news.volyx.in

VSCode’s SSH agent is bananas (fly.io)

737 points by zdyxry · 542 days ago · 511 comments on HN

Article summary

The article discusses the author's concern with VSCode's SSH agent, which they believe is overly invasive and poses security risks. The agent runs a full-scale installation of Node.js and establishes a WebSocket connection back to the VSCode frontend, allowing for extensive system access capabilities. The author compares this to Emacs' Tramp, which uses existing SSH access to copy files back and forth without installing anything. The author's goal is to integrate their product into VSCode's remote editing flow, but is hesitant due to security concerns.

Main themes

  • VSCode SSH agent security
  • Remote editing and development
  • LLM integration
  • Security risks and vulnerabilities
  • Comparison to Emacs Tramp

What commenters say

  • VSCode's SSH agent poses significant security risks due to its extensive system access capabilities and potential for exploitation.
  • The use of a remote agent is necessary for features like running extensions that aren't installed locally, but this comes with security trade-offs.
  • Alternative editors like Zed and Eclipse Theia may offer similar functionality to VSCode without the same security concerns, but may also have their own drawbacks.
  • The need for a standardized feature set for remote editing and development is highlighted, with some arguing that this could be provided by the operating system itself.
  • Some commenters believe that VSCode's design and functionality are intentionally geared towards suffocating open-source alternatives and promoting Microsoft's own technology.
  • Others argue that the security risks associated with VSCode's SSH agent are not unique to the product and can be mitigated with proper configuration and precautions.
  • The use of a remote agent can be seen as a necessary evil for achieving certain development goals, such as integrating LLMs into the development process.
  • There is a desire for a more secure and open-source alternative to VSCode that can provide similar functionality without the same security risks.