Trending storyPast story
VSCode's SSH Remote Agent Is as Invasive as a Trojan
1 report1 sourceupdated 6 days ago
What happened
Summary
Fly.io 的 Thomas Ptacek 拆解了 VSCode 的 SSH 远程编辑功能。和 Emacs 轻量的 Tramp 不同，VSCode 会在远程机器上下载一个完整的 Node 二进制文件，通过 WebSocket 通信，能读写文件、启动 shell 终端，还能持久化自身。作者称这行为“离谱”，警告不要在开发服务器或生产环境使用。
Coverage
Follow the reports to see the story from different sides.
Sep 24
- Hacker News front pageVSCode's SSH Remote Agent Is as Invasive as a Trojan
Thomas Ptacek from Fly.io dissects VSCode's SSH remote editing feature. Unlike Emacs' lightweight Tramp, it downloads a full Node binary to the remote machine, communicates via WebSocket, and can read/write files, spawn shell PTYs, and persist itself. The author calls it 'bananas' and warns against using it on dev servers or production.