[CITIZENDOT]

> I wonder if vscode would still load the script if you click “don’t trust author”

It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712.

But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.

[Scaled]

Yeah, I had no idea Microsoft thinks trust means auto run immediately a script. I always just thought it was something more pedestrian, like restricting debug launch links or something. I will probably not use vs code at all for untrusted repos now.

[manarth]

  > "I will probably not use vs code at all for untrusted repos now"

The meaning of "Trust" is pretty unambiguous. If you're clicking "Trust this" for a repository you don't trust, I'm not sure that switching IDEs is going to help you much.

[hyperhello]

Typical. I’m uninstalling VSCode right now. Does it leave any malware behind that can still run things? Probably.

[zeratax]

I feel like vscode is doing everything right here and they cant really do much about users choosing to ignore security warnings. Other IDEs here do exactly the same or less. Not saying there isn't room to improve, but again if you're uninstalling vscode what are you going to replace it with?

[hyperhello]

Hiding malicious behavior behind security warnings you can only click yes or no to is the Microsoft way of neatly denying responsibility, and it compounds and reinforces itself. This pdf looks like a pdf, acts like a pdf, opens like a pdf, what are you going to do? You clicked OK so you wanted that Outlook virus to email itself to everyone on your address book and send their bitcoin to Madagascar, not Microsoft.

[zeratax]

what is the alternative here? never ever running git hooks, lsps etc. all of these are vulnerable. and again no other ide here has a better solution.