2

I've been using VS Code for a year or so now. I have no idea how VS Code Extension security is handled. I'm alarmed by things like this:

Some questions I have are:

  • What does Microsoft do to ensure Extensions we install are safe?
  • Are they scanning the Extensions for known vulns?
  • Is VS Code safe to use in an Enterprise Environment?
  • How can I tell?
  • Why are duplicate extension names allowed!
    • There are security and marketing implications by Microsoft allowing "package-squatting".

Does anyone have insights to share regarding VS Code Extension Security?

SeaDude
  • 3,725
  • 6
  • 31
  • 68
ericOnline
  • 1,586
  • 1
  • 19
  • 54
  • 1
    [*"**Extensions.** The software gives you the option to download other Microsoft and third party software packages from our extension marketplace or package managers. Those packages are under their own licenses, and not this agreement. Microsoft does not distribute, license or provide any warranties for any of the third party packages. By accessing or using our extension marketplace, you agree to the extension marketplace terms located at https://go.microsoft.com/fwlink/?LinkID=266231."*](https://code.visualstudio.com/license) – jonrsharpe Mar 12 '19 at 16:54

1 Answers1

1

Hm. Unfortunately, the link to "extension marketplace terms" that @jonrsharpe provided does not include the word "extension". If you extrapolate VS Code Extensions to be covered by the Azure Marketplace terms (as alluded to in the text), then you get this little tidbit:

https://azure.microsoft.com/en-us/support/legal/marketplace-terms/

Publisher Privacy Policies. Publishers are responsible for providing privacy statements that describe their privacy practices with respect to Customer Data collected by their Offerings or any customer information that they receive from Microsoft. Unless indicated otherwise in connection with a Marketplace Offering published by Microsoft, Microsoft’s privacy, security, and data location and data retention policies will not apply to any Marketplace Offering or to Publishers’ use of any Customer Data or other customer information.

In short "...Microsoft's privacy, security...policies will not apply to any..." VS Code Extensions OR to "...Publishers' use of any Customer Data or other customer information."

Microsoft does NOT handle VS Code Extension Security.

ericOnline
  • 1,586
  • 1
  • 19
  • 54