Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SpaceVim – Like Spacemacs, but for Vim

spacevim.org

Post reply on HN
Print view View original

41–50 of 186 posts

Re: SpaceVim – Like Spacemacs, but for Vim

#41

Post by AtticHacker »

verandaguy wrote: post #36
PhasmaFelis wrote: post #32

> Like spacemacs, but for vim. This is one of the most obtuse project descriptions I've seen. If you're making a...whatever this is...aimed at Vim users, why would you expect them to be familiar with a something-or-other for Emacs?

Not to mention that (IIRC) Spacemacs involves installing evil-mode, which makes Emacs interactions similar to Vim interactions. Taking that into account, this can be interpreted as "It makes Vim work more like Vim."

Or it could be interpreted as "Make Vim use Emacs keys!"

Re: SpaceVim – Like Spacemacs, but for Vim

#42

Post by StreamBright »

xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

The first thing I looked for is an installer that actually does something else than curl | sh.

Re: SpaceVim – Like Spacemacs, but for Vim

#43

Post by Philipp__ »

I don't get Spacemacs hype. I tried it, and never felt comfortable using it. Started with blank .emacs.d, yeah I completely cleard whole configuration two or three times until I hit sweetspot. Now I'm sitting on ~250 loc config on vanilla emacs (including evil), and eveything works like a charm. Plus I learned a lot about elisp. I never liked those bundles and distributions. They always felt redundant, but I can understand the appeal to some people.

Re: SpaceVim – Like Spacemacs, but for Vim

#44

Post by elcapitan »

arnarbi wrote: post #37
krzyk wrote: post #7

Ok, but what it is? The page doesn't explain it. The top page explanation refers to spacemacs and most vim users don't know spacemacs. Is it a vim plus a bundle of plugins? EDIT: Cleaned up the spacemacs sentence.

It's a distribution, bundling vim with a whole bunch of plugins and configuration that's supposed to work out of the box. Spacemacs is the same for Emacs.

Thanks, that's the tldr I was looking for too.

Re: SpaceVim – Like Spacemacs, but for Vim

#45

Post by scribu »

towb wrote: post #13

Yay for the effort! But personally I don't think this is a good way to learn and use vim. The strength of vim is to customise it after your own needs and you'll do yourself a disservice if you end up with a config that you don't know and don't use more than x percent of.

I agree, the usefulness of a "distribution" like this is getting some fresh ideas about how to customise the editor.

For example, this site listed some useful plugins that I didn't know about, such as https://github.com/bogado/file-line

Re: SpaceVim – Like Spacemacs, but for Vim

#46

Post by dijit »

scrollaway wrote: post #40
dijit wrote: post #38

Earlier quoted context omitted.

It's not exactly the same, and http injection by ISP's is definitely a thing. https://www.djm.org.uk/posts/protect-yourself-from-non-obvio...

I know of the attack. It's very unlikely to matter in practice. There's a ton of potential issues when you're curl-piping; all those issues are present in some form when you're simply doing curl first then sh. It's far more egregious to download a hard-to-inspect binary then run it, than it is to download a shell script then run it. Although it's harder to inject code on the fly, if you're at the stage where you're w…

if you believe shell scripts are hard enough to write that systemd can take over. Then you should also believe that they're hard enough to inspect that you want some level of auditing.

RPM's are inspectable, signed by default and integrate better with your system. (the same is true of apt). And if they're in the package repository then there is a maintainer who is ultimately responsible for ensuring the quality of the code.

Re: SpaceVim – Like Spacemacs, but for Vim

#47

Post by bjackman »

xkxx wrote: post #16

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet.…

For me the insecurity isn't even the worst thing about curl | sh.

I like package managers, and I tolerate tarballs, because I know what they do and how to reverse it. I care about the organisation of my filesystem and suspect that the people who suggest I pipe their script into my shell do not care at all.

Re: SpaceVim – Like Spacemacs, but for Vim

#48

Post by adventist »

madmax108 wrote: post #39
adrusi wrote: post #31

Earlier quoted context omitted.

Starting with a blank slate lets you refer to just the program's documentation to configure it, while if you start with a config bundle you'll have to refer to both the program's documentation and the bundle's documentation, and you'll have to be decently familiar with both how the program works and what the bundle does in order to make creative customizations. Using a configuration bundle makes the learning curve le…

>>> Using a configuration bundle makes the learning curve less steep but more tall, essentially. Beautiful quote which I'll definitely use more often :)

Same here!

Re: SpaceVim – Like Spacemacs, but for Vim

#49

Post by scrollaway »

dijit wrote: post #46
scrollaway wrote: post #40

Earlier quoted context omitted.

I know of the attack. It's very unlikely to matter in practice. There's a ton of potential issues when you're curl-piping; all those issues are present in some form when you're simply doing curl first then sh. It's far more egregious to download a hard-to-inspect binary then run it, than it is to download a shell script then run it. Although it's harder to inject code on the fly, if you're at the stage where you're w…

if you believe shell scripts are hard enough to write that systemd can take over. Then you should also believe that they're hard enough to inspect that you want some level of auditing. RPM's are inspectable, signed by default and integrate better with your system. (the same is true of apt). And if they're in the package repository then there is a maintainer who is ultimately responsible for ensuring the quality of th…

For the second time here, I'm not dissing package managers... I even explicitly said the solution is "vetting a package with a high-entry-bar distribution".

But the whole point of high-entry-bar distros is that it's highly curated. Some random script from the web will not be in there. How do you serve those that need to casually distribute trivial software?

There's some answers to that question - they're not widespread at all. It's one of the major failures of package management on Linux. macOS gets it mostly right.

Post reply on HN