Live-share: Enforce Connection Mode Direct
Product and Version [VS/VSCode]: Both VS and VSCode
OS Version [macOS/Windows]: Both
Live Share Extension Version: Latest
Target Platform or Language N/a
Steps to Reproduce / Scenario:
- Enable the ability to force users to operate the product in direct mode only as to prevent unauthorized sharing of code to third parties either through policies or some other mechanism
This is a really great product, and I see a lot of value in its features from an internal perspective. My security team is looking to lock it down to internal only without completely blocking the endpoint *.servicebus.windows.net:443.
Any ideas or guidance is appreciated.
cwoodworth
All 12 comments
@cwoodworth Hey! Thanks for reaching out. We鈥檝e heard this request a few times, and definitely want to enable team/organization-wide policy enforcement in the future. In the meantime, blocking our cloud relay may be the best way to guarantee that only direct mode can be used. If it would be valuable, we could provide you with the DNS hosts of the Live Share relays, so that you didn鈥檛 need to block Azure Service Bus entirely.
@jasongin Can you think of a better recommendation? Also, could you confirm that if our relay was blocked by a firewall, that it wouldn鈥檛 prevent a direct connection from successfully happening? (e.g. would the Share operation fail if it couldn鈥檛 reach the relay?)
lostintangent
on 27 Jul 2018
Can you think of a better recommendation?
Nothing right now. As mentioned, we have discussed how we might build support for these sort of enterprise policies in the future, but there are no immediate plans.
could you confirm that if our relay was blocked by a firewall, that it wouldn鈥檛 prevent a direct connection from successfully happening?
Yes. The direct connection is attempted first, so blocking the relay servers will not cause any problem for direct connections.
jasongin
on 27 Jul 2018
@jasongin Thanks for confirming that!
@cwoodworth We鈥檒l use this issue to track implementing the centralized policy enforcement. In the meantime, it would be great to know if blocking the relay servers would be an acceptable workaround for your team to adopt Live Share. Let me know if it would be helpful to get the specific list of DNS hosts, or if blocking *.servicebus.windows.net:443 is sufficient. Thanks!
lostintangent
on 27 Jul 2018
Sorry I need to correct my statement above. (For some reason I was thinking only about the potential of joining being blocked.)
If the relay servers are blocked, then the share operation will fail when using the default "auto" connection mode. VSLS hosts would have to change their connection mode to "direct" in order to successfully share. And then VSLS on the join side would automatically detect that is the only possible way to connect to the session, so it would not even try connecting to the relay.
jasongin
on 28 Jul 2018
@lostintangent It would be great if I could get the specific DNS servers as my team was very against blocking the entire set of relays. Thanks for all your help, and the quick response.
cwoodworth
on 30 Jul 2018
@jasongin @lostintangent Any update on this? Let me know if another forum for communication is preferred.
cwoodworth
on 2 Aug 2018
@cwoodworth Hey! Sorry for the late reply. Yeah, let's follow up over e-mail ([email protected]). That way we can talk about the specific details, and how to best unblock your organization. Thanks!
lostintangent
on 2 Aug 2018
@lostintangent is there any update on a process for organizations enforcing direct mode or should I email you?
JaredShaver
on 1 Mar 2019
Now that VS2019 is out and ships with this by default, I'm also interested in an administrative way to block the relay. Is blocking *.servicebus.windows.net:443 still the best option here?
almostjulian
on 2 Apr 2019
Yes @lostintangent, it would be very helpful to have the specific list of DNS hosts to block. We looked into blocking *.servicebus.windows.net:443, but that's a bid of a broad brush and we had other services that relied on that.
hutchcodes
on 21 May 2019
Hello!
@lostintangent Are there any updates on centralized policy enforcement, that would not rely on blocking network trafic since that is not always possible with our remote workers, who are numerous in this period of time =). We use our corporate Azure AD accounts to connect to liveshare, so the best solution for our organization might be to rely on that to inherit some mandatory settings such as Direct-connect mode. Thank you for your help!
mfjerome
on 20 May 2020
Hello!
Same as @mfjerome here.
SebHonorine
on 20 May 2020
Related issues
tamuratak
路
3Comments
Luchiwis
路
3Comments
Chuxel
路
3Comments
hez2010
路
4Comments
Chuxel
路
4Comments
Most helpful comment
Hello!
@lostintangent Are there any updates on centralized policy enforcement, that would not rely on blocking network trafic since that is not always possible with our remote workers, who are numerous in this period of time =). We use our corporate Azure AD accounts to connect to liveshare, so the best solution for our organization might be to rely on that to inherit some mandatory settings such as Direct-connect mode. Thank you for your help!