Hacker News new | past | comments | ask | show | jobs | submit
AtNightWeCode | on: Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
The core problem is that VScode extensions does not need to be signed at all. Mind boggling stupid design decision.
Rohansi | parent | next
Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
yubblegum | root | parent
Vendor A publishes a public key on their site for authenticating any signature. There is an entire subset of cryptography dedicated to addressing these needs. This is just yet another software player, Cursor, taking the absolutely easy no effort path because otherwise they would be, I don't know, "losers". I mean only losers would setup a basic authenticated provinance for bits of code they are pushing to the world to be executed by all and sundry. Really, this profession has become a complete clown show.
still_grokking | root | parent | next
> Really, this profession has become a complete clown show.

Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!

Let's see where things will move as soon as we have regular product liability for software:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum...

Just a few days left! Looking forward.

loading story #50314223
loading story #50313676
loading story #50312207
LooseMarmoset | parent | next
i work for a large company that’s trying to curate vs code extensions, and this doesn’t make it easy.

we automatically block extensions and require that extensions must be approved, but this is a tedious process.

wombatpm | parent
Is there finally a use for blockchain?
luipugs | root | parent | next
No, that is already solved by gpg.

Stop trying to make blockchain happen, it's not going to happen.

loading story #50313372