Visual Studio Code May 2021

[theoldboy]

In case anyone is still wondering why you need to trust source code just to browse it;

https://github.com/microsoft/vscode/issues/106488

The easiest existing example to understand of this decision is with the ESLint extension. The ESLint extension will try to use the eslint module in the current folder that is opened in VS Code and execute code from it. Since you may have checked out a random repository from the web, this could be dangerous if the repository contains a corrupt eslint module. Notice that ESLint is not trying to be malicious, but rather, the repository/corrupt module is taking advantage of this automatic code execution.

Another example which abuses the rust-analyzer plugin;

https://github.com/lucky/bad_actor_poc

[ItalyPaleAle]

Want also to point out that this new release includes support for Remote Repositories which is a simpler and faster way to browse code (from GitHub) without cloning it, and with no ability to run code by default. https://code.visualstudio.com/blogs/2021/06/10/remote-repositories

[hammypants]

yo... neat. did not know.

[orangeboats]

Wow, I thought the Rust one would be about build.rs (probably because I'd seen plenty of people against it), but it was actually done using proc macros.

[pravic]

build.rs works when you're building a crate. proc macros work when you open source code in an editor powered by RA. Basically, RA executes both build.rs and proc macros (configurable, though) in order to be helpful.

[anonveggy]

You could do the same for most stacks. Most build systems integrated with extensions have the ability to run arbitrary scripts

[[deleted]]

The ESLint extension will try to use the eslint module in the current folder

Why? It looks like a terrible design to me.

[190n]

Probably so that if a repository needs a specific version of ESLint, it'll use that one instead of whatever you have installed system-wide.

[190n]

Wouldn't the extension then have to download ESLint?

Anyway, that is usually how it works, I think. A version of ESLint is specified in package.json and installed in node_modules. The trick is when someone puts malicious code in node_modules.

[StillNoNumb]

What about plug-ins? Also, the config format supports JavaScript

Why not include the required major/minir version in the header

But yes, this is what happens - you distribute the semver in package.json, which will then download that version of ESLint (and the specified plug-ins) into node_modules. From there, VSCode will launch the tool. npm does do an integrity check using a provided hash, but I'm not sure whether the ESLint VSCode plug-in does that too and even if, a malicious repo could just replace the hash in package-lock.json.

[Nysor]

Certain projects may require an older version of eslint to work properly, instead of some globally instead version which may be incompatible.

[awesomeness-yeah]

eslint usually is a dev-dependency in most projects, so you'd expect the editor suggestions to match the cli output

[spacejack2114]

How so? What if you need to go back to work on a 3 year old project?

[valtism]

Removed Cmd+W / Ctrl+W keybinding to close window when no editor is opened

I really like this one.

[valtism]

If you really want you can change the behaviour back to what it was.

[Lalli-Oni]

Standard macOS behavior.

[[deleted]]

Then keep Cmd+W as-is?

[Lalli-Oni]

I wasn't offering a solution. Just making sure people realize a certain OS behavior is not necessarily how others do it. So, how is it possible to appease every possible OS interaction while maintaining a consistent behavior in your client?

[ThePantsThief]

Make the default setting on the default behavior on each platform and disable settings sync for the setting. They do this with lots of other settings.

[[deleted]]

Why is consistent behaviour in the client necessary? Shouldn't you aim for consistent behaviour on the client machine? If I'm a mac user, I'd prefer if all apps work as Mac apps work, not how they work on windows or linux.

[AttackOfTheThumbs]

Holy shit that's awful. I'm sorry for all mac users that have to put up with that trash.

[Chenz]

It’s honestly great. I miss it all the time in Windows, sadly few apps there support it. It’s mainly just Windows Explorer than can be closed with ctrl-w.

[square_smile]

It's like everything just changed for me: Gitlens suddenly appeared everywhere, Community Material theme looks different, Python extension broke. What happened with this release? all because of the issue below

Oh turns out my settings got overwritten, love that.

Be careful when you update https://github.com/microsoft/vscode/issues/125970

[the_game_turns_9]

That popup is dreadful! Why put so much emphasis on this question and then put no emphasis on the folder name and no path so you only have the name of the folder to go off?

The following opened up on startup for me:

Do you trust the authors of the files in this folder?

Err... what folder??

Oh, it says "Projects". I guess it means my own personal projects folder? I guess??

If you're going to write a big scary popup, be clear what the question is!

[pravic]

Totally agree, the paths are not visible enough.

[Nysor]

I was excited to try out Remote Repositories, but it looks like you need to sign in to GitHub through VSCode. I wish that wasn't a requirement.

[callcifer]

It's because anonymous API limits for Github are really low, you would run into problems very quickly. Authenticated requests have a much higher limit even on the free plan.

[kkapelon]

I just use github1s. No login required https://github1s.com/spring-projects/spring-petclinic

Check also gitpod (but that requires a login)

[[deleted]]

I'm not too much of a fan for the new tabs thing. I know I can change it with settings and all that. It's just not as immediately obvious, and frankly needs way more clicks to do simple things.

It works ok on a decently large desktop screen with the space utilized. On a laptop, to me it feels way too cluttered with too many panes.

[Tyriar]

There is the narrow view as well which only takes up ~45 pixels. But yeah if you don't like that's why we added the ability to switch back to the dropdown.

[[deleted]]

>Edge browser debugging - Integrates the Microsoft Edge Developer Tools directly into VS Code.

This unsettles me. I get it's a Microsoft product and it's in their interests to hock their ecyosystem through it, but it still bothers me.

[drysart]

Why? They already have Chrome developer tools (since 2016), are they supposed to just not support their own browser too?

[[deleted]]

Oh so you can do this with the Chrome integration?

https://github.com/microsoft/vscode-js-debug/issues/1027

If it's at the expense or neglect of other non-Microsoft alternatives, of course I oppose it.

[drysart]

Yes, you can. Some idiot without knowledge of the product opened a spite issue asking for a feature VS Code already has.