VSCode's SSH Agent Is Bananas

(fly.io)

55 points | by Rapzid 1 hour ago

17 comments

  • danielklnstein 49 minutes ago
    Missing a (2025)

    FYI VSCode's SSH Agent is a godsend for remote development - the "disadvantages" that Fly lists are part of its advantages. I've worked in several teams that have made extensive use of the extension, and it's never been an issue. You can restrict SSH access arbitrarily to ensure whatever security or access guardrails you need.

    • modeless 26 minutes ago
      Yeah this is the right architecture for remote editing with remote tools. It works really well. (There are longstanding bugs around reconnection when the SSH connection is broken but that's not the fault of the architecture.)
    • miohtama 37 minutes ago
      “A tool with a purpose of editing files on a remote system can edit files on a remote system.”
      • devonbleak 29 minutes ago
        it's worse than that, last i looked into this - there's functionality in the protocol that allows the remote system to modify files and execute code on the local/frontend system. it really is bananas.
        • necovek 25 minutes ago
          Reminds me of the old Jenkins protocol which warned about "slaves" getting access to execute code on the "master": who's the master now? ;)
          • Muromec 15 minutes ago
            when slaves became workers and joined the union, the unions became "social partners". this is how one closes the laptop at 4 and doesn't have to suffer vibe-decrees mandating RTO

            seize the control plane.

      • varispeed 35 minutes ago
        Shock and horror!
  • 10000truths 21 minutes ago
    So a program that is specifically designed to edit files and run arbitrary commands on a remote machine... can do so. Not sure where the bananas part comes in. Sending a binary over SSH/SFTP might sound weird at first glance, but VSCode can't assume that your remote machine can access the wider internet, and it needs a reliable way to bootstrap the agent on the remote. Shipping it over the SSH tunnel is the natural solution.
    • bobtheborg 9 minutes ago
      I think the actual concern, not well expressed in the blog post, is the fact that node and vscode server are installed on, for instance, a prod machine that (probably) should be very tightly controlled in terms of what software is installed and running. You don't want to unwittingly add to the attack surface
      • pstuart 7 minutes ago
        Fair enough, but running VSCode on a prod machine is also bananas.
        • Banditoz 1 minute ago
          The assumption being made is VSCode is not running on the prod machine.
        • K0IN 3 minutes ago
          agree, but do you think every dev you know konws this?

          also "i just want to edit a config file and i want a nice ui", is how you get there.

    • dist-epoch 8 minutes ago
      The bananas part is that it dumps 500 MB of stuff on the remote side.
  • binlog 32 minutes ago
    The agent is supposed to run on a remote dev box. The purpose is to make the remote machine an extension of your local one, to run extensions, containers, test deployments, forward ports and tons more. Tunneling is part of the feature set. If you are installing it on production servers and are surprised by its behavior that’s on you.
  • MajesticHobo2 43 minutes ago
    This part of VSCode's architecture is acceptable to me. The reverse direction, where a compromised remote can do whatever it wants to my local machine, is not.
  • Shorel 18 minutes ago
    For my own agent one of the design constraints is that it can't get out of the work directory, and it can't even try to guess the full path of that directory. Interesting that VSC has gone the other way entirely.
  • 2snakes 10 minutes ago
    I should call my dev machine the Fly Machine too
  • dleslie 27 minutes ago
    The problem isn't that it can edit remote files or run remote shell commands.

    The problem is that it appears to do this via an AI Agent. This broadens the security concerns significantly.

  • comandillos 36 minutes ago
    This extension and devcontainers is basically the way to go for large dev teams inmho
  • KeplerBoy 24 minutes ago
    off topic, but I feel this observation was quite early in feb' 2025: "LLM-generated code is useful in the general case if you know what you’re doing. But it’s ultra-useful if you can close the loop between the LLM and the execution environment (with an “Agent” setup)."

    kudos

  • innocent_name 31 minutes ago
    Moreover, it explicitly breaks in VSCodium and no good alternatives exist.
    • zenapollo 16 minutes ago
      Not sure what you consider "no good" alternatives. jeanp413.open-remote-ssh[0] has worked flawlessly. It's the first or second search hit in the extension manager for "ssh". It's a fork of Microsoft's previous extension before the proprietarized it.

