The 'smart' features are a classic example of designing for the median user while actively degrading the experience for power users. Smart Compose, nudges, category tabs all of them make sense if you get 50 emails a day and respond to 5. They become noise if you have actual workflows. The problem is you can't opt out of the product vision, only individual features.

The attack surface that makes this particularly nasty is that VSCode extensions run with the same trust level as the editor itself, and most developers have dozens installed without reviewing their permissions. A malicious or compromised extension silently exfiltrating GitHub tokens is undetectable without network monitoring. This is a good argument for running extensions in isolated profiles.

> is undetectable without network monitoring

Even with network monitoring, exfil to Github itself can be very hard to stop unless you SSL intercept and have very strict URL allow lists.

Best is to move away from Github, move to self hosted internal Gitlab/Forgejo and block Github completely.

This is a concerning trend. Turnstile was marketed as a privacy-respecting CAPTCHA alternative, but requiring WebGL fingerprinting undermines that entirely. At this point what's the actual difference between this and the tracking they claimed to replace?

At the time, reCAPTCHA was the alternative and it was effectively working as a giant ad targeting data collection tool. I'm pretty sure Google have now back tracked from this.

WebGL finger printing is just one of many things you need to do if you actually want to stop automation. There is no way round it other than requiring ID of some sort.

So wild thinking folks would actually believe a massive, US-based, publicly-traded company when they say something is “privacy-respecting”.