Check Point has discovered three malicious Visual Studio Code extensions available through the official VSCode store that contained code to steal user data and enable backdoor access.
The extensions were installed more than 45,000 times.
@campuscodi, this is why we need to unionize software vetting by installing packages from distros exclusively.
@cnx@larkspur.one @campuscodi@mastodon.social New-age developers will complain about how impossible it is to adhere to reasonable standards, and make users install it through less secure means. No matter how often it is showcased in practice that this is very dumb and leads to exploits time and time again, the developers will not change their ways.
That said, many distros could use better packaging guidance. I can agree that it is overly complex on some distros if the developer in question has no prior experience.
bonifartius 𒂼𒄄
@tyil @campuscodi @cnx how about elpa? should those be repacked for each distribution? (probably)
@bonifartius@qoto.org @campuscodi@mastodon.social @cnx@larkspur.one I would argue they should. All packages should be managed by your distro's package manager. This keeps update simple, and at least somewhat vetted by people who know what they're doing, and have an interest in making sure nothing bad gets in.
If I'm not mistaken, ELPA packages are just plaintext lisp files which need to be written to the right location. This should be relatively simple in any package manager. If it isn't, I'd argue the package manager needs some love, or maybe the distro maintainers can provide a script to make it easier.