Thread

VSCode's SSH Agent Is Bananas (2025)

310 points · 218 comments · Rapzid

10000truths · 1790201673 · focus · HN ↗
So a program that is specifically designed to edit files and run arbitrary commands on a remote machine... can do so. Not sure where the bananas part comes in. Sending a binary over SSH/SFTP might sound weird at first glance, but VSCode can't assume that your remote machine can access the wider internet, and it needs a reliable way to bootstrap the agent on the remote. Shipping it over the SSH tunnel is the natural solution.
1. bobtheborg · 1790202393 · focus · HN ↗
  I think the actual concern, not well expressed in the blog post, is the fact that node and vscode server are installed on, for instance, a prod machine that (probably) should be very tightly controlled in terms of what software is installed and running. You don't want to unwittingly add to the attack surface
  1. pstuart · 1790202529 · focus · HN ↗
    Fair enough, but running VSCode on a prod machine is also bananas.
    K0IN · 1790202746 · focus · HN ↗
    agree, but do you think every dev you know konws this?
    also "i just want to edit a config file and i want a nice ui", is how you get there.
    doc_ick · 1790203560 · focus · HN ↗
    Expecting vscode to police every single dev using it instead of a company is bananas.
    jasomill · 1790212772 · focus · HN ↗
    The very first page[1] of the VSCode remote documentation makes it perfectly clear that VSCode remoting is more akin to running an Emacs server on the remote than TRAMP.
    [1] <a href="https://code.visualstudio.com/docs/remote/remote-overview" rel="nofollow">https://code.visualstudio.com/docs/remote/remote-overview
    brabel · 1790250340 · focus · HN ↗
    Aha, thanks for explaining it in terms I can understand !
    jayd16 · 1790264883 · focus · HN ↗
    Every dev with ssh keys into prod should know it.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.