Comment by jasode

18 days ago

reply to multiple comments :

mjdv : > it wasn't clear to me that just opening and trusting a directory

andy_ppp : >obviously I wasn’t explicit enough in explaining I’m talking about code execution simply by opening a directory.

Understandably, there's a disconnect in the mental model of what "opening a folder" can mean in VSCode.

In 99% of other software, folders and directories are purely navigation and/or organization and then you must go the extra step of clicking on a particular file (e.g. ".exe", ".py", ".sh") to do something dangerous.

Furthermore, in classic Visual Studio, solutions+projects are files such as ".sln" and ".vcsproj" or a "CMakeLists.txt" file.

In contrast, VSCode projects can be the folders. Folders are not just purely navigation. So "VSCode opening a folder" can act like "MS Excel opening a .xlsm file" that might have a (dangerous) macro in it. Inside the VSCode folder may have a "tasks.json" with dangerous commands in it.

Once the mental model groks the idea that a "folder" can have a special semantic meaning of "project+tasks" in VSCode, the warning messages saying "Do you trust this folder?" make more sense.

VSCode uses "folders" instead of a top-level "file" as a semantic unit because it's more flexible for multiple languages.

To re-emphasize, Windows File Explorer or macOS Finder "opening a folder" do not run "tasks.json" so it is not the same behavior as VSCode opening a folder.

7 comments

jasode

Reply
EGreg  18 days ago

Oh man! Microsoft was the #1 company with this problem for over 25 years and they still do it?

Word and Excel “MACROS” used to be THE main vector for kiddie viruses. Come on M$ … billions of dollars and you’re still loading up non-interactive code execution in all your documents that people expect to be POD (Plain Old Data)?

https://support.microsoft.com/en-us/office/protect-yourself-...

Is it so much to ask for your software to AT LEAST warn peole when it’s about to take a destructive action, and keep asking until the user allows that class of thing non-interactivlely ONLY FOR THAT SIGNED SOFTWARE?

Apple does other software things really badly with their millions of dollars, but they get Privacy RIGHT: https://www.youtube.com/watch?v=XPogdNafgic

  • WorldMaker  18 days ago

    VS Code does exactly that, warns before loading this non-interactive code. It warns you loudly, with an ugly modal dialog, on opening a new to it folder and suggests Restricted Mode. A lot of the arguments here relate to:

    1) This loud warning is easy to ignore, despite how loud it is

    2) This loud warning is easy to disable, which many desire to do because it is very loud

    3) This loud warning is easy to build bad habits (instead of marking safe parent folders, continually clicking Allow and training yourself to only click Allow)

    4) Restricted Mode sounds "too restricted" to be useful (though it isn't too restrictive and is very useful)

    5) Restricted Mode is also loud to remind you that you are in it, so many users think it is too loud and never want to be in it (despite it being very useful)