Hacker News Reader

Comment by echoangle | Hacker News Reader

The message displayed when asking if you want to trust the directory is pretty clear about it.

https://code.visualstudio.com/docs/editing/workspaces/worksp...

I don't like the way it is handled. Imagine Excel actively prompting you with a pop up every time you open a sheet: "Do you trust the authors of this file? If not you will loose out on cool features and the sheet runs in restricted mode"

No it doesn't because restricted mode without Macros is the default and not framed like something bad or loosing out on all of those nice features,

The point of an IDE is that it does stuff a simple text editor does not.

Sure, but as noted elsewhere, the IDEs generally don't "do stuff" by default just on opening a file folder. VSCode, by default, will run some programs as soon as you open a folder.

> the IDEs generally don't "do stuff" by default just on opening a file folder

In any JetBrains IDE: Settings > Tools > Startup Tasks.

Even something as simple as syntax highlighting is a vector.

I think Excel does do something similar though with Protected View. https://support.microsoft.com/en-us/office/what-is-protected...

Exactly that's why I was making the comparison, It's not a in your face PopUp, where users get used to just pressing the blue, highlighted and glowing "I trust the authors" button without even being told what features they'd miss out on.

The Protected view in Office instead tells you "Be careful" and to only activate editing when you need to.

It's also worth noting that this behavior evolved very slowly. It took Excel decades to learn how to best handle the defaults. Excel started with modals similar to VS Code's "Do you want to allow macros? This may be dangerous", found too many users self-trained on "Allow" as the only button that needed to be pressed and eventually built the current solution.

If VS Code is still on the same learning curve, hopefully it speeds up a bit.

Right, I think one of the biggest problems is the name "Restricted Mode" itself. It sounds like a punishment, when it is a safer sandbox. Restricted Mode is great and incredibly useful. But it is unsurprising how people don't like to be in Restricted Mode when it sounds like a doghouse out back, not a lobby or atrium on the way to the rest of the building.

It's worded really badly, so vscode is the thing that provides the dangerous features? No problem, I know and trust vscode. What the message should be warning about is that the folder may contain dangerous code or configuration values that can execute upon opening due to vscode features that are enabled by default. That sounds worse for them but that would be honest.

But you, as a security conscious software developer, know that the phrase "may automatically execute files" can also be "with malicious intent" - the tradeoff that whoever made the text (and since it's open source it's likely been a committee talking about it for ages) had to make is conciseness vs clarity. Give people too much text and they zone out, especially if their objective is "do this take home exercise to get a job" instead of "open this project carefully to see if there's any security issues in it".

This problem goes back to uh... Windows Vista. Its predecessors made all users an admin, Vista added a security layer so that any more dangerous tasks required you to confirm. But they went overboard and did it for anything like changing your desktop background image, and very quickly people got numb to the notice and just hit 'ok' on everything.

Anyway. In this particular case, VS Code can be more granular and only show a popup when the user tries to run a task saying something like "By permitting this script to run you agree that it can do anything, this can be dangerous, before continuing I'm going to open this file so you can review what it's about to do" or whatever.

The message, at least for me, does not convey that merely opening may lead to code execution.

Really? "May automatically execute files" suggests to me that at least code could execute without me taking any further explicit action.

Other IDEs do this too btw

Reply on news.ycombinator.com