6 ms·

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where I only installed official company owned extensions and even that is hard to be sure I'm not getting suckered. Sad state.

Gigachad 4mo ago
The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.
- charlieyu1 4mo ago
  I don’t understand why we don’t just sandbox everything. We have done it for web browsers, we can definitely do it for VSCode extensions.
  - inlined 4mo ago
    What are you withholding from the sandbox without making it useless?
    - atq2119 4mo ago
      Internet access. An editor extension does not need it.
      - sedatk 4mo ago
        All AI agent extensions disagree in unison.
        californical 4mo ago
        It could request access to a specific domain which you can approve or deny
      - larusso 4mo ago
        Most sandbox systems today, take seatbelt from Apple for instance, only strip permissions. If your extensions without internet access calls a tool that needs it, boom access denied or worse, weird network issues. One would need some kind of ring system where less privileged processes can call higher privileged processes with their own sandbox permissions.
        therealdrag0 4mo ago
        Let the user grant permissions at install time. An error is a success in this scenario.
        atq2119 4mo ago
        Sure, that's the main challenge with building good sandboxing systems. But it's not actually that hard to do when the will to do it is there. For example, Android already allows you to give apps restricted access to your media. My understanding of the way it works is that the resulting interface for picking photos etc. is not under the control of the app. The app only receives whatever file you picked.
  - Gigachad 4mo ago
    Because it's hard to create a system that is both sandboxed and powerful. You can't have an extension system that allows a plugin to run a locally installed linter or view the status of docker containers but can't execute something malicious. I do agree though that it is incredibly important to start taking sandboxing seriously. But there is a lot of difficulty and friction, and most of the users will scream and cry about extensions being limited.
    - moring 4mo ago
      > You can't have an extension system that (...) Yes you can. Extension systems of today have multiple problems that prevent that. The basic assumption that has to go, though, is that a core application like VSCode can be written once, then be extended to infinity without the core evolving. That's an assumption you see everywhere in extension systems, and it restricts everything to "features or security, but not both". Taking your examples: > run a locally installed linter VSCode and its extensions have certain files opened. The linter can do much less if it gets read-only access to those files, but not write access and no other files, not the open internet or something. This has then to be coupled with those permissions being displayed before installing, allowing them to be reviewed by users as well as plugin repo curators. Basically listing those permissions as declarative metadata. Because then a user or curator won't see "this plugin can read and write all your files" but "this plugin can read (but not write) the files being opened by VSCode". If the plugin wants to exfiltrate those files, the permissions would also list "this plugin can send HTTP requests to totally-legit-site.ru" instead of "this plugin gets arbitrary internet access". Main lession: permissions are WAY too coarse. But if they are fine-grained, they will soon no longer match the evolution of extensions, so the core system has to evolve too. > view the status of docker containers "This plugin can view the status of all docker containers started by other VSCode extensions in the same VSCode window". > users will scream and cry about extensions being limited Are those the same users? We might need two different products here, "feature VSCode" and "secure VSCode".
      - vlovich123 4mo ago
        I don’t know what linters you use, but the ones I like are the ones that show you problems in the workspace stably, not just in the files that happen to be open and altering as files open and close. You can always improve, but pretending like there’s an easy solution is lazy - if it was easy it would have been done.
- miki123211 4mo ago
  Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.
  - atq2119 4mo ago
    Fully agree with the first half of your comment. The second half goes off the rails, though. I rarely see people complain about sandboxing. What people complain about is when devices are locked down in a way where you are only allowed to install software that is approved by a central gatekeeper, even though sandboxing is in place that should make it far safer to run arbitrary safer than on traditional desktop systems.
    - nstart 4mo ago
