[tormeh]

The situation is absolutely insane, but it's also productive, but real security would slow everything down a lot. The moment you ask some corporate bureaucrat to put their signature down on a piece of paper saying that such and such dev tool is approved for use, they're going to block everything to avoid the responsibility implied by their approval. I can't really come up with a system that both works and is secure. The only exception is signing up for an integrated environment where Microsoft or Apple provides the OS, compiler, and editor. Oops - Apple doesn't sell servers, so only Microsoft offers this. Hope you like C#.

In theory you can mix and match, but in practice most bureaucrats will insist on single-sourcing.

[rapind]

Linux development has a blueprint they could follow. Like the principle of least privilege. These aren’t cutting edge concepts.

Also I’m not sure the tradeoffs of adding security to an editor are that big of a deal. Are we really seeing revolutionary stuff here? Every now and then I check out VS Code only to realize Vim is still 10x better.

[fc417fc802]

Vim is hardly secure either. Extensions in both provide for arbitrary code execution.

[rapind]

No doubt, but I (and I suspect many others) rarely update plugins and I have a very select list of plugins that I use (mostly from one guy), and I just use git to manage them. I never see churn, but that might just be me.

I assume you could probably do the same with VSCode, but I suspect there's a cultural difference that pushes you to always update? Do things stop working because of churn?

[not_ai]

At the company I work for they locked down installing extensions through the marketplace. Some are available but most are not and there is a process to get them reviews and approved. You might be able to side load them still but I haven’t cared enough to want to try.

They did the same with Chrome extensions.