Comment by Rohansi
13 hours ago
Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
13 hours ago
Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
Vendor A publishes a public key on their site for authenticating any signature. There is an entire subset of cryptography dedicated to addressing these needs. This is just yet another software player, Cursor, taking the absolutely easy no effort path because otherwise they would be, I don't know, "losers". I mean only losers would setup a basic authenticated provinance for bits of code they are pushing to the world to be executed by all and sundry. Really, this profession has become a complete clown show.
> Really, this profession has become a complete clown show.
Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!
Let's see where things will move as soon as we have regular product liability for software:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum...
Just a few days left! Looking forward.
I'm having trouble understanding what effects that directive could have. Liability under what circumstances and to what degree?
That, and NIS2. Looks like a good trend, hopefully it's not just protectionism.
1 reply →
I don't think even VSCode does this. Probably not even any package managers I know of? Code signing, yes, but not for organization verification? It's pretty much like a username - anyone can claim it if it is unclaimed?
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
This is a solved problem, just look at how EFF's certbot works. You cannot just claim that you are porn.com unless you put a payload there that matches what the bot expects.
2 replies →
> Code signing, yes, but not for organization verification
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
[flagged]