5 ms·

In VS Code settings search for "tasks" you will find "Task: Allow Automatic Tasks"...turn it off. Anything else that should be locked down?

dude250711 8mo ago
Yes, uninstall the whole thing. It's just a Chromium covered with a bunch of JavaScript.
exitb 8mo ago
Even if you lock everything now, what if the thing autoupdates with new helpful "features". You can't patch bad development culture.
Muromec 8mo ago
Sounds like autorun on usb drives all over again. They cant learn
- tclancy 8mo ago
  I think that's a bit ungenerous: there is a push and pull between security and seamless user experience and it's never obvious where the line should be set. You really only figure out which way to move it after someone complains.
gus_ 8mo ago
On macOS systems, this results in the execution of a background shell command that uses nohup bash -c in combination with curl -s to retrieve a JavaScript payload remotely Unrestricted outbound connections, specially from curl/wget/bash
StingyJelly 8mo ago
This may only provide a flalse sense of security. Afaik, there is no way to disable workspace settings taking priority over user settings, so a malious repo can easily override them and reenable automatic tasks.
- Tyriar 8mo ago
  Various settings are `restricted` in the codebase to only use them when the workspace is trusted. `allowAutomaticTasks` is one such setting: https://github.com/microsoft/vscode/blob/f7730c409e14af94d75ba79fe2df96beda1b0cbd/src/vs/workbench/contrib/tasks/browser/task.contribution.ts#L546 https://github.com/microsoft/vscode/blob/f7730c409e14af94d75... So a malicious repo can easily override it... if you say you trust it.
rcxdude 8mo ago
Don't mark the folder as trusted when you open in VsCode. The number of other hooks that may exist is going to be hard to track down (especially because each addon may add their own).
ecshafer 8mo ago
1. Uninstall VSCode 2. Install Vim / Emacs / Sublime / Helix 3. ???? 4. Profit
- __jonas 8mo ago
  > Helix I'm not sure about the other ones, but I know that helix supports language servers by default and it does not have a workspace trust system like vscode, so LSPs can automatically execute code when you enter a directory https://github.com/helix-editor/helix/issues/9514#issuecomment-1925826872 https://github.com/helix-editor/helix/issues/9514#issuecomme... So uninstalling VSCode would be a bit of a step back in that case

dude250711 8mo ago

Yes, uninstall the whole thing. It's just a Chromium covered with a bunch of JavaScript.

exitb 8mo ago

Even if you lock everything now, what if the thing autoupdates with new helpful "features". You can't patch bad development culture.

Muromec 8mo ago

Sounds like autorun on usb drives all over again. They cant learn

tclancy 8mo ago
I think that's a bit ungenerous: there is a push and pull between security and seamless user experience and it's never obvious where the line should be set. You really only figure out which way to move it after someone complains.

gus_ 8mo ago

On macOS systems, this results in the execution of a background shell command that uses nohup bash -c in combination with curl -s to retrieve a JavaScript payload remotely Unrestricted outbound connections, specially from curl/wget/bash

StingyJelly 8mo ago

This may only provide a flalse sense of security. Afaik, there is no way to disable workspace settings taking priority over user settings, so a malious repo can easily override them and reenable automatic tasks.

Tyriar 8mo ago
Various settings are `restricted` in the codebase to only use them when the workspace is trusted. `allowAutomaticTasks` is one such setting: https://github.com/microsoft/vscode/blob/f7730c409e14af94d75ba79fe2df96beda1b0cbd/src/vs/workbench/contrib/tasks/browser/task.contribution.ts#L546 https://github.com/microsoft/vscode/blob/f7730c409e14af94d75... So a malicious repo can easily override it... if you say you trust it.

rcxdude 8mo ago

Don't mark the folder as trusted when you open in VsCode. The number of other hooks that may exist is going to be hard to track down (especially because each addon may add their own).

ecshafer 8mo ago

1. Uninstall VSCode 2. Install Vim / Emacs / Sublime / Helix 3. ???? 4. Profit

__jonas 8mo ago
> Helix I'm not sure about the other ones, but I know that helix supports language servers by default and it does not have a workspace trust system like vscode, so LSPs can automatically execute code when you enter a directory https://github.com/helix-editor/helix/issues/9514#issuecomment-1925826872 https://github.com/helix-editor/helix/issues/9514#issuecomme... So uninstalling VSCode would be a bit of a step back in that case