Comment by ghshephard
13 hours ago
I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:
- Cursor needs to add signing if they want to claim something was "made" by another party.
- Anthropic needs to stamp out any provider from using said, "Made by Anthropic" until they start adding signing to their process. Trademark law is useful here.
Until that happens - it's almost like you have to delete any extension from the Cursor Store off of your Cursor instance - kind of a crapshoot what you are actually downloading, no?
For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?
The core problem is that VScode extensions does not need to be signed at all. Mind boggling stupid design decision.
Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
Vendor A publishes a public key on their site for authenticating any signature. There is an entire subset of cryptography dedicated to addressing these needs. This is just yet another software player, Cursor, taking the absolutely easy no effort path because otherwise they would be, I don't know, "losers". I mean only losers would setup a basic authenticated provinance for bits of code they are pushing to the world to be executed by all and sundry. Really, this profession has become a complete clown show.
10 replies →
i work for a large company that’s trying to curate vs code extensions, and this doesn’t make it easy.
we automatically block extensions and require that extensions must be approved, but this is a tedious process.
Is there finally a use for blockchain?
No, that is already solved by gpg.
Stop trying to make blockchain happen, it's not going to happen.
Using it for voting would probably be useful for the blockchain, but then the downside would be the potential loss of privacy.
You want an AI company to care about IP? And you aren't being sarcastic?