If you want on to Microsoft's internal network, CORPNET, publish or own an existing a VSCode extension.
-
@GossiTheDog I realize that this is tangential, but the network is named CORPNET? Really? Are we in a cheap 1980s techno-thriller?
@maccruiskeen that's the main AD domain, yep. Keep in mind MS is an 80s company
-
RE: https://hachyderm.io/@ChrisShort/116606591908387955
If you want on to Microsoft's internal network, CORPNET, publish or own an existing a VSCode extension.
The Visual Studio Code Marketplace, which Microsoft own, is completely uncontrolled.
Anybody can publish an extension, it provides code execution on endpoints, extensions auto update by default, "verified" blue tick extensions just need any domain registration, and there's no endpoint security controls at all around what users can install.
VSCode is an absolute security shittip as a result.
@GossiTheDog One of the top 10 extensions, with 73 million downloads, looks like its owned by a single dev on his personal github account.
I wonder how many fishing attempts he gets per day.
-
@GossiTheDog And this is why my work PC is locked down so tight I can't even make and run my own batch files, let alone anything .exe. The organisation actually practices the Essential Eight.
@ingram you can probably install VSCode
-
@maccruiskeen that's the main AD domain, yep. Keep in mind MS is an 80s company
@GossiTheDog@cyberplace.social @maccruiskeen@social.linux.pizza also, this is the company that chose to call a flagship product family .NET
-
Also - if you think 'none of our users run VSCode', check your telemetry. They do. It doesn't even need local admin rights to install.
I've tooted about this one for about two years now, Microsoft have created their own security bonfire and it's going off in their own backyard, they just haven't realised yet.
@GossiTheDog lol MS didn't even follow their own guidelines
-
@maccruiskeen that's the main AD domain, yep. Keep in mind MS is an 80s company
@GossiTheDog @maccruiskeen is it pronounced corEnet or corPnet?
-
P pelle@veganism.social shared this topic
