Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SpaceVim – Like Spacemacs, but for Vim

spacevim.org

Post reply on HN
Print view View original

21–30 of 186 posts

Re: SpaceVim – Like Spacemacs, but for Vim

#21

Post by TheDong »

Shicholas wrote: post #17
krzyk wrote: post #7

Ok, but what it is? The page doesn't explain it. The top page explanation refers to spacemacs and most vim users don't know spacemacs. Is it a vim plus a bundle of plugins? EDIT: Cleaned up the spacemacs sentence.

it's emacs with vim controls. FWIW, I wouldn't compare emacs with vim in this set up, but with something like tumx instead (and imo what emacs offers is better than tmux).

They're not asking what space-emacs is, but what this linked page is.

This page is not emacs. This page is just a bunch of neovim plugins, as OP surmised.

Re: SpaceVim – Like Spacemacs, but for Vim

#22

Post by bn-usd-mistake »

Shicholas wrote: post #17
krzyk wrote: post #7

Ok, but what it is? The page doesn't explain it. The top page explanation refers to spacemacs and most vim users don't know spacemacs. Is it a vim plus a bundle of plugins? EDIT: Cleaned up the spacemacs sentence.

it's emacs with vim controls. FWIW, I wouldn't compare emacs with vim in this set up, but with something like tumx instead (and imo what emacs offers is better than tmux).

No it's not. This is actually vim, just with some configuration and plugins. You are probably talking about [Spacemacs](http://spacemacs.org/)?

Re: SpaceVim – Like Spacemacs, but for Vim

#23

Post by semi-extrinsic »

scrollaway wrote: post #20
xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

No, installing a package using my package manager will

a) ensure this exact binary/script is GPG signed by someone I ostensibly trust

b) ensure it's not been tampered with by a MitM between the hosting server and my computer

This reduces my risk exposure to "creator of software X (or distro packager Y) has turned rogue", which is many orders of magnitude less likely than "website of software X got pwned, or someone is MitM-ing me".

Re: SpaceVim – Like Spacemacs, but for Vim

#24

Post by qzio »

scrollaway wrote: post #20
xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

Yes. But this site doesn't use https even...

Re: SpaceVim – Like Spacemacs, but for Vim

#25

Post by smallnamespace »

madmax108 wrote: post #8

The greatest dev timesaving tip that someone gave me was to clear my .vimrc and start off with a blank slate. vim is a language in itself [1] and it's easy to try to mimic someone who has conversational fluency in it, but as with languages, the only way to learn in practice from the start. Projects like SpaceVim try to create an IDE like environment, but because of being terminal driven, it's difficult for anyone to…

I don't quite understand this point. Why does the exact starting point of tinkering (existing .vimrc vs a completely blank one) matter, unless you somehow think the empty .vimrc defaults are the most sensible?

Like, there could be a bunch of features that are barely used and not discovered, but seems like the easiest way to discover new features is to scan through a good .vimrc, rather than sleuthing through online resources.

Re: SpaceVim – Like Spacemacs, but for Vim

#26

Post by kevinjcliao »

madmax108 wrote: post #8

The greatest dev timesaving tip that someone gave me was to clear my .vimrc and start off with a blank slate. vim is a language in itself [1] and it's easy to try to mimic someone who has conversational fluency in it, but as with languages, the only way to learn in practice from the start. Projects like SpaceVim try to create an IDE like environment, but because of being terminal driven, it's difficult for anyone to…

Have you really saved time, though? I know next to nothing about elisp, yet I can be perfectly productive with Spacemacs. Being able to edit my .spacemacs file and add a functional layer for an entirely new programming language with sane defaults seriously beats fighting configuration files to do the same thing anyways.

This sort of 'configure your own' extremist software purity movement is great for some people, but if you want a setup that meets your needs 95% of the time, and works well, Spacemacs is great. I'm sure learning to configure your own vimrc has been a rewarding experience, but I don't think you can really argue it's a time saving measure.

Re: SpaceVim – Like Spacemacs, but for Vim

#27

Post by scrollaway »

semi-extrinsic wrote: post #23
scrollaway wrote: post #20

Earlier quoted context omitted.

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

No, installing a package using my package manager will a) ensure this exact binary/script is GPG signed by someone I ostensibly trust b) ensure it's not been tampered with by a MitM between the hosting server and my computer This reduces my risk exposure to "creator of software X (or distro packager Y) has turned rogue", which is many orders of magnitude less likely than "website of software X got pwned, or someone i…

That does not invalidate what I said.

Re: SpaceVim – Like Spacemacs, but for Vim

#28

Post by xkxx »

scrollaway wrote: post #20
xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

There are 2 types of "any script you haven't read, or binary you haven't decompiled": 1. scripts and binaries you obtained from somebody you trust in a safe authenticated way; 2. everything else.

When I update my Debian distro, I get binaries via HTTP, that's true. But I also have the public keys of my distro's maintainers whom I trust. The authenticity of every binary I download is automatically checked using those public keys. It's an example of "any script you haven't read, or binary you haven't decompiled" type 1.

curl | sh via HTTP is an example of "any script you haven't read, or binary you haven't decompiled" type 2.

curl | sh via HTTPS is an example of something that is very-very close to "any script you haven't read, or binary you haven't decompiled" type 1.

Re: SpaceVim – Like Spacemacs, but for Vim

#29

Post by scrollaway »

xkxx wrote: post #28
scrollaway wrote: post #20

Earlier quoted context omitted.

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

There are 2 types of "any script you haven't read, or binary you haven't decompiled": 1. scripts and binaries you obtained from somebody you trust in a safe authenticated way; 2. everything else. When I update my Debian distro, I get binaries via HTTP, that's true. But I also have the public keys of my distro's maintainers whom I trust. The authenticity of every binary I download is automatically checked using those…

The presence of https prevents most mitm vectors. It doesn't prevent the far more likely scenario of the website in question being broken into and serving malware or backdoorware.

Point is, don't run binaries you don't have some way of vetting. curl sh is no worse offender than "download link here".

Re: SpaceVim – Like Spacemacs, but for Vim

#30

Post by jsmeaton »

kevinjcliao wrote: post #26
madmax108 wrote: post #8

The greatest dev timesaving tip that someone gave me was to clear my .vimrc and start off with a blank slate. vim is a language in itself [1] and it's easy to try to mimic someone who has conversational fluency in it, but as with languages, the only way to learn in practice from the start. Projects like SpaceVim try to create an IDE like environment, but because of being terminal driven, it's difficult for anyone to…

Have you really saved time, though? I know next to nothing about elisp, yet I can be perfectly productive with Spacemacs. Being able to edit my .spacemacs file and add a functional layer for an entirely new programming language with sane defaults seriously beats fighting configuration files to do the same thing anyways. This sort of 'configure your own' extremist software purity movement is great for some people, but…

When I forked my dotfiles project I took the time to learn what most of the changes, commands, and config did. I removed a lot that I didn't find relevant. But I don't think I'd have gotten near to the current state if I'd started from scratch.

I think there's value in learning what prepackaged configs provide and tailoring them. I don't necessarily agree that starting from scratch is optimum for most though.

Post reply on HN