<story><title>VSCode remote code execution advisory</title><url>https://github.com/google/security-research/security/advisories/GHSA-pw56-c55x-cm9m</url></story><parent_chain><item><author>bboygravity</author><text>&amp;gt; Realistically, how often do you need to install brand-new non-standard software?&lt;p&gt;Almost every day. Sometimes multiple times a day in case of a new project &amp;#x2F; new embedded hardware (toolchain) &amp;#x2F; new devkit to &amp;quot;quickly test&amp;quot; &amp;#x2F; tight deadlines, etc.&lt;p&gt;&amp;gt; If it is a regular occurrence then you need a process by which you can request it and the IT team can assess how they manage it.&lt;p&gt;There isn&amp;#x27;t. It has been attempted to get such a process multiple times over the past years. With and without escalation to higher ups all the way up to the CEO. The IT team promises they&amp;#x27;ll speed things up, but a software approval for 1 app still takes at least 3 months. Now what?&lt;p&gt;I&amp;#x27;ll tell you now what: employees and contractors alike just start using their own fully unlocked (perhaps badly updated) machines out of desperation and transfer files to and from locked-down company machines using email or onedrive or whatever other means possible.&lt;p&gt;Maybe better companies exist?</text></item><item><author>edent</author><text>It requires two things.&lt;p&gt;Firstly, an IT team which works &lt;i&gt;with&lt;/i&gt; users rather than against users. That might be as simple as adding all the &amp;quot;core&amp;quot; apps to MDM to ensure they always get patched regularly.&lt;p&gt;Secondly, it requires a development team to realise that just because they&amp;#x27;re good at programming computers it doesn&amp;#x27;t mean they&amp;#x27;re good at administering them. Yes, it sucks that you&amp;#x27;re not allowed to install bonzibuddy.exe from Limewire. But your needs aren&amp;#x27;t more important than protecting the integrity of the network and company.&lt;p&gt;Realistically, how often do you need to install brand-new non-standard software?  If it is a regular occurrence then you need a process by which you can request it and the IT team can assess how they manage it.</text></item><item><author>hn_throwaway_99</author><text>Related question about this, with apologies if this is a dumb question. For small to mid size tech companies (say small startups to 1000 employees), what are the general recommended IT procedures to ensure &lt;i&gt;application&lt;/i&gt; software like this is updated across the company?&lt;p&gt;That is, every company I&amp;#x27;ve worked at has had some form of device management software on their laptops, but that software only ensured that the OS and some specific &amp;quot;managed applications&amp;quot; were always patched. For developers, though, we never had fully &amp;quot;locked down&amp;quot; machines because they made our job so much more difficult (that is, more than other departments we&amp;#x27;d often be installing and running new software).&lt;p&gt;In that case, are there some specific corporate controls to ensure nobody is running an unpatched VSCode, beyond messaging all engineers and saying &amp;quot;you better make sure your VSCode installation is updated, or else...&amp;quot;?</text></item></parent_chain><comment><author>padjo</author><text>Rather than cheat the system to get the project done you probably need to let the project be late and then explain that it was late because IT dragged their feet on app approval. That will make it pretty clear to the powers that be that this needs to be fixed.</text></comment>
<story><title>VSCode remote code execution advisory</title><url>https://github.com/google/security-research/security/advisories/GHSA-pw56-c55x-cm9m</url></story><parent_chain><item><author>bboygravity</author><text>&amp;gt; Realistically, how often do you need to install brand-new non-standard software?&lt;p&gt;Almost every day. Sometimes multiple times a day in case of a new project &amp;#x2F; new embedded hardware (toolchain) &amp;#x2F; new devkit to &amp;quot;quickly test&amp;quot; &amp;#x2F; tight deadlines, etc.&lt;p&gt;&amp;gt; If it is a regular occurrence then you need a process by which you can request it and the IT team can assess how they manage it.&lt;p&gt;There isn&amp;#x27;t. It has been attempted to get such a process multiple times over the past years. With and without escalation to higher ups all the way up to the CEO. The IT team promises they&amp;#x27;ll speed things up, but a software approval for 1 app still takes at least 3 months. Now what?&lt;p&gt;I&amp;#x27;ll tell you now what: employees and contractors alike just start using their own fully unlocked (perhaps badly updated) machines out of desperation and transfer files to and from locked-down company machines using email or onedrive or whatever other means possible.&lt;p&gt;Maybe better companies exist?</text></item><item><author>edent</author><text>It requires two things.&lt;p&gt;Firstly, an IT team which works &lt;i&gt;with&lt;/i&gt; users rather than against users. That might be as simple as adding all the &amp;quot;core&amp;quot; apps to MDM to ensure they always get patched regularly.&lt;p&gt;Secondly, it requires a development team to realise that just because they&amp;#x27;re good at programming computers it doesn&amp;#x27;t mean they&amp;#x27;re good at administering them. Yes, it sucks that you&amp;#x27;re not allowed to install bonzibuddy.exe from Limewire. But your needs aren&amp;#x27;t more important than protecting the integrity of the network and company.&lt;p&gt;Realistically, how often do you need to install brand-new non-standard software?  If it is a regular occurrence then you need a process by which you can request it and the IT team can assess how they manage it.</text></item><item><author>hn_throwaway_99</author><text>Related question about this, with apologies if this is a dumb question. For small to mid size tech companies (say small startups to 1000 employees), what are the general recommended IT procedures to ensure &lt;i&gt;application&lt;/i&gt; software like this is updated across the company?&lt;p&gt;That is, every company I&amp;#x27;ve worked at has had some form of device management software on their laptops, but that software only ensured that the OS and some specific &amp;quot;managed applications&amp;quot; were always patched. For developers, though, we never had fully &amp;quot;locked down&amp;quot; machines because they made our job so much more difficult (that is, more than other departments we&amp;#x27;d often be installing and running new software).&lt;p&gt;In that case, are there some specific corporate controls to ensure nobody is running an unpatched VSCode, beyond messaging all engineers and saying &amp;quot;you better make sure your VSCode installation is updated, or else...&amp;quot;?</text></item></parent_chain><comment><author>octodog</author><text>I work at a bank and I can tell you that nobody is emailing or sharing files to their personal devices. Doing so would have you fired on the spot.&lt;p&gt;At my workplace apps are whitelisted and it&amp;#x27;s honestly not a big deal. Very rarely do I find myself in a situation where I can&amp;#x27;t access the tools that I need.</text></comment>