True, it’s a private (not local) IP. It could easily have connected to a remote system, as their proof-of-concept did.
This code execs cmd.exe and pipes output to and from a hardcoded IP. That’s pretty weird. What’s running on that IP? How does the extension know something is there?
It looks like VS Code has no review — human or automated — or enforced entitlement system that would have stopped this or at least had someone verify it was legit.
Their findings included an extension that opens an obvious reverse shell.
It’s nice that this is compatible with Redis clients, and even Redis cluster operations. But I wish they would take this opportunity to make scaling more ergonomic. The Redis cluster mode is a pain to use because certain commands don’t work on a cluster (and developers don’t seem to realize this, leading to implementation issues).
It’s better now. No more bottles and kegs. This time it’s barrels, vintages and terroirs.
This makes a lot of sense if you’re delivering static content. Cloudflare even has the Super Slurper which serves your S3 content and migrates it seamlessly to Cloudflare’s competitor R2 service, after which your egress is free.
Is it a blunder? Tell that to Apple, Jetbrains, or Microsoft, each of whom have proprietary code editors that net billions of dollars of revenue.
It’s true, VS Code is open source, but it is developed almost entirely by Microsoft, by a large team of paid full-time programmers, designers, and PMs. It may be the most-used text editor in the world, but it isn’t developed by a team of volunteers who materialized around it because it was open source.
Instead, consider that making something open source is often just a marketing strategy — or a soft way to sunset a project.
This is a nice editor. I don’t like the comparisons to Atom since some of us remember that as “the really bloated and slow predecessor to VS Code”. Whereas Zed is quite small and fast. Opening a shell panel is instant and makes VS Code feel slow.
Its strength is multi-user (their term: multiplayer) shared editing spaces. It also has quite good AI integration and supports Github Copilot too.
I am a little concerned that they started off commercial and then went open source. Open source is great! But this path sometimes means that the original developers no longer have the time/money/interest to keep developing it. I hope that’s not the case here because they’ve got the start of something good.
Unfortunately, Apple has the resources, both legal and financial, to tie that up in the EU courts for decades.
Who would’ve thought? This isn’t going to fly with the EU.
Article 5.3 of the Digital Markets Act (DMA): “The gatekeeper shall not prevent business users from offering the same products or services to end users through third-party online intermediation services or through their own direct online sales channel at prices or conditions that are different from those offered through the online intermediation services of the gatekeeper.”
Apple has an annual legal budget of approximately infinity dollars. I assure you they are aware of this and they believe they are in compliance, even if just barely.
If challenged, they will have no problem fighting it — they have nearly as much cash on hand as the entire EU budget.
I hope the EU challenges this, and I hope the EU wins, but Apple isn’t going to be surprised by whatever happens.
deleted by creator
Although Firefox on iOS doesn’t support extensions, other browsers do.
Orion supports Firefox extensions.
Safari also has tons of extensions available, such as: StopTheMadness (annoyance blocker, highly configurable), AdGuard (ad blocker), Vinegar (blocks YouTube ads on the web), and many others.
“I implemented the FizzBuzz algorithm in only 10 million lines of code!”
There’s no way Apple lets the automaker access app data from your phone. Apps on the phone can’t even see data from other apps on the phone.
There are two ways I can think of for the infotainment to get the messages. The first is by OCR-ing the CarPlay screen, which is shady as hell. The second is a feature like this one where the car has Bluetooth notification integration.
I have not. As someone in the Mac community I can tell you that Apple enthusiasts are Apple’s harshest critics. They are the type of people who care a lot about details like this, and have been criticizing Apple for years on the amount of RAM in entry level systems, as well as the absolute rip-off prices they charge for RAM upgrades.
deleted by creator
And of course there have been forges launched, including SourceHut, Gitea, Gogs, Forgejo…
It would be interesting to see what the difference is. The slim image doesn’t even have vi installed, although it does have bash. And of course, git, etc. are not present. Much of the difference could be the size difference between musl and libc, and the size difference between apk and apt metadata.
I don’t think OP is going to find a non-musl distro as small as Alpine. These stripped-down Debians are a lot bigger, but among the smallest non-Alpine that you’ll find.
Standard node images are around 1 GB. node:lts-alpine is about 176 MB. So it’s fairly close to alpine in this case.
What runtime do you need? If it’s Node.js, the “slim” Docker images are lightweight and based on Debian. (for example node:lts-slim)
This draft spec was eventually published as RFC 9562. Compared to the previous spec it adds versions 6, 7, and 8, plus best practices guidance.
Basically, there are a bunch of UUID alternatives that arose to fix the problem that UUIDs are bad for use as database keys in large tables (here’s the perspective of MySQL experts Percona). A bunch of these alternatives are actually linked from the RFC, which I haven’t seen done before. Version 7, in particular, is meant to address this use case.