Programming

Thanks, I've updated the description text.

Software is the leading cause of all computer viruses.

Who is Kate?

Kate the editor? Or is there an IDE called Kate?

Don't think it has anything to do with electron. VSCode is just the largest editor that people install extensions for, so it's what makes the most sense to write malware for. If vim was more popular, I'm sure there would be more crypto mining extensions for that (I wonder how many there are? Surely more than zero?)

Maybe to build one of those shitty websites where you can't select text because every letter is in its own element.

Just that? An open source HTML minifier probably bundled with a miner.

im glad his hand got chopped off

The collaborative sharing nature of these platforms is a big advantage. (Not just VS Code Marketplace. We have this with all extension and lib and program package managers.)

Current approaches revolve around

• reporting
• manual review
• automated review (checks) for flagging or removal
• secured naming spaces

The problem with the latter is that it is often not necessarily proof of trustworthyness, only that the namespace is owned by the same entity in its entirety.

In my opinion, improvements could be made through

• better indication of publisher identity (verified legal entities like companies, or of persona, or owned domain)
• better indication of publisher trustworthiness (how did they establish themselves as trustworthy; long running contributions in the specific space or in general, long standing online persona, vs "random person", etc)
• more prominent license and source code linking - it should be easy to access the source code to review it
• some platforms implement their own build infrastructure to ensure the source code represents the published package

Maybe there could be some more coordinated efforts of review and approval. Like, if the publisher has a trustworthiness indication, and the package has labeled advocators with their own trustworthiness indicated, you could make a better immediate assessment.

On the more technical side, before the platform, a more restrictive and specific permission system. Like browser extensions ask for permissions on install and/or for specific functionality could be implemented for app extensions and lib packages too. Platform requirements could require minimal defaults and optional things being implemented as optional rather than "ask for everything by default".

I can't imagine a sandbox would help. what can an an extension do that doesn't touch some arbitrary code that gets run? it could add a line to the middle of a giant file right before you run and remove it immediately after. even if you run the whole editor in a sandbox you do eventually deploy that code somewhere, it can change something inconspicuous like a url in a dependency file that might not get caught in a pr

the only solution is to audit everything you install, know all the code you run, etc. ofc that's not reasonable, but idk what else there is. better automated virus check things maybe? identity verification for extension publishers? idk if there's an actual solution

The more sandboxed the extension system, the less powerful it is.

You either have an entity that approves of extensions. Or your users have to be very careful and trusting of other people. There's no other way.