Thread

1. 10000truths · 1790201673 · focus · HN ↗

   So a program that is specifically designed to edit files and run arbitrary commands on a remote machine... can do so. Not sure where the bananas part comes in. Sending a binary over SSH/SFTP might sound weird at first glance, but VSCode can't assume that your remote machine can access the wider internet, and it needs a reliable way to bootstrap the agent on the remote. Shipping it over the SSH tunnel is the natural solution.

   1. bobtheborg · 1790202393 · focus · HN ↗

      I think the actual concern, not well expressed in the blog post, is the fact that node and vscode server are installed on, for instance, a prod machine that (probably) should be very tightly controlled in terms of what software is installed and running. You don't want to unwittingly add to the attack surface

      1. pstuart · 1790202529 · focus · HN ↗

         Fair enough, but running VSCode on a prod machine is also bananas.

         1. Banditoz · 1790202919 · focus · HN ↗

            The assumption being made is VSCode is not running on the prod machine.

Unofficial Hacker News client; not affiliated with Y Combinator.