Add extension runtime security article #7920
Conversation
|
@seaniyer Here's the first draft of the dedicated article that discusses extension runtime security. I've reused most of the content that was previously in the FAQ section of the Extension Marketplace article. Can you review and provide feedback if there are other Marketplace measures we need to include? Thanks! |
|
@isidorn First version of this new doc available for your review. TO DO:
|
There was a problem hiding this comment.
This is a great first stab at this document.
I will share it with folk on the MP side and @sandy081 could also give it a read
fyi @joaomoreno
|
The goal of this doc is to:
|
|
Thanks. LGTM |
|
|
||
| * **Issues, Repository, and License**: Check if the publisher provided these and if they have the support you expect. | ||
|
|
||
| * **Verified Publisher**: Use the blue check mark next to the publisher's name and domain name as an extra signal of trust. The check mark indicates that the publisher has proven domain-name ownership to the Marketplace. It also shows that the Marketplace has verified both the existence of the domain name and the good standing of the publisher on the Marketplace for at least six months. |
There was a problem hiding this comment.
Let's add a bullet point about "long-standing presence"
The goal is that publishers that have been publishing extensions for a long time should be more trust-worthy
There was a problem hiding this comment.
We don't have clear information about publisher's long-standing presence, apart from going through the history of a specific extension's releases. Am I missing a specific signal?
There was a problem hiding this comment.
Good point
Marketplace should update this page https://marketplace.visualstudio.com/publishers/vadimcn to contain more publisher information. I will discuss with @seaniyer @mariaghiondea
The dialog points to that page.
There was a problem hiding this comment.
Though I still think we can add that point, and users can investigate when was the extension first published.
@ntrogh I leave that decision up to you Nick
|
Also @joaomoreno sketched this image Not sure if we should include it, or some form of it - to make this document easier to parse.
|
|
@isidorn The comparison image is definitely nice. However, because we're dealing with a sensitive topic, it might result in people oversimplifying the decision process for trusting an extension. Unless it's 100% exact and approved, I'd refrain from putting such guidance in the docs. |
Fixes #7874