      Agreed. What's frustrating is that we have models for how sandboxing can work and instead of investing efforts into nailing that experience, the OS providers are prone to turning it into a monetization/lock in layer instead. My VLC and VS Code should have an OS native way of being limited to particular functionality. But when the OS providers implement the sandbox, they center it around an App Store and restrictions on only apps that have been notarized where said notorization costs money or a requires a subscription. And then they remove the ability to do things which their own native apps can do and set tighter controlling rules on what APIs apps can ever have access to. When all I wanted was for VLC or similar to run in a sandbox by default where a plug-in I install can't do anything to my system or access the internet by default because the software itself is restricted to just the files I'm using and that's it.
      - Gigachad 4mo ago
        That exists on linux under flatpak, but it requires Wayland and Pipewire. Also many packages just request full system permissions rather than update to work in a sandbox. It's in the works and one day we will have it but progress is slow.
- xyzzy123 4mo ago
  Funnily enough a lot of this "extension sprawl" is caused by the _difficulty_ of installing tools on locked down Windows machines. I recently moved to a locked down SoE and instead of being able to use regular tools (which require a lengthy negotiation process to install) I now use extensions for absolutely everything, _because_ they're not currently policed in the same way...
  - ihateolives 4mo ago
    At my last workplace I was not allowed to install JSON viewer/prettier extension for my browser, but I was allowed to install VScode with random JSON plugins.
  - 3form 4mo ago
    I see the same thing. Similar for PyPI and NPM registry actually.
- yard2010 4mo ago
  The shit show that's called lastpass, which I unfortunately know, was hacked because a developer installed a bad version of Plex Media Server on his work computer.
ToucanLoucan 4mo ago
About the level of security in software I expect from the vendor who came up with “screenshotting your desktop every few seconds, OCRing those, and dumping the results to disk unencrypted in plain text”
at-fates-hands 4mo ago
I've become equally paranoid about VSCode extensions. I remember using several other IDE's like Brackets, JetBrains, Sublime Text or Bluefish only having a few solid extensions to rely on to get my dev work done. Now it seems like anything you do, someone or some company has built an extension specifically for your task. At this point I try and get the most done with the least amount of extensions period. That and trying to get the rest of my code off of Github is the other.
cwnyth 4mo ago
I've stayed with Sublime, often to the derision of VSCode addicts. I love to see the "VSCode is perfect" uncritical thinkers get theirs.
- no-name-here 4mo ago
  Sublime also has packages. https://packagecontrol.io https://packagecontrol.io Sublime's de facto package control repository is handled by an Uber engineer and father of 5 in his spare time, not someone currently at Sublime per https://packagecontrol.io/about https://packagecontrol.io/about / https://packagecontrol.io/say_thanks https://packagecontrol.io/say_thanks and his linked site. VS Code Marketplace seems to have a number of protections in place: https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security#_marketplace-protections https://code.visualstudio.com/docs/configure/extensions/exte... / https://code.visualstudio.com/api/advanced-topics/extension-host https://code.visualstudio.com/api/advanced-topics/extension-... It also appears that Sublime doesn't have sandboxing: https://github.com/sublimehq/sublime_text/issues/6915 https://github.com/sublimehq/sublime_text/issues/6915 > I love to see … Be kind to others. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html > "VSCode is perfect" Is the claim "VSCode is perfect" one that you've regularly run across, that you specifically called it out? (I'm personally happy that multiple editor options exist.)
  - brabel 4mo ago
    I was feeling like sneering as well about how my emacs setup never caused any issues until I remembered emacs packages have zero protection whatsoever and can run anything anywhere, are ALL authored by some guy in Nebraska or Slovakia or something in their spare time :) but we don’t see any attacks since there’s so few of us still using emacs.
  - deleted 4mo ago
    [deleted]
xgulfie 4mo ago
And they all want to auto-update, too.
wyclif 4mo ago
I don't use VSCode, but doesn't their plugin ecosystem indicate if the plugin is MSFT-approved?
- csomar 4mo ago
  That just means the domain was verified which costs like 10 bucks.
- no-name-here 4mo ago
  I'm guessing you're referring to the "Verified Publisher" blue checkmark next to the publisher's name and domain name, which proves the publisher owns the domain name and has 6+ months in the marketplace? https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security https://code.visualstudio.com/docs/configure/extensions/exte... (Separately, it doesn't help that MS doesn't allow VS Code forks to use the official marketplace, including as verified publisher doesn't seem to exist there - example: https://open-vsx.org/extension/esbenp/prettier-vscode https://open-vsx.org/extension/esbenp/prettier-vscode ) (Ancillary links: https://code.visualstudio.com/docs/configure/extensions/extension-marketplace https://code.visualstudio.com/docs/configure/extensions/exte... / https://marketplace.visualstudio.com/VSCode https://marketplace.visualstudio.com/VSCode )

