Hacker News new | ask | show | jobs
by ande-mnoc 470 days ago
Will Microsoft consider adding a permission model for extensions?
3 comments

This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116

We do not plan to add a permission model in the next 6 months.

> We do not plan to add a permission model in the next 6 months.

I guess Copilot functionality trumps "Security above all else" now.

https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...

Yeah, the vscode release notes used to be lists of interesting new things and novel improvements.

Now they are all “copilot” “features”.

TBH, no criticism on the developers, but the VS Code release notes haven't been interesting or relevant to how I used the editor for years. I think I checked out when they added a terminal client to it and it dominated the release notes for ages.

AI features is one of the bigger innovations in editors in years, I fully understand the enthusiasm, especially given it can be linked to an earnings model. That said, before AI stuff I would've expected them to push integration with Github and Azure more.

This is why I use Emacs and it's why I didn't stop using Emacs when Sublime Text II, then Atom, then VSCode became popular.

When Microsoft gets bored of VSCode or forces you to only do AI "vibe coding", Emacs will still be there.

New version just came out. The release notes were full of good things.

Well, I used Emacs for 15-20 years. It has problems of its own -- mostly that it is effectively locked into an antediluvian view of how editors work, and that to use it effectively you end up maintaining large and complex configuration files.

I still use it for some things, but what we really need is a new, different edition of Emacs that has the same basic architecture but a more modern take on all the stuff that dates from the 1980s.

before copilot the first item in their release notes was always accessibility, which I though was a very nice touch. Now Copilot took the prime spot
Given the enormity of the attack surface that has just been exposed, that's disappointing.
This isn’t really exposed so much as exploited. This was always possible.
Security has been overlooked for way too long for me to trust it at this point.

The only sane way to contain the blast radius is to run is to run code-server in a container (or in a VM) and use it through a browser tab.

Luckily, the UI works perfectly, hotkeys and everything. They did an awesome work there.

There will never be some permission model. Like in VBA there is after all this years nothing. VBA would be much less problematic if you could restrict VBA to just one Excel sheet or so