Notices by Greg Slepak 🐢 (taoeffect@mstdn.io)

DoS attack against #GPG / #OpenPGP. Will likely only get worse.

RT https://twitter.com/lobsters/status/1145036770691563520

SKS Keyserver Network Under Attack
https://lobste.rs/s/lyjs3a #crypto #security

It downloads who knows what code and injects it into the built product:

https://github.com/Microsoft/vscode/blob/67cd9258fd0ed429ddc626d488d48bd65c2f2283/build/lib/extensions.ts#L108

Meaning, the source code in the git repo isn't the only thing that your "custom built" VSCode instance will be running.

Shady Microsoft doing shady things.

Something tells me this will blow up in their user's faces. #vscode

#NeverTrustMicrosoft

Upon installing #VSCode ("insiders edition", their nightly build), it:

- Immediately opened my web browser without my permission and instantly loaded a URL with various parameters (what did it just send to Microsoft?!)

- Tried to connect to at least 4 different domains, including one for "bing search results" when I tried searching *inside the text editor*

- Still continued to connect to 3 domains, including Bing search, after I disabled all "telemetry" settings

Not worth it.