It's pretty annoying. I'm a developer, I know what I'm doing. I don't need to be asked whether I trust a Python notebook or not.
famous last words
Basically the files and folders are usually innocuous, it's the particular configuration of the workspace or plugins that may run code on them that need to be "trusted" or designed to request permission before executing code
It is the same approach to defend off phishing attacks in large corporations: shift the responsibility to the user.
In my opinion, this is just another scream for codified capabilities. Which would be a real solution and not just repeatedly a click away from disaster.
Despite favoring "least privilege" myself, I find the new nag screens overbearing. I think some basic UI reworking can help to alleviate that, though. It's a new feature; they'll get it right within a couple of iterations.
Builds, tests and the app itself could easily run inside a container - web apps can simply expose a TCP port and GUI apps can use X forwarding or the platform equivalent. Other programs that need external devices (like a serial connection to an MCU) could have those and only those passed in.
And if we're even more paranoid and worried about code exploiting our editor and tools, the editor could also be just a simple thin client with all the linters, language servers and everything else running in the container. For VS Code, this already exists for cloud development services (Che, etc.).
Fixing it should really be given top priority, but doesn't look to be a very popular subject when you compare it to some of the others such as whether or not ESLint should become a NodeJS core module ...
Yup.
I love VS Code but the sheer amount of chatty notifications especially when browsing a large code base can be simply overwhelming. I just start reflexively ignoring them. There’s no “just shut up already and let me work” button.
I’m glad this is something they are working on improving.
I prefer zero trust.
