Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
Vendor A publishes a public key on their site for authenticating any signature. There is an entire subset of cryptography dedicated to addressing these needs. This is just yet another software player, Cursor, taking the absolutely easy no effort path because otherwise they would be, I don't know, "losers". I mean only losers would setup a basic authenticated provinance for bits of code they are pushing to the world to be executed by all and sundry. Really, this profession has become a complete clown show.
> Really, this profession has become a complete clown show.
Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!
Let's see where things will move as soon as we have regular product liability for software:
Despite that I also think that this is the right and long overdue move on the EU side. We need to break the basic pattern that nobody cares as long as the responsible effectively never get the bill when they mess up.
Software is "Unsafe at Any Speed" [ https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed ] to bring a striking analogy — even we have since about 60 years the tech to build software which provably (in the mathematical sense) matches its specification. Still what you have on the market is utter garbage, and instead of getting better it gets currently actually worse with lowering the garbage quality level even more with "AI" slop. That EU legislation could become the escape hatch; that's why I'm looking forward.
I don't think even VSCode does this. Probably not even any package managers I know of? Code signing, yes, but not for organization verification? It's pretty much like a username - anyone can claim it if it is unclaimed?
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
This is a solved problem, just look at how EFF's certbot works. You cannot just claim that you are porn.com unless you put a payload there that matches what the bot expects.
And force everyone who wants to publish an extension to buy and manage a domain name? What if it expires? You're just replacing one set of problems with another.
> Code signing, yes, but not for organization verification
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
Vendor A publishes a public key on their site for authenticating any signature. There is an entire subset of cryptography dedicated to addressing these needs. This is just yet another software player, Cursor, taking the absolutely easy no effort path because otherwise they would be, I don't know, "losers". I mean only losers would setup a basic authenticated provinance for bits of code they are pushing to the world to be executed by all and sundry. Really, this profession has become a complete clown show.
> Really, this profession has become a complete clown show.
Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!
Let's see where things will move as soon as we have regular product liability for software:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum...
Just a few days left! Looking forward.
I'm having trouble understanding what effects that directive could have. Liability under what circumstances and to what degree?
That, and NIS2. Looks like a good trend, hopefully it's not just protectionism.
Well, if something than it's "anti-protectionism".
This is going to cause some major argument between the EU and the US, maybe even a trade war. Trouble is already underway:
https://www.reuters.com/legal/government/us-lawmakers-urge-t...
Despite that I also think that this is the right and long overdue move on the EU side. We need to break the basic pattern that nobody cares as long as the responsible effectively never get the bill when they mess up.
Software is "Unsafe at Any Speed" [ https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed ] to bring a striking analogy — even we have since about 60 years the tech to build software which provably (in the mathematical sense) matches its specification. Still what you have on the market is utter garbage, and instead of getting better it gets currently actually worse with lowering the garbage quality level even more with "AI" slop. That EU legislation could become the escape hatch; that's why I'm looking forward.
I don't think even VSCode does this. Probably not even any package managers I know of? Code signing, yes, but not for organization verification? It's pretty much like a username - anyone can claim it if it is unclaimed?
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
This is a solved problem, just look at how EFF's certbot works. You cannot just claim that you are porn.com unless you put a payload there that matches what the bot expects.
And force everyone who wants to publish an extension to buy and manage a domain name? What if it expires? You're just replacing one set of problems with another.
You could make it a requirement only for people who want to attribute “made by”. If you publish a no name extension, you could skip it.
> Code signing, yes, but not for organization verification
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
[flagged]
i work for a large company that’s trying to curate vs code extensions, and this doesn’t make it easy.
we automatically block extensions and require that extensions must be approved, but this is a tedious process.
Is there finally a use for blockchain?
No, that is already solved by gpg.
Stop trying to make blockchain happen, it's not going to happen.
Using it for voting would probably be useful for the blockchain, but then the downside would be the potential loss of privacy.