Comment by orlp
1 day ago
So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.
Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.
I started experimenting with more traditional text editors since last spring and am happy to say, that I’m a happy user of Neovim now.
Does anyone know Microsoft's justification for that policy?
Windows has a builtin keyboard shortcut to open LinkedIn. This is just how they do things.
I thought that couldn't really be true. I was wrong.
https://www.theverge.com/2023/9/15/23874798/microsoft-window...
All I have to say is: lmao
"Of course we don't make mistakes. There's no need to delay our updates."
Wtf. That’s its own scandal
[dead]