[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
Re: [che-dev] Persist Theia plugin data in a Che workspace
|
I agree with Thomas. Compatibility with VS Code is quite critical.
Every time I say someone that we are working on ability to grab VS code extension directly from the marketplace they are blown away.
And secure workspace sharing comes with a price: you can’t store anything in files, you can’t store anything in environment variables. And now we do store a workspace token in environment variable, so invited user can find it. Apart from that, if user is in terminal of a workspace it is possible to catch memory of the IDE and find tokens even if they would be used per-action and not persisted anywhere.
This leads us to the situation we have on OSIO - sharing is not secure.
If we want to share workspaces we need to think through how it can be achieved and what are the drawbacks if any.
That's the point, we are reaching a point where usage from vscode/desktop is very different to how we could use it in Che/cloud
That's the point...it's not just the github token, it's arbitrary files that may or may not contain information that is considered confidential. VSCode has the storage path at $HOME/.config/Code[ - Variant]/User/workspaceStorage/
A vscode extension can put any type of file it wants there.
/Thomas
On Fri, 2018-12-14 at 16:04 +0100, Sun Tan wrote:
also if we still just talk about the github token, it should be stored through all the workspaces. I cannot see a user having to reimport a token each time he create a new workspace ...
To me, if you take the Github token are personal and
should NOT be per workspace
SHOULD be per user
I cannot see how we could allow another user that has access to my workpace to use my github token
_______________________________________________
che-dev mailing list
che-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://www.eclipse.org/mailman/listinfo/che-dev
--
_______________________________________________
che-dev mailing list
che-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://www.eclipse.org/mailman/listinfo/che-dev
--
Oleksandr Garagatyi