Discussion

@GossiTheDog Just got notified by regular old Visual Studio that there is an update 18.6.1 except there are no release notes for 18.6.1.

So now I'm left wondering if this is a fix for a security flaw I should install right now or the result of a supply side attack facilitated by a security flaw I should definitely not install.

Whichever is the truth, I'm sure the correct approach is to ask CoPilot what to do, right Microsoft?

@GossiTheDog

Tried VScode, it was not really bad - except for my taste ate too much RAM, which becomes precious with all that AI and Browser-engine Apps.

Still looking for something better than Notepad++ having:
- low mem footprint
- (relatively) fast
- plugin/built-in support for couple languages I need

@GossiTheDog One of the top 10 extensions, with 73 million downloads, looks like its owned by a single dev on his personal github account.

I wonder how many fishing attempts he gets per day.

@GossiTheDog

VS Code started to be a thing people used when I was at MS. A lot of folks were using the remote extensions for working in Azure VMs. I saw that there was an open issue about FreeBSD support, so I reached out to some of the folks responsible internally. The things I learned about how that worked made me back away slowly and be very happy I used vim.

@GossiTheDog I realize that this is tangential, but the network is named CORPNET? Really? Are we in a cheap 1980s techno-thriller?

@GossiTheDog And the editor itself makes extensions necessary. Like want to highlight trailing white space (something that should be built into a code editor)? Nope, you need to install a random 3rd party extension!

@GossiTheDog One day, I might figure out why I'd ever want to install VSCode, but this is not that day. May it rot in hell for completely destroying search results between it and the real VS, both ways.

@GossiTheDog a Microsoft product with insecure macros? unheard of!

@GossiTheDog hell even opening a repo in vscode can cause code execution in multiple ways. It is basically impossible to use securely.

https://github.com/emilyselwood/self_deleting_repo

@GossiTheDog

They recently added a feature to control what publishers are allowed

https://code.visualstudio.com/docs/enterprise/policies

@GossiTheDog especially bad in light of rejecting the requests for cooldowns in the past https://github.com/microsoft/vscode/issues/79689

Also - if you think 'none of our users run VSCode', check your telemetry. They do. It doesn't even need local admin rights to install.

I've tooted about this one for about two years now, Microsoft have created their own security bonfire and it's going off in their own backyard, they just haven't realised yet.