abadideainfo on the github breach appears to only be available on xitter 🙄 , I fished it out for you.
gonna gently push back that there's no reason (according to github's version of the story) to associate this with AI or with spectacular incompetence on the part of the employee; the issue is that industry standard, extremely widely used text editor Visual Studio Code has a big button that says "click here to add useful functionality to do your job" that has a 1% chance of installing ransomware
Nephrite@0xabad1dea I'm honestly not sure if you're joking or if this is literally true.
Ratsnake@Nephrite @0xabad1dea 1% is maybe a bit exaggerated but VS Code marketplace is kinda notorious for malware
@ratsnakegames @0xabad1dea That sounds pretty bad. Don't they do reviews or anything?
@Nephrite @0xabad1dea which package registry does these days?
@ratsnakegames @0xabad1dea Maybe I shouldn't learn coding. Sounds more and more like a well of cursed knowledge these days.
Radek Pietruszewski 🐶@Nephrite @ratsnakegames @0xabad1dea The problem IMO is a complete lack of sandboxing. You can have completely legitimate extension one day, then next day it gets updated with a compromised version (perhaps via a dependency)
@radex @Nephrite @0xabad1dea you cannot meaningfully sandbox an extension whose functionality includes compiling and running code from the user's workspace
@radex sandboxing the web browser was reasonably easy at the start because web pages had extremely limited functionality. But every time that allowable functionality gets extended, there is another multi-year process of defining and standardizing new interfaces including new permissions.
You cannot do that in an IDE without severely compromising the usefulness of thr IDE's plugin model
@ratsnakegames @Nephrite @0xabad1dea Sure. I'd rather say that _not every_ extension can be meaningfully sandboxed.
Required permissions could be clearly displayed and those that require full unsandboxed access could be additionally flagged.
IMO this would go a long way towards reducing risk of pwnage via extensions. Long process, sure, but worth it.
DerPumu (he/him)