Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SpaceVim – Like Spacemacs, but for Vim

spacevim.org

Post reply on HN
Print view View original

31–40 of 186 posts

Re: SpaceVim – Like Spacemacs, but for Vim

#31

Post by adrusi »

smallnamespace wrote: post #25
madmax108 wrote: post #8

The greatest dev timesaving tip that someone gave me was to clear my .vimrc and start off with a blank slate. vim is a language in itself [1] and it's easy to try to mimic someone who has conversational fluency in it, but as with languages, the only way to learn in practice from the start. Projects like SpaceVim try to create an IDE like environment, but because of being terminal driven, it's difficult for anyone to…

I don't quite understand this point. Why does the exact starting point of tinkering (existing .vimrc vs a completely blank one) matter, unless you somehow think the empty .vimrc defaults are the most sensible? Like, there could be a bunch of features that are barely used and not discovered, but seems like the easiest way to discover new features is to scan through a good .vimrc, rather than sleuthing through online r…

Starting with a blank slate lets you refer to just the program's documentation to configure it, while if you start with a config bundle you'll have to refer to both the program's documentation and the bundle's documentation, and you'll have to be decently familiar with both how the program works and what the bundle does in order to make creative customizations.

Using a configuration bundle makes the learning curve less steep but more tall, essentially.

Re: SpaceVim – Like Spacemacs, but for Vim

#34

Post by xkxx »

scrollaway wrote: post #29
xkxx wrote: post #28

Earlier quoted context omitted.

There are 2 types of "any script you haven't read, or binary you haven't decompiled": 1. scripts and binaries you obtained from somebody you trust in a safe authenticated way; 2. everything else. When I update my Debian distro, I get binaries via HTTP, that's true. But I also have the public keys of my distro's maintainers whom I trust. The authenticity of every binary I download is automatically checked using those…

The presence of https prevents most mitm vectors. It doesn't prevent the far more likely scenario of the website in question being broken into and serving malware or backdoorware. Point is, don't run binaries you don't have some way of vetting. curl sh is no worse offender than "download link here".

> don't run binaries you don't have some way of vetting

Thank you for your recommendations regarding operational security. We do really appreciate them.

Re: SpaceVim – Like Spacemacs, but for Vim

#36

Post by verandaguy »

PhasmaFelis wrote: post #32

> Like spacemacs, but for vim. This is one of the most obtuse project descriptions I've seen. If you're making a...whatever this is...aimed at Vim users, why would you expect them to be familiar with a something-or-other for Emacs?

Not to mention that (IIRC) Spacemacs involves installing evil-mode, which makes Emacs interactions similar to Vim interactions.

Taking that into account, this can be interpreted as "It makes Vim work more like Vim."

Re: SpaceVim – Like Spacemacs, but for Vim

#37

Post by arnarbi »

krzyk wrote: post #7

Ok, but what it is? The page doesn't explain it. The top page explanation refers to spacemacs and most vim users don't know spacemacs. Is it a vim plus a bundle of plugins? EDIT: Cleaned up the spacemacs sentence.

It's a distribution, bundling vim with a whole bunch of plugins and configuration that's supposed to work out of the box.

Spacemacs is the same for Emacs.

Re: SpaceVim – Like Spacemacs, but for Vim

#38

Post by dijit »

scrollaway wrote: post #20
xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

It's not exactly the same, and http injection by ISP's is definitely a thing.

https://www.djm.org.uk/posts/protect-yourself-from-non-obvio...

Re: SpaceVim – Like Spacemacs, but for Vim

#39

Post by madmax108 »

adrusi wrote: post #31
smallnamespace wrote: post #25

Earlier quoted context omitted.

I don't quite understand this point. Why does the exact starting point of tinkering (existing .vimrc vs a completely blank one) matter, unless you somehow think the empty .vimrc defaults are the most sensible? Like, there could be a bunch of features that are barely used and not discovered, but seems like the easiest way to discover new features is to scan through a good .vimrc, rather than sleuthing through online r…

Starting with a blank slate lets you refer to just the program's documentation to configure it, while if you start with a config bundle you'll have to refer to both the program's documentation and the bundle's documentation, and you'll have to be decently familiar with both how the program works and what the bundle does in order to make creative customizations. Using a configuration bundle makes the learning curve le…

>>> Using a configuration bundle makes the learning curve less steep but more tall, essentially.

Beautiful quote which I'll definitely use more often :)

Re: SpaceVim – Like Spacemacs, but for Vim

#40

Post by scrollaway »

dijit wrote: post #38
scrollaway wrote: post #20

Earlier quoted context omitted.

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

It's not exactly the same, and http injection by ISP's is definitely a thing. https://www.djm.org.uk/posts/protect-yourself-from-non-obvio...

I know of the attack. It's very unlikely to matter in practice.

There's a ton of potential issues when you're curl-piping; all those issues are present in some form when you're simply doing curl first then sh.

It's far more egregious to download a hard-to-inspect binary then run it, than it is to download a shell script then run it. Although it's harder to inject code on the fly, if you're at the stage where you're worried about these kinds of attacks it makes very little difference.

I don't see people bitching about https://www.terraform.io/ offering download links for example. So yeah, it gets tiresome to always see "oh! curl|sh! boo! bad!" - there's actually no better way of sharing such scripts short of making and vetting a package with a high-entry-bar distribution. And a two-step curl + sh instead of a pipe is security theater.

https would certainly be appreciated on that site but that's a general issue, regardless of the download script.

Post reply on HN