As an VSCode extension author, I am always terrified by the amount of power I have.

It is a shame that the team never prioritized extension permission issues [0] despite their big boss said security is the top priority [1]. All they have is "workspace trust" and various other marginally useful security measures.

I don't install a VSCode extension unless it is either official or well known and audited and I have to use it. I keep most of them disabled by default unless I need something for a project. (Even if you don't care about security, it's good for VSCode performance. I'll save that story for another day.)

[0] https://github.com/microsoft/vscode/issues/52116

[1] https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...

The situation is absolutely insane, but it's also productive, but real security would slow everything down a lot. The moment you ask some corporate bureaucrat to put their signature down on a piece of paper saying that such and such dev tool is approved for use, they're going to block everything to avoid the responsibility implied by their approval. I can't really come up with a system that both works and is secure. The only exception is signing up for an integrated environment where Microsoft or Apple provides the OS, compiler, and editor. Oops - Apple doesn't sell servers, so only Microsoft offers this. Hope you like C#.

In theory you can mix and match, but in practice most bureaucrats will insist on single-sourcing.

Same thing for browser extensions: a simple browser extension (e.g. web dark mode), can read all your password fields. It's crazy that there are no proper permission scopes in any major browsers ! It would have been so easy to make password / email fields exempt from browser extensions unless they ask for the permission.

Installing any 3rd party dev dependency without sandboxing should terrify you. These supply chain attacks are not hypothetical.

Trusting other devs to not write malicious code has led to a surprisingly small number of incidents so far, but I don't think this will extrapolate into the future.

With more lines of code being auto-written without deliberate intent or review from an accountable author, things can only get worse!

Yes, exactly. The lack of any sort of permission controls for extensions in VS Code gives me the creeps

I am (am worried) and recently stopped adding extensions by just the random anon. Also I take time to sanitise foreign (to my knowledge) gh repos using Claude code.