Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edit

github.com

Post reply on HN
Print view View original

61–70 of 337 posts

Re: Microsoft Edit

#61

Post by ToValueFunfetti »

tim-- wrote: post #54
ocdtrekkie wrote: post #52

Earlier quoted context omitted.

Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion. There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.

> in a reasonably secure fashion It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/ There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into mo…

The parent is talking about MITM, which is prevented with TLS and curl but not winget. They are saying curl is strictly better, not that it is impenetrable. If you trust the domain owner, you can trust curl | bash, but you can't trust winget

Re: Microsoft Edit

#62

Post by watusername »

xyst wrote: post #49

It will take more than nostalgia and rust to tear me away from my neovim setup that has been built up/improved on over the years. Lsp, dap, autocompletion, aliases and bindings for each programming languages. Lazily loaded of course so it’s still snappy. Manage configuration, and external dependencies such as lsps with nix. Then have separate nix shells for each project to load tooling and other dependencies in an is…

You are not the target audience. This is aimed at casual users and beginners, and it's already in a good shape to replace nano with its user-friendly, mouse-enabled TUI.

Re: Microsoft Edit

#63

Post by wenc »

electroly wrote: post #56
jksmith wrote: post #19

This is just a "because I wanted to" project. And I get that; done a lot of those myself just to understand what the hell was going on. But the rewrite of turbo vision into FPC and compiling to half a dozen targets has been around for 20 years. Turbo vision is probably the best text mode windowing library in existence. The cool fun kicks in when you can map a whole text screen to an array like so: var Screen: Array[1…

Every time I see a new modern TUI framework, my disappointment is the same: "Oh. This isn't as good as Turbo Vision."

Turbo Vision was truly immersive. I used it in Turbo C and also in Paradox 4.5.

So good.

Re: Microsoft Edit

#64

Post by WD-42 »

_verandaguy wrote: post #28
WD-42 wrote: post #18

Earlier quoted context omitted.

Who cares? It’s fun. Programming can be fun.

I'm not saying that doing this can't be fun, or even good to learn off of, but when it's touted as a feature or a spec, I do have to ask if it's a legitimate point. If you build the world's widest bike, that's cool, and I'm happy you had fun doing it, but it's probably not the most useful optimization goal for a bike.

Not a great analogy. This editor is really fast. Speed is important, to a point. But having more of it isn't going to hurt anything. It is super fun to write fast code though.

Re: Microsoft Edit

#65

Post by tim-- »

ToValueFunfetti wrote: post #61
tim-- wrote: post #54

Earlier quoted context omitted.

> in a reasonably secure fashion It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/ There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into mo…

The parent is talking about MITM, which is prevented with TLS and curl but not winget. They are saying curl is strictly better, not that it is impenetrable. If you trust the domain owner, you can trust curl | bash, but you can't trust winget

Why can't I trust winget?

It's not hard to run the `show` command to see what a winget install will do. https://learn.microsoft.com/en-us/windows/package-manager/wi...

It's easy enough to view the manifests (eg, https://github.com/microsoft/winget-pkgs/blob/2ecf2187ea0bf1...) and arguably, is better then the protection for MITM that you would get using naked cURL & Bash, simply because there are file hashes for all of the installer files provided by a third party.

> They are saying curl is strictly better, not that it is impenetrable

Right. But it arguably is not strictly better.

> You can't trust winget

Again, this is not backed up by anything. I have trust in winget. I can trust that the manifest has at least been vetted by a human, and that the application that will be installed should be the one that I requested. I can not trust that this will happen with curl | bash. If the application that is installed is not the one that I requested, there is tooling a process to sort out why that did not happen, and a way to flag it so that it doesn't happen to other users. I don't have this with curl | bash.

Re: Microsoft Edit

#69

Post by bee_rider »

tim-- wrote: post #54
ocdtrekkie wrote: post #52

Earlier quoted context omitted.

Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion. There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.

> in a reasonably secure fashion It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/ There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into mo…

>> Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion.

> It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline.

I’m confused by this; it seems to be written in the tone of a correction but you both seem to be saying that you get whatever the server sends. (?)

Re: Microsoft Edit

#70

Post by mikepurvis »

kevin_thibedeau wrote: post #23
cosignal wrote: post #6

Earlier quoted context omitted.

Yeah ... I don't think there's any overlap between "users largely unfamiliar with terminals" who want something easy to use, and 'Linux users who are sufficiently technical that they would even hear about this repo'.

There's no shortage of less technical people using nano for editing on Linux servers. Something even more approachable than that would have a user base.

Especially noting it's a single binary that's just 222kb on x86_64— that's an excellent candidate to become an "installed by default" thing on base systems. Vim and emacs are both far too large for that, and even vim-tiny is 1.3MB, while being considerably more hostile to a non-technical user than even vim is.

I can definitely see msedit having a useful place.

Post reply on HN