FilterHN

The code base for VSCode seems to be huge. With plug-ins, bloat, all the different things that it does, and large number of installations, it seems an ideal target for vulnerabilities and supply chain attacks.

Anyone knows more the level of risk?

▲

criemen

10 hours ago

[-]

> For obscure technical reasons they are always multiples of four.

Why did I know that that link went to Raymond Chen before clicking it... That man is a treasure.

▲

userbinator

5 hours ago

[-]

In this case I noticed that the process IDs on her system had seven digits.

I believe on Windows 9x, process IDs are actual kernel addresses (pointers to the process structure), and thus always have 10 digits.

▲

anonymousDan

11 hours ago

[-]

Re the last wish, isn't that exactly what ulimit is for?

▲

diath

10 hours ago

[-]

On Linux, yes, but this was Windows-specific code and Windows has no equivalent mechanism to ulimits.

▲

Arnavion

6 hours ago

[-]

There are job objects which are similar to Linux cgroups, including the ability to set a limit on the number of processes. But I'm not sure if that limit will be tripped in this case or not because the child processes have exited, whereas the job object parameter is specifically called LIMIT_ACTIVE_PROCESS

https://learn.microsoft.com/en-us/windows/win32/procthread/j...

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns...

▲

diath

5 hours ago

[-]

OpenProcess retrieves a handle to an existing process rather than creating a process so it won't be governed by JOB_OBJECT_LIMIT_ACTIVE_PROCESS, the bug here is that it's leaking handles, not processes.

▲

Arnavion

4 hours ago

[-]

Ah yes, in that case the relevant limit would be one on total handles, which doesn't seem to exist.

▲

anonymars

11 hours ago

[-]

> Sometimes I think it would be nice to have limits on resources in order to more automatically find mistakes like this

I was actually fairly disappointed when Visual Studio (not code) went to 64-bit. Because I knew its memory usage was now going to be unconstrained. Still way better than the unapologetic gluttony of Rider but experiences showed it to be a bit leaky over time (tip: Ctrl-Alt-Shift-F12 twice does a full garbage collection https://learn.microsoft.com/en-us/visualstudio/ide/visual-st...)

Also remember that all your references (pointers) are going to double in size so right off the bat it will use more, potentially a lot more depending on how reference-heavy your data is

▲

DanielHB

1 hour ago

[-]

> I was actually fairly disappointed when Visual Studio (not code) went to 64-bit.

Keep stuff on 32bit to ensure memory leaks and feature bloat are caught early, genius.

Seriously though, that might be a quick and dirty way to get an application with a hard-limit on memory for testing.