VSCodium.dev

[moritztim]

I bought the domain vscodium.dev and would love to host a web build there! I need some help making it secure tho.

[moritztim]

For starters, how do I disable installing extensions on the backend?

[daiyam]

Hi,

First of all, you should have consulted us before trying to use our brand name.
We don't know you. You're not a bad actor, isn't it?

@stripedpajamas @GitMensch @PalinuroSec What do you think about this situation?

[moritztim]

Well, I figured I'd just get it before a bad actor does. I'll transfer it to you for the price I paid, if you want it. Sorry for not consulting with you first, it was kind of an impulse decision 😅

[GitMensch]

@daiyam I think that making an online version available sounds good.
If @moritztim can prepare that and provide all necessary install/run parts as a free script for others to re-use, that would be nice. It would also provide a good estimate how much it costs to host that, allowing us to make a decision if it is reasonable to take available funds (and/or ask people that want it to provide these).

Concerning the extensions: I think that if you running a web instance only extensions that don't need a server-side are possible to be installed - but I never even tried.

In general - habe a look at the related issue #905 and discussion in #1469.

[moritztim]

Concerning the extensions: I think that if you running a web instance only extensions that don't need a server-side are possible to be installed - but I never even tried.

Correct. In the reh_web build, installed extensions are split into server and client side. With some surface level research I haven't been able to figure out how to disable the ability to install ones that run on the server.

In general - habe a look at the related issue #905 and discussion in #1469.

Yep. Those were a great starting point, I'll make sure to have a list of resources I used somewhere in my repo.

[daiyam]

Don't forget about the terminal ;)

[moritztim]

Alright, here we go. I hope I can get this running within a reasonable timeframe, before I start working again and might not have time anymore.

[PalinuroSec]

well, actually i did the same. i came out of nowhere, created a website, registered a domain and offered it to the project.
if the actual project admins agree, we could add the proper cname records and add it to the infrastructure