It is a shame that the team never prioritized extension permission issues [0] despite their big boss said security is the top priority [1]. All they have is "workspace trust" and various other marginally useful security measures.
I don't install a VSCode extension unless it is either official or well known and audited and I have to use it. I keep most of them disabled by default unless I need something for a project. (Even if you don't care about security, it's good for VSCode performance. I'll save that story for another day.)
[0] https://github.com/microsoft/vscode/issues/52116
[1] https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...
So I started uninstalling some icon themes and less used extensions that I installed on a whim years ago.
I implicitly trust extensions by Google, Microsoft and the like, but the less known published make me nervous.
Meanwhile random FOSS projects be like "please sudo curl bash to install the prebuilt binaries".
In theory you can mix and match, but in practice most bureaucrats will insist on single-sourcing.
Also I’m not sure the tradeoffs of adding security to an editor are that big of a deal. Are we really seeing revolutionary stuff here? Every now and then I check out VS Code only to realize Vim is still 10x better.
They did the same with Chrome extensions.
I've used it to inject download links on sites, autoclose modals, etc. You can either write them yourself, or review other people before installing them.
It’s not a perfect solution, but at least it reduces the surface area to a single extension.
FYI: Just set Script Updates to Never.
I'm also skeptical that even a dark mode extension would be simple considering how varied web pages can be
Trusting other devs to not write malicious code has led to a surprisingly small number of incidents so far, but I don't think this will extrapolate into the future.
With more lines of code being auto-written without deliberate intent or review from an accountable author, things can only get worse!
They are (of course) not foolproof and very well may miss something, so people need to evaluate their own risk/reward tradeoff with these extensions, even after reviewing them with AI, but I think they are pretty useful.
We already have so many good fast secure polygot customizable text editors. Why run one through Chrome and fill it with extensions for everything that will have arbitrary access to everything?
You open it. It just works. And the learning curve is smooth.
Compare this to Vim where, if it's the first time you're opening it, you are forced to kill the process because you don't even know how to quit it, never mind actually do any productive work.
> Compare this to Vim where, if it's the first time you're opening it, you are forced to kill the process because
I'm serious. Open a blank file by typing `vim` into the terminal. Don't press anything, just look at the screen.
I'm sorry, but reading docs, or just reading, shouldn't be considered a significant barrier to entry.
The comment isn't actually even talking about providing the same service, so they mention emailing themselves files and usb drives.
The problem was there was a big technical hurdle to locally network mount a file system. Especially across OSes. It's even harder to do it non locally. Sure, it's not hard if you're familiar with that stuff. Sure, it's not hard to learn if you're comfortable in the terminal. Sure, today you can use rclone. BUT that's not a tool my grandma can use.
On the other hand, we're not talking about tools my grandma can use. We're talking about tools a programmer can use.
By the way, the language server protocol was originally developed for VSCode [1]. The popularity of LSP in other editors might have contributed to advertise VSCode.
my favorite VSCode feature is the SSH remote working feature. VSCode gives me the full editing / console / Claude environment on my local workstation, where all files, shells, and yes Claude as well run on a company lab machine over the VPN. Props to the collaborative working feature where several people can all share the same VSCode editor session on their individual workstations.
Vim can do the above two things if you run as a terminal app with tmux. Sublime could do it if you shared the editor via X or Waypipe (well not the second feature). But VSCode integrates it directly in the app and it's a much better experience.
> But VSCode integrates it directly in the app and it's a much better experience.
We built a password automation tool (thepassword.app) specifically to address this: the AI model orchestrates browser navigation, but actual credential values are injected at the local browser level and never enter the model's context. Even if the model were compromised or prompt-injected, there's nothing sensitive to steal.
The lesson generalizes: for any AI tool touching sensitive data, the safest architecture keeps that data entirely outside the AI's reasoning loop.
Who is this “we”? I don’t, and don’t know anybody else who does this.
Also, was this article itself written by an AI assistant? If the author is that carefree regarding these extensions, I guess probably.
Even this reads like an AI extension wrote it.
You all can take vim out of my cold dead hands.
I think it’s the culture behind the (neo)vim community is a bit more technical, and are quite quicker to sound the alarm if anyone tries something shady.
But, in any event, I hand-roll my own config and every plugin I install is inspected by me. When I pull changes, I check the diffs for anything shady. If a plugin is simple enough, I will just integrate it into my own stuff.
Why do these companies put so much effort into fighting right to repair to avoid IP leaks any halfway serious company could reverse engineer in a week, but on the other hand encourage their employees to vibe all company secrets into the cloud?
Can't repair your own stuff and either need to use authorized repair shop or buy new? The company gets more money.
Force your developers to forgo quality in efforts to produce more cruft in less time? The company gets more money.
Of course, only considering short-term, long-term they'll lose money, but at that point all the executives and managers already got their bonuses and probably moved on to doing the same in some other company.
Only if you believe they are truthful about the reason for fighting right to repair. I think the reason for fighting right to repair is to reduce the time before a replacement purchase is required.
> but on the other hand encourage their employees to vibe all company secrets into the cloud?
Lots of companies do ban or restrict usage of LLMs etc.
The main thing I had to wait on for a long time was support for preventing 3rd party code from being plagiarized since our code base was intermingled with partnered companies.
TBF, Cursor's code indexing works the same way, it has to send all workspace files to their servers.
Auto-completion systems need previous edits to suggest next edits so no surprises their either.
“Oh that’s cool, I already donate to my local neo nazi group. We are both philanthropists!”
Nothing makes me go from apolitical to a red blooded American faster than seeing someone make a stupid false equivalency about the US on this forum
In fact, many even are from "hostile countries" that are "enemies of democracy".
What's more, some of those people aren't aligned with US interests and aren't willing to put their lives on the line for CIA operations!