Mad Bugs: Vim vs. Emacs vs. Claude

> How do we professional bug hunters make sense of this? This feels like the early 2000s. Back then a kid could hack anything, with SQL Injection. Now with Claude.

Lack of accountability.

With other industries, when people aren't happy with their products, they ask for money back, they sue, they switch to the competition.

There are no EULA that assert removal of customer rights if the product is acquired.

Re: Mad Bugs: Vim vs. Emacs vs. Claude

#5

Post by zingar » Wed, Apr 01, 2026, 6:40 AM UTC

pjmlp wrote: post #4

> How do we professional bug hunters make sense of this? This feels like the early 2000s. Back then a kid could hack anything, with SQL Injection. Now with Claude. Lack of accountability. With other industries, when people aren't happy with their products, they ask for money back, they sue, they switch to the competition. There are no EULA that assert removal of customer rights if the product is acquired.

I don’t understand the connection to the post, could you elaborate?

Re: Mad Bugs: Vim vs. Emacs vs. Claude

#6

Post by normie3000 » Wed, Apr 01, 2026, 6:41 AM UTC

I'd be interested to understand what modelines are for, and if this is a class of bug that can be disabled via vim settings. Also, are there editors which could not be affected by this class of bug?

Re: Mad Bugs: Vim vs. Emacs vs. Claude

#7

Post by snarf_br » Wed, Apr 01, 2026, 6:41 AM UTC

grimm8080 wrote: post #2

What does RCE mean?

Remote Code Execution, which this isn't, in both cases.

It is code execution.

Re: Mad Bugs: Vim vs. Emacs vs. Claude

#8

Post by chrismorgan » Wed, Apr 01, 2026, 6:42 AM UTC

grimm8080 wrote: post #2

What does RCE mean?

RCE stands for Remote Code Execution: being able to trigger arbitrary code execution (ACE) from a remote machine.

This, however, is mislabelled: it’s not remote code execution at all, only local. It would only become RCE if there was some path to remotely triggering Vim to open the attack file, or Emacs the attack repository, