Issue #113 (VS Code Extension Security)06/19/24
Workshop: Frontend Issues with Backend Solutions
Frontend issues are often triggered by backend problems. Join us as we discuss common sources for poor web vitals and how to use Tracing to connect issues through your stack at the code-level.
|
|
|
|
Once in a while there always seems to be some talk about how insecure VS Code extensions are and how easy it is for extension developers to secretly push malware to users. Last week I featured an article on this subject and there's another one linked below that summarizes some of these problems.
For example, you might install an extension but eventually the ownership may change or the owner becomes malicious. A subsequent update may push something to your system that's harmful or invades your privacy.
One way you can minimize the chances of this happening is by turning off automatic updates on extensions. Search for the word "update" in your settings and you'll notice the top three results are related to extension updates and VS Code updates in general.
If you're concerned about all updates, you can disable all update checks by unchecking the setting
"Auto Check Updates". That might be overkill, so instead you can change the
"Auto Update" setting to a value of "none", which allows you to manually update your extensions.
Once this is changed, you can still allow specific extensions to auto-update if you trust them. Go to your installed extensions, then click the extension you want to 'trust', and you'll notice there's now an empty check box you can tick that tells VS Code that you want to update this extension automatically.
You can use the little cog icon to choose
"Auto Update All (From Publisher)" which will allow this specific extension to be automatically updated.
And one last thing I'll mention here is a quote from the VS Code docs on the topic of extension security, where they answer the question
Can I trust extensions from the Marketplace?
"The Marketplace runs a virus scan on each extension package that's published to ensure its safety. The virus scan is run for each new extension and for each extension update. Until the scan is all clear, the extension won't be published in the Marketplace for public usage."
There's more info on that page about the potential for 'name squatting' and a few other points. So it does seem that, for the most part, Microsoft is doing what they can to ensure the safety of the extensions.
Now on to this week's hand-picked links!
