Comment by syntaxing
4 hours ago
That was a fun read, I wonder if vscode would still load the script if you click “don’t trust author”? That being said, can you embed something yourself and push the commit?
4 hours ago
That was a fun read, I wonder if vscode would still load the script if you click “don’t trust author”? That being said, can you embed something yourself and push the commit?
> I wonder if vscode would still load the script if you click “don’t trust author”
It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712.
But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.
Typical. I’m uninstalling VSCode right now. Does it leave any malware behind that can still run things? Probably.