I want this solved so much - across all of the operating systems I use.
Ideally I'd like to never run code I download from the internet outside of a sandbox ever again.
Case in point, just yesterday: https://www.bleepingcomputer.com/news/security/malicious-vsc... - "Malicious VSCode extension in Cursor IDE led to $500K crypto theft" - because the Open VSX alternative to the VS Code marketplace has unreviewed extensions and they don't have a sandbox to stop them from doing anything they like.
It also really bothers me that running a simple utility effectively means I’ve given the developer full access to my system.
It’s even worse when commercial software wants me to add it’s repo to my package manager for updates… (Who audits post install scripts of RPM, etc!!!)
That being said, I’m also too lazy to run every thing inside its own container — especially for browsers, etc.
Feels too cumbersome that I need some automated CI pipeline just to ensure my DIY containers remain updated.
Also a pain to decide what file/directories the container should have access to.
In principle, I should probably use something like Qubes.
However, the prospect of putting my entire security ins small group of people writing somewhat complicated software with no financial disincentive for shenanigans also bothers me. (I realize this is extremely unfair and their work is quite impressive, but theoretically reality could get in the way)
https://invisiblethingslab.com/ is a company. They have a big vested interest in not doing something shady and wasting years of trust, sinking the company, possibly even risk legal problems.
I don't know about Cursor, but VSCode can be used from Chrome, which has a good sandbox against an attacker's exploiting VSCode to get access to the system you are running Chrome on.
Ideally I'd like to never run code I download from the internet outside of a sandbox ever again.
Case in point, just yesterday: https://www.bleepingcomputer.com/news/security/malicious-vsc... - "Malicious VSCode extension in Cursor IDE led to $500K crypto theft" - because the Open VSX alternative to the VS Code marketplace has unreviewed extensions and they don't have a sandbox to stop them from doing anything they like.