Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: CuteVim – Portable Vim with a cute vimrc

github.com

Post reply on HN
Print view View original

11–20 of 74 posts

Re: Show HN: CuteVim – Portable Vim with a cute vimrc

#12

Post by tczMUFlmoNk »

cardanome wrote: post #10
yellow_lead wrote: post #7

> saving backups of files in ~/.vim/backup every time you save, and keeping an undo-per file Is this a security risk? Not complaining, as it can be changed in the vimrc, just want to pose the question.

For a file to end up in ~/.vim/backup you need to have (had) the right to edit it in the first place. (I assume) files that are edited as root would go into the root home directory, so no problem. I can maybe see it be a problem for servers but I can't really think of a likely case, you would have to mess up pretty badly.

On the other hand, files edited through a flow like `sudoedit(1)` get copied into /var/tmp with mode 0600 and edited under the user's editor. This is in some ways much better than something like `sudo vim`, since that's a lot of privilege to be granting to a large attack surface. But it does create files like ~/.undodir/%var%tmp%shadow.XXcFqVH3: also with mode 0600, but they stick around even after sudoedit(1) terminates. So I think that it's fair to say that it is a nonzero security risk because it creates persistent copies of potentially sensitive files.

Aside from just a strict Unix permissions model, I think it's also easy to imagine cases where you create a sensitive file, edit it, delete it, and expect it to be really deleted. Or even just use Vim as a scratch buffer with no name! Yet undodir persists data in these cases, too.

Re: Show HN: CuteVim – Portable Vim with a cute vimrc

#16

Post by csdvrx »

tczMUFlmoNk wrote: post #12
cardanome wrote: post #10

Earlier quoted context omitted.

For a file to end up in ~/.vim/backup you need to have (had) the right to edit it in the first place. (I assume) files that are edited as root would go into the root home directory, so no problem. I can maybe see it be a problem for servers but I can't really think of a likely case, you would have to mess up pretty badly.

On the other hand, files edited through a flow like `sudoedit(1)` get copied into /var/tmp with mode 0600 and edited under the user's editor. This is in some ways much better than something like `sudo vim`, since that's a lot of privilege to be granting to a large attack surface. But it does create files like ~/.undodir/%var%tmp%shadow.XXcFqVH3: also with mode 0600, but they stick around even after sudoedit(1) termin…

> So I think that it's fair to say that it is a nonzero security risk because it creates persistent copies of potentially sensitive files.

sudoedit is something I hadn't considered. The backup should have an exclusion list, with at least /var/tmp

> Yet undodir persists data in these cases, too.

Except showing the count of available backups files somewhere in the interface, I don't see an easy way to avoid that

Re: Show HN: CuteVim – Portable Vim with a cute vimrc

#18

Post by krick »

> sensible defaults

> a tabline on top

I don't have anything against all these "default configurations" for vim (even though I'm struggling to imagine, why the kind of person who doesn't want to configure vim himself would choose vim in the first place), but this line just made me chuckle.

Re: Show HN: CuteVim – Portable Vim with a cute vimrc

#19

Post by reissbaker »

This is sick and eliminates the "but I want my muscle memory to work on bare-metal Vim installed by default on every Linux" complaint against stuffing too much config into Vim. Why bother using the barebones install when you can just scp a single binary over that contains everything, to literally any OS? Amazing.

That being said, the config is definitely highly personal — it would be amazing to have a set of scripts to compile one's own personal .vimrc and related config files (really, the entire .vim directory) into a single APE.

Re: Show HN: CuteVim – Portable Vim with a cute vimrc

#20

Post by csdvrx »

reissbaker wrote: post #19

This is sick and eliminates the "but I want my muscle memory to work on bare-metal Vim installed by default on every Linux" complaint against stuffing too much config into Vim. Why bother using the barebones install when you can just scp a single binary over that contains everything, to literally any OS ? Amazing. That being said, the config is definitely highly personal — it would be amazing to have a set of scripts…

> That being said, the config is definitely highly personal

I have very special preferences (like CHORDING EVERYWHERE! :) )

> it would be amazing to have a set of scripts to compile one's own personal .vimrc

Actually, I thought about people who may have different preferences!

If you want to do the same thing but with your own .vimrc, just check the "How can I make my own CuteVim APE?" section in the README (https://github.com/csdvrx/CuteVim?tab=readme-ov-file#how-can...)

This section documents the use of the refresh.sh script from https://github.com/csdvrx/CuteVim/blob/main/refresh.sh

> and related config files (really, the entire .vim directory) into a single APE.

I don't like having a billion files everywhere (like plugins/ etc) so I didn't think about that usecase, but that would be a great addition because most people have a .vim tree: even with my dislike for having too many files, I have myself a few in .vim/after/syntax/ (to apply italics to comments)

If you can contribute a script that converts your .vimrc and .vim/ tree into something that can be added to the APE, I'd be very happy to add it!

Post reply on HN