Gigachad 4mo ago

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

charlieyu1 4mo ago
I don’t understand why we don’t just sandbox everything. We have done it for web browsers, we can definitely do it for VSCode extensions.
- inlined 4mo ago
  What are you withholding from the sandbox without making it useless?
  - atq2119 4mo ago
    Internet access. An editor extension does not need it.
    - sedatk 4mo ago
      All AI agent extensions disagree in unison.
      - californical 4mo ago
        It could request access to a specific domain which you can approve or deny
    - larusso 4mo ago
      Most sandbox systems today, take seatbelt from Apple for instance, only strip permissions. If your extensions without internet access calls a tool that needs it, boom access denied or worse, weird network issues. One would need some kind of ring system where less privileged processes can call higher privileged processes with their own sandbox permissions.
      - therealdrag0 4mo ago
        Let the user grant permissions at install time. An error is a success in this scenario.
      - atq2119 4mo ago
        Sure, that's the main challenge with building good sandboxing systems. But it's not actually that hard to do when the will to do it is there. For example, Android already allows you to give apps restricted access to your media. My understanding of the way it works is that the resulting interface for picking photos etc. is not under the control of the app. The app only receives whatever file you picked.
- Gigachad 4mo ago
  Because it's hard to create a system that is both sandboxed and powerful. You can't have an extension system that allows a plugin to run a locally installed linter or view the status of docker containers but can't execute something malicious. I do agree though that it is incredibly important to start taking sandboxing seriously. But there is a lot of difficulty and friction, and most of the users will scream and cry about extensions being limited.
  - moring 4mo ago
    > You can't have an extension system that (...) Yes you can. Extension systems of today have multiple problems that prevent that. The basic assumption that has to go, though, is that a core application like VSCode can be written once, then be extended to infinity without the core evolving. That's an assumption you see everywhere in extension systems, and it restricts everything to "features or security, but not both". Taking your examples: > run a locally installed linter VSCode and its extensions have certain files opened. The linter can do much less if it gets read-only access to those files, but not write access and no other files, not the open internet or something. This has then to be coupled with those permissions being displayed before installing, allowing them to be reviewed by users as well as plugin repo curators. Basically listing those permissions as declarative metadata. Because then a user or curator won't see "this plugin can read and write all your files" but "this plugin can read (but not write) the files being opened by VSCode". If the plugin wants to exfiltrate those files, the permissions would also list "this plugin can send HTTP requests to totally-legit-site.ru" instead of "this plugin gets arbitrary internet access". Main lession: permissions are WAY too coarse. But if they are fine-grained, they will soon no longer match the evolution of extensions, so the core system has to evolve too. > view the status of docker containers "This plugin can view the status of all docker containers started by other VSCode extensions in the same VSCode window". > users will scream and cry about extensions being limited Are those the same users? We might need two different products here, "feature VSCode" and "secure VSCode".
    - vlovich123 4mo ago
      I don’t know what linters you use, but the ones I like are the ones that show you problems in the workspace stably, not just in the files that happen to be open and altering as files open and close. You can always improve, but pretending like there’s an easy solution is lazy - if it was easy it would have been done.
miki123211 4mo ago
Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.
- atq2119 4mo ago
  Fully agree with the first half of your comment. The second half goes off the rails, though. I rarely see people complain about sandboxing. What people complain about is when devices are locked down in a way where you are only allowed to install software that is approved by a central gatekeeper, even though sandboxing is in place that should make it far safer to run arbitrary safer than on traditional desktop systems.
  - nstart 4mo ago
    Agreed. What's frustrating is that we have models for how sandboxing can work and instead of investing efforts into nailing that experience, the OS providers are prone to turning it into a monetization/lock in layer instead. My VLC and VS Code should have an OS native way of being limited to particular functionality. But when the OS providers implement the sandbox, they center it around an App Store and restrictions on only apps that have been notarized where said notorization costs money or a requires a subscription. And then they remove the ability to do things which their own native apps can do and set tighter controlling rules on what APIs apps can ever have access to. When all I wanted was for VLC or similar to run in a sandbox by default where a plug-in I install can't do anything to my system or access the internet by default because the software itself is restricted to just the files I'm using and that's it.
    - Gigachad 4mo ago
      That exists on linux under flatpak, but it requires Wayland and Pipewire. Also many packages just request full system permissions rather than update to work in a sandbox. It's in the works and one day we will have it but progress is slow.
xyzzy123 4mo ago
Funnily enough a lot of this "extension sprawl" is caused by the _difficulty_ of installing tools on locked down Windows machines. I recently moved to a locked down SoE and instead of being able to use regular tools (which require a lengthy negotiation process to install) I now use extensions for absolutely everything, _because_ they're not currently policed in the same way...
- ihateolives 4mo ago
  At my last workplace I was not allowed to install JSON viewer/prettier extension for my browser, but I was allowed to install VScode with random JSON plugins.
- 3form 4mo ago
  I see the same thing. Similar for PyPI and NPM registry actually.
yard2010 4mo ago
The shit show that's called lastpass, which I unfortunately know, was hacked because a developer installed a bad version of Plex Media Server on his work computer.

