VS Code Remote SSH

“VSCode remote ssh exposes your host to attack from the sandbox”

“VS Code has had a working remote SSH plugin for almost a decade now”

“It also has some unfortunate OS / glibc minimums which means that it's growing less useful as time goes on.”

“it is a great tool when operating in a trusted circle”

“It also fills up the hard drives on shared server, where each user up to 5 GB of vscode nonsense.”

“It's like giving away a gun that explodes in your face if you shoot it in anger”

“if your latency is higher than 30-50ms, since VSCode's SSH agent streams the files to your computer, the typing experience feels snappier”

“filled the disk and crashed/hung the Pi by using all the RAM”

“This is what makes it bananas for me. I don't know what Microsoft is thinking if they allow this.”

“The remote can use it to run code on the local machine as well, exactly what the "sandbox" pattern was supposed to prevent.”

“the editor buffers are local and the editor UX as a whole is local on your machine”

“A surprise waiting to happen if you Remote SSH into an agent sandbox.”

“And it doesn't work on BSD, and fails in an opaque way when it tries.”

“It also makes your local client an extension of the remote box. That is going directly against expectations for remote access.”

“A remote access protocol that gives a potentially untrustworthy remote system the ability to execute arbitrary code on the local machine is a serious problem”

“It allows me to connect to my dev environment (remote box) from any PC”

“I've been using it daily since it came out.”

“Of course, it is a pity Microsoft doesn't open source it.”

“it doesn't pick up the MotD, preventing me from showing users important messages”

“it auto-installed node, npm, and hundreds of megabytes of npm packages”

“The problem is the remote host has control over local host through the protocol.”

“there is an SSH agent at all, whereas Emacs just uses the built-in Bourne shell”

“You don't want to unwittingly add to the attack surface”

“At the cost of a proprietary binary blob on the remote end”

“allows the remote system to modify files and execute code on the local/frontend system”

“The reverse direction, where a compromised remote can do whatever it wants to my local machine, is not.”

“I'd probably prefer if VS Code simply ran ed/vim remotely, but both of those editors can invoke shell anyhow”

“VSCode's SSH Agent is a godsend for remote development”

“VScode has a really efficient protocol that communicates only that's required”

“I just use it via my browser.”

“use VSCode with the Remote SSH extension, which will give you the file browser UI etc.”

“The integrated terminal pretty much makes this as smooth an experience as working locally.”

“got sick and tired of the vscode instability and frequent need to blow away state / reinstall plugins after updates”

“The VSCode remote ssh implementation is a bit concerning”

“Easiest way to do it would be enable ssh in container and then use VSCode ssh extension.”

“I use VSCode’s remote SSH specifically so that code editing doesn’t suck.”

“A compromised remote could use the VS Code Remote connection to execute code on your local machine.”

“It's the primary way I work on remote servers. Takes a few seconds to start up, but then it's just as if I'm working locally.”

“VSCode over SSH is one of the best ways to develop on various SBCs.”

“VSCode over SSH kinda rocks honestly”