There is a Feature request from 2018 that I have been following for a long time to ask for VSCode Sadbox. I do not understand how Microsoft is not putting it up in priority.
And even if this exists, and you are sandboxed, with all guardrails and such, if you trust an extension that later gets compromised, you'd get the same sadness. It's the problems with trusting trust all over again...
Maybe sandboxing, plus freezing updates for at least a week, then on each update reviewing the permissions for each extension, then reviewing the extension itself for compromises. Something that should be done not by the user but by the supply chain itself.
This is how browsers have been doing things for 20 years, it's ridiculous that a company worth billions isn't doing it.
https://developer.chrome.com/docs/extensions/reference/permi... https://support.mozilla.org/en-US/kb/manage-optional-permiss...
I heared zed sandboxes extensions. I should have a look at that editor some day.
Also, modifying my code is far better than just launching, stealing everything silently, and having full control over my system. Needing to inject some sort of malware into an arbitrary project is way better.