Developers Are Victims Too : A Comprehensive Analysis of The VS Code Extension Ecosystem · HackerPapers discussions

Developers Are Victims Too : A Comprehensive Analysis of The VS Code Extension Ecosystem — mentioned by uludag

Mon, 13 Jan 2025 14:32:27 GMT

> VS Code managed to by-pass the qualitiy and amount of extensions/plugins in a fraction of time Emacs took decades. I get the impression that the VSCode has a rather fractured, limited, malware-infested[1][2], JavaScript-churn inundated plugin ecosystem. You have lots of choice, but I'm would be just as hesitant using a random extension as I would downloading some random executable and running it. On the other hand, I'm genuinely surprised (in a good way) how OCD some Emacs users are with the code I publish to MELPA. [1] https://arxiv.org/abs/2411.07479 [2]…

Paper and discussion history. A mention is not an endorsement.

Developers Are Victims Too : A Comprehensive Analysis of The VS Code Extension Ecosystem — mentioned by uludag

Wed, 27 Nov 2024 16:38:03 GMT

I have no doubt that VSCode has a much less risk of executing code by opening something. Ironically however, it seems that VSCode's extension is the most effective channel to distribute malware in the history of code editors. [1] [2] Not that MELPA couldn't be used to distribute malware either, I just think, as another poster mentioned, these problems are almost more social than technical. [1] https://www.bleepingcomputer.com/news/security/malicious-vsc... [2] https://arxiv.org/html/2411.07479v1

Paper and discussion history. A mention is not an endorsement.