[ande-mnoc]

Will Microsoft consider adding a permission model for extensions?

[isidorn]

This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116

We do not plan to add a permission model in the next 6 months.

[yukIttEft]

> We do not plan to add a permission model in the next 6 months.

I guess Copilot functionality trumps "Security above all else" now.

https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...

[fragmede]

Given the enormity of the attack surface that has just been exposed, that's disappointing.

[kobalsky]

Security has been overlooked for way too long for me to trust it at this point.

The only sane way to contain the blast radius is to run is to run code-server in a container (or in a VM) and use it through a browser tab.

Luckily, the UI works perfectly, hotkeys and everything. They did an awesome work there.

[_trampeltier]

There will never be some permission model. Like in VBA there is after all this years nothing. VBA would be much less problematic if you could restrict VBA to just one Excel sheet or so