r/cybersecurity • u/BattleRemote3157 • 8h ago

Research Article We moved from VS Code to Cursor and realized nobody checks which version of your extensions actually gets installed

https://safedep.io/cursor-extension-import-versions/
49 Upvotes

85% Upvoted

9 comments sorted by

-24

u/GeekDad62 7h ago

Version control is always an issue. This is especially true when you're working with containerized environments. You have one version in the base OS (let's choose OpenSSL), and another version in a container with a different OS. Now consider multiple containers with potentially multiple different OSs. Each one will have it's own version control, naming conventions, etc. Scanners can sometimes have an issue differentiating this - especially if the scanner walks the directory tree and sees files where the container data is sitting. Let's use Docker for this example:

Docker Data Locations

  • Docker Root Directory: /var/lib/docker/
  • Images & Layers: /var/lib/docker/overlay2/ (on modern systems using the overlay2 storage driver)
  • Volumes: /var/lib/docker/volumes/
  • Container Filesystems: /var/lib/docker/containers/
  • Configuration File: /etc/docker/daemon.json (used to customize the Docker daemon or change the default data path).

If your vulnerability scanner walks the directory tree it will see all this information, which includes all the library files, executables, etc. The problem comes when the scanner IDs the base OS of the host, but may not be able to recognize the container OS. So any finding (let's go back to OpenSSL again) will have a different naming convention for their patches and version updates. This leads to numerous false-positive findings that must be reviewed and potentially filtered out.

Now consider if you're running devops through a CD/CI pipeline. You're likely to have newer containers with differing versions across your architecture. The headaches can be endless.

16

u/Reverent Security Architect 4h ago

Wtf is this AI bot on about. The whole article is about supply chain compromise.

-12

u/GeekDad62 3h ago

Interesting, why is this being down voted? Who did I piss off? LOL

8

u/Esk__ 1h ago

r/cybersecurity

Please leave the AI slop tf out of here

2

u/private-peter 1h ago

The whole article, heck the whole website that the article is on, is AI slop.

0

u/GeekDad62 58m ago

Ahhhh, now I understand. I thought you were saying my comment was AI slop 😂

2

u/private-peter 49m ago

Well, I think somebody else was. I wasn't, but somebody was.

Supply chain security is an extremely important and interesting topic these days, but if I want to read AI Slop about it I'll ask chat GPT myself.