HackerNews VSCode's remote editing over SSH raises security concerns compared to Emacs' Tramp system. (Note: The headline is 149 characters long.)
(fly.io) (Archive)Summary
The discussion centers on integrating VSCode's remote editing capabilities over SSH with Large Language Models (LLMs) for code generation. Users highlight that while LLM-generated code can be useful when properly managed, it often produces errors or "hallucinations." A proposed solution involves a closed-loop system where an agent runs the generated code, identifies errors, and feeds them back to the LLM for iterative improvement. However, this process raises concerns about running such iterations on personal development environments due to potential boundary issues with LLMs affecting system configurations.
The conversation also compares VSCode's remote editing feature to Emacs' Tramp, a well-established Elisp-based tool that extends Emacs via SSH sessions. Unlike Tramp, which operates minimally on the remote connection, VSCode employs a more invasive approach by deploying a Bash snippet stager to download and run an agent using Node.js over port-forwarded SSH. This setup allows extensive operations like file editing and launching shell processes, raising security concerns about its use in sensitive environments.
Despite these concerns, it's noted that custom connections to Fly Machines can be established in VSCode without engaging with the aforementioned complexities. The discussion concludes by acknowledging the necessity of understanding these technical details, even as the platform shifts focus away from such integrations.
The comments reflect diverse perspectives on Visual Studio Code's (VSCode) remote capabilities, particularly its use of an agent for SSH connections. Some users appreciate VSCode's seamless integration and powerful features like file system navigation, editing, and process management through the Remote - SSH plugin. They highlight how it enhances productivity by allowing developers to work remotely as if they were on a local machine.
However, concerns are raised about security due to the extensive permissions granted to the agent, which can navigate the filesystem, edit files, and create shell processes. Critics argue that this level of access could be exploited, especially in production environments, likening it to running an untrusted application with full system privileges.
Others compare VSCode's approach unfavorably to alternatives like Zed or traditional editors such as Vim and Emacs, citing issues like bloat, resource consumption, and reliability over SSH. Some users express frustration with the complexity of configuring these tools compared to the simplicity of using a local editor on a remote machine.
The discussion also touches on broader themes in software development, such as the trade-offs between ease of use and security, and the preference for open-source solutions that allow for customization and transparency. While some see VSCode's architecture as innovative and beneficial, others view it as overly complex or insecure for certain applications, particularly when integrating with emerging technologies like large language models (LLMs).
Overall, the comments illustrate a balance between admiration for VSCode's capabilities and caution regarding its security implications, reflecting broader debates in software development about tool choice and system design.