alt Hacker NewsSo if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
Replies
delis-thumbs-7e • yesterday at 1:39 PM
I started experimenting with more traditional text editors since last spring and am happy to say, that I’m a happy user of Neovim now.
CoastalCoder • yesterday at 1:07 PM
Does anyone know Microsoft's justification for that policy?
➕ show 2 replies
dgellow • yesterday at 1:23 PM
Wtf. That’s its own scandal
sick_of_slop • yesterday at 11:20 PM
[dead]
If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.
Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.