious extensions, even now, are practically nonexistent: https://github.com/EclipseFdn/open-vsx.org/wiki/Guidelines-on-Extension-Requests#questions-about-licenses-and-potentially-malicious-extensions https://github.com/EclipseFdn/open-vsx.org/wiki/Guidelines-o... With billions of dollars being poured into this ecosystem, it's mind-boggling that security is being treated as such an afterthought. Consider this when choosing tools.
- rwmj 1y ago
  Yes, let's blame the guys working on something for free, instead of the company which raised nearly a billion in VC money but couldn't be bothered to check.
  - btown 1y ago
    If you run part of the software supply chain ecosystem, put it on the web without any kind of "alpha" or "insecure" language that's highly visible to end users on every package, and even distribute professional white papers and marketing-style landing pages to promote it (e.g. https://outreach.eclipse.foundation/openvsx https://outreach.eclipse.foundation/openvsx), but create a deployment architecture that executes arbitrary third party code during every deploy (as was the case before https://github.com/EclipseFdn/publish-extensions/pull/881/files https://github.com/EclipseFdn/publish-extensions/pull/881/fi... landed to fix the issue in the link above) - I do indeed think that the Eclipse Foundation bears some responsibility here. And for sure, Cursor and others should have funded security hardening of their extension marketplace. The lion's share of the blame lies on that. But the Eclipse Foundation is in a position to incentivize that investment by making it clear to end users that open-vsx is still at an experimental level of stability and security, rather than promoting it as an enterprise-ready product with white papers and all.
    - rwmj 1y ago
      There are companies that will provide quality guarantees and product liability insurance for open source software (I work for one in fact), so maybe Cursor should have used one of those.
- edg5000 1y ago
  @rwmj The Eclipse foundation is actually backed by some really big companies. Check out the sponsors page. (And a fun but irrelevant bonus fact: Eclipse was originally made by IBM)
  - rwmj 1y ago
    For sure, but the membership fees these companies pay are really quite small (bottom of this page https://www.eclipse.org/membership/prospectus/ https://www.eclipse.org/membership/prospectus/), and they mainly go towards infrastructure, running the working groups, and conferences. The projects get some benefits, but they don't get a lot of full time developers (in fact, I'd be surprised if they get even a fraction of 1 FTE), and are largely run either by volunteers or by people doing this in their 20% time in regular day jobs. In any case, Cursor didn't pay any money here, so they get to keep all the pieces when the code they used for free breaks.
    - edg5000 1y ago
      Ah, I see.
a_wild_dandan 1y ago
I blame my tool, Cursor. They blame their tool, open-vsx. We're either both right about that logic, or both wrong. Either way, I expect consistency in how the product I pay for assigns/accepts blame. Cursor's response will be interesting.

by worble 1y ago

btown 1y ago

The biggest "reveal" here is that open-vsx has far less effective anti-fraud measures than the end users of Cursor, Windsurf, etc. expect. It seems that an attacker was able to easily manipulate download counts, placing their malicious extension high in search results. And this is far from the first open-vsx vulnerability in the past month. See: https://blog.koi.security/marketplace-takeover-how-we-couldve-taken-over-every-developer-using-a-vscode-fork-f0f8cf104d44 https://blog.koi.security/marketplace-takeover-how-we-couldv... which describes how open-vsx was installing arbitrary packages and running their build scripts in a privileged environment. And the instructions to report malicious extensions, even now, are practically nonexistent: https://github.com/EclipseFdn/open-vsx.org/wiki/Guidelines-on-Extension-Requests#questions-about-licenses-and-potentially-malicious-extensions https://github.com/EclipseFdn/open-vsx.org/wiki/Guidelines-o... With billions of dollars being poured into this ecosystem, it's mind-boggling that security is being treated as such an afterthought. Consider this when choosing tools.

rwmj 1y ago
Yes, let's blame the guys working on something for free, instead of the company which raised nearly a billion in VC money but couldn't be bothered to check.
- btown 1y ago
  If you run part of the software supply chain ecosystem, put it on the web without any kind of "alpha" or "insecure" language that's highly visible to end users on every package, and even distribute professional white papers and marketing-style landing pages to promote it (e.g. https://outreach.eclipse.foundation/openvsx https://outreach.eclipse.foundation/openvsx), but create a deployment architecture that executes arbitrary third party code during every deploy (as was the case before https://github.com/EclipseFdn/publish-extensions/pull/881/files https://github.com/EclipseFdn/publish-extensions/pull/881/fi... landed to fix the issue in the link above) - I do indeed think that the Eclipse Foundation bears some responsibility here. And for sure, Cursor and others should have funded security hardening of their extension marketplace. The lion's share of the blame lies on that. But the Eclipse Foundation is in a position to incentivize that investment by making it clear to end users that open-vsx is still at an experimental level of stability and security, rather than promoting it as an enterprise-ready product with white papers and all.
  - rwmj 1y ago
    There are companies that will provide quality guarantees and product liability insurance for open source software (I work for one in fact), so maybe Cursor should have used one of those.
edg5000 1y ago
@rwmj The Eclipse foundation is actually backed by some really big companies. Check out the sponsors page. (And a fun but irrelevant bonus fact: Eclipse was originally made by IBM)
- rwmj 1y ago
  For sure, but the membership fees these companies pay are really quite small (bottom of this page https://www.eclipse.org/membership/prospectus/ https://www.eclipse.org/membership/prospectus/), and they mainly go towards infrastructure, running the working groups, and conferences. The projects get some benefits, but they don't get a lot of full time developers (in fact, I'd be surprised if they get even a fraction of 1 FTE), and are largely run either by volunteers or by people doing this in their 20% time in regular day jobs. In any case, Cursor didn't pay any money here, so they get to keep all the pieces when the code they used for free breaks.
  - edg5000 1y ago
    Ah, I see.

a_wild_dandan 1y ago

I blame my tool, Cursor. They blame their tool, open-vsx. We're either both right about that logic, or both wrong. Either way, I expect consistency in how the product I pay for assigns/accepts blame. Cursor's response will be interesting.