      0: https://open-vsx.org/extension/jeanp413/open-remote-ssh

    • arcanemachiner 28 minutes ago
      You say that like it's a bad thing; I narrowly escaped serious use of VSCode thanks to this fact.
    • whalesalad 18 minutes ago
      Take zed for a spin
  • walrus01 51 minutes ago
    When I give an agent ssh access to something I want to be able to watch and fully understand what it's doing. I want it to essentially only "type" things into the CLI that I could have typed myself, I can comprehend what it's doing, and am not surprised by the results. Opencode and a smart LLM (qwen 3.8-flash-next, deepseek v4 0731 or smarter) do relatively well with this in my experience.
    • pixl97 29 minutes ago
      And if everyone was like you AI safety wouldn't be that large of concern. The default human behavior seems to be fire and forget which can go off the rails really quick.
      • walrus01 28 minutes ago
        It's not like I've never told an agent to build an ssh tunnel or some sort of more persistent connection between my dev machine running the harness and the remote thing it is talking to as an SSH client... Just that I don't want it going and doing that proactively unless I specifically define the parameters first.
        • Muromec 9 minutes ago
          luckily nobody made an actor library in the most pupular programming language that can bootstrap a (resident) remote process in one line of code. it would be a shame if someone did that and then also build a made tool calling process of the harness installable on everything with a stdio.

          it's not like it's any worse than just giving the thing access to your ssh keys.

          • walrus01 4 minutes ago
            Agents and harnesses don't get access to "my" ssh keys, they get access to new ed25519 key pairs created for specific projects and access to discrete things. The blast radius is relatively well contained to specific VMs they are SSHing into for project specific purposes. I don't run a harness or agent directly on my personal workstation.
  • halfcat 13 minutes ago
    I’m currently experimenting with running:

    - neovim

    - in VS Code [1]

    - in the browser

    Cloud VM runs the built-in `code serve-web` command, over Tailscale using `tailscale serve`. No SSH. Extensions work. No extensions run locally (with SSH some extensions have to run locally on your machine).

    I’m trying to see how little I can run on my local machine. VS Code over SSH is a good step in that direction, but there’s more attack surface if SSH is misconfigured, plus risk of an extension getting compromised.

    I expected the added layers (neovim, through an extension, inside VS Code, over the web) to be slow, but so far it works surprisingly well.

    [1] https://github.com/vscode-neovim/vscode-neovim

  • Doches 26 minutes ago
    > It turns out we don’t have to care about any of this [...], so none of this matters in any kind of deep way, but: we’ve decided to just be a blog again, so: we had to learn this, and now you do too.

    I found this closing sentence utterly delightful, particularly in an age of endlessly filtering every piece of text I read on the internet through a mental "was this written by Claude, Codex, or (just possibly) a human?" filter.

  • whalesalad 18 minutes ago
    I avoided Zed for a long time because of the SSH feature in VScode. Then I realized Zed has SSH remote too. Just flagging this for anyone else who relies on vscode-over-ssh and is sick of the bloat.
  • Joker_vD 46 minutes ago
    > Emacs hosts the spiritual forebearer of remote editing systems, a blob of hyper-useful Elisp called “Tramp”. If you can hook Tramp up to any kind of interactive environment — usually, an SSH session — where it can run Bourne shell commands, it can extend Emacs to that environment.

    vs.

    > The agent runs over port-forwarded SSH. It establishes a WebSockets connection back to your running VSCode front-end. The underlying protocol on that connection can: Wander around the filesystem; - Edit arbitrary files; Launch its own shell PTY processes; Persist itself.

    So... basically the same things that Tramp could do as well?

    > In security-world, there’s a name for tools that work this way. I won’t say it out loud, because that’s not fair to VSCode, but let’s just say the name is murid in nature.

    Yeah, it's called RAT, and an ur-example of it is SSH itself (especially when allowed to run a shell remotely), so... not sure why are you freaking out.

    I mean, I'd probably prefer if VS Code simply ran ed/vim remotely, but both of those editors can invoke shell anyhow so... eh?

    • kccqzy 3 minutes ago
      The difference is that there is an SSH agent at all, whereas Emacs just uses the built-in Bourne shell.

      Some people get an icky feeling where remote editing tools change the remote filesystem in any way that is not explicitly done by the user. A binary installation of Node is extra extra icky. (I don’t have Node installed anywhere on my computers.)

    • woodada 18 minutes ago
      > basically the same things that Tramp could do as well?

      Yes, just much faster. At the cost of a proprietary binary blob on the remote end, whereas tramp works with bare sh/bash.

      However there's now tramp-rpc, which is tramp but talks to a Rust client on the remote side, and that makes Emacs even faster than vscode-over-ssh.

    • hilariously 3 minutes ago
      Don't know why you are being downvoted, this is how a lot of clients do it - Jetbrains does the same thing as well.