ToucanLoucan 4mo ago

About the level of security in software I expect from the vendor who came up with “screenshotting your desktop every few seconds, OCRing those, and dumping the results to disk unencrypted in plain text”

at-fates-hands 4mo ago

I've become equally paranoid about VSCode extensions. I remember using several other IDE's like Brackets, JetBrains, Sublime Text or Bluefish only having a few solid extensions to rely on to get my dev work done. Now it seems like anything you do, someone or some company has built an extension specifically for your task. At this point I try and get the most done with the least amount of extensions period. That and trying to get the rest of my code off of Github is the other.

cwnyth 4mo ago

I've stayed with Sublime, often to the derision of VSCode addicts. I love to see the "VSCode is perfect" uncritical thinkers get theirs.

no-name-here 4mo ago
Sublime also has packages. https://packagecontrol.io https://packagecontrol.io Sublime's de facto package control repository is handled by an Uber engineer and father of 5 in his spare time, not someone currently at Sublime per https://packagecontrol.io/about https://packagecontrol.io/about / https://packagecontrol.io/say_thanks https://packagecontrol.io/say_thanks and his linked site. VS Code Marketplace seems to have a number of protections in place: https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security#_marketplace-protections https://code.visualstudio.com/docs/configure/extensions/exte... / https://code.visualstudio.com/api/advanced-topics/extension-host https://code.visualstudio.com/api/advanced-topics/extension-... It also appears that Sublime doesn't have sandboxing: https://github.com/sublimehq/sublime_text/issues/6915 https://github.com/sublimehq/sublime_text/issues/6915 > I love to see … Be kind to others. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html > "VSCode is perfect" Is the claim "VSCode is perfect" one that you've regularly run across, that you specifically called it out? (I'm personally happy that multiple editor options exist.)
- brabel 4mo ago
  I was feeling like sneering as well about how my emacs setup never caused any issues until I remembered emacs packages have zero protection whatsoever and can run anything anywhere, are ALL authored by some guy in Nebraska or Slovakia or something in their spare time :) but we don’t see any attacks since there’s so few of us still using emacs.
- deleted 4mo ago
  [deleted]

xgulfie 4mo ago

And they all want to auto-update, too.

wyclif 4mo ago

I don't use VSCode, but doesn't their plugin ecosystem indicate if the plugin is MSFT-approved?

csomar 4mo ago
That just means the domain was verified which costs like 10 bucks.
no-name-here 4mo ago
I'm guessing you're referring to the "Verified Publisher" blue checkmark next to the publisher's name and domain name, which proves the publisher owns the domain name and has 6+ months in the marketplace? https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security https://code.visualstudio.com/docs/configure/extensions/exte... (Separately, it doesn't help that MS doesn't allow VS Code forks to use the official marketplace, including as verified publisher doesn't seem to exist there - example: https://open-vsx.org/extension/esbenp/prettier-vscode https://open-vsx.org/extension/esbenp/prettier-vscode ) (Ancillary links: https://code.visualstudio.com/docs/configure/extensions/extension-marketplace https://code.visualstudio.com/docs/configure/extensions/exte... / https://marketplace.visualstudio.com/VSCode https://marketplace.visualstudio.com/VSCode )