[GoLUG] PSA for VSCode: SSH plugin lets the remote end run arbitrary local commands

[Bradley D. Thornton]

Hi Kyle!

On 9/26/26 4:05 PM, Kyle Terrien wrote:
> Honestly, this is scary, and I think I may need to install VSCode to
> test this myself.  (I’m a happy GNU Emacs user.)

Then you must be referring to VSCodium (/usr/bin/codium)?! Right?

I do envy you Emacs guys, and yeah... after all these years I'm still 
promising myself I'm gonna take a week to just follow along with that 
guy on YouTube who builds an entire environment from scratch - even 
though I really only see myself using Org Mode and eVil Mode... I'm not 
even sure if that's how people use the caps on that one but yes, guilty, 
Vim guy here. I'm just fine w/ksh & Elvis, but I honestly never even 
thought about installing an SSH plugin on VSCodium. Is it supposed to 
give me something in addition to what I already have in the Terminal 
inside VSCodium or the shells I'm running in my terminal w/tmux?

I do avail myself of the Git capability in Codium but even then, the 
remote Origin is usually my own self-hosted Forgejo server, although I 
do contribute some stuff to GitHub repos. It works just the same for 
Origins on remote UNIX boxes without HTTP based forge software.

I must be missing something.

> I always thought
> VSCode handled SSH remote editing poorly (by copying over that big
> binary), but this is in the category of “broken by design”.  Why can’t
> they at least use a domain socket, which is subject to Unix
> permissions?

Yeah I'm definitely missing something. Why would I need to do such a 
thing When I've got my favorite terminal "Gnome-Terminator" standing by 
whenever I want to SSH into a remote box?

Yeah, I'm prolly not going to find out coz I don't think my business 
process includes an SSH plugin for Codium.

> 
> Also, check out all the users on Hacker News who can’t tell the
> difference between

Thanks for my daily ROFL there :) but I remember almost two years into 
my career as a developer in 1979, the part of it where I was still 17yrs 
old, being instantly humbled when I went to lunch with a couple of 
"CE's" who I discovered (much to the chagrin of my ego) had likely 
forgotten more than I would ever learn, as they reminisced about having 
to know how many wraps on a toroid you needed to make in order to 
rebuild memory on a particular machine.

Your just denigrating (mostly) spoiled children (and deservedly so) who 
want to how ferocious they are when pounding their chests. 
Unfortunately, unlike us, who realize that SAIL began in 1963, and by 
the 80's the state of Artificial Intelligence was such that it could see 
three to four moves ahead on a 286 and beat many good chess players; 
these guys who don't know Devo's Secret Agent Man from Agent 86 or 
Agentic are a rather scary lot of narcissists and one day, one of them 
just may be the one to execute the script: `~$ ./kill_sarah_connor.sh`.

It's good seeing a post from you Kyle, enjoy the rest of your weekend 
and I'm still determined to do a self-immersion program in Emacs... soon :)

Kindest regards,

-- 
Bradley D. Thornton
Manager Network Services
https://NorthTech.US
Key available at:
https://keyoxide.org/A0E3913390670CCE

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xA0E3913390670CCE.asc
Type: application/pgp-keys
Size: 6949 bytes
Desc: OpenPGP public key
URL: <http://golug.org/pipermail/golug_golug.org/attachments/20260926/84ebec1d/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <http://golug.org/pipermail/golug_golug.org/attachments/20260926/84ebec1d/attachment-0001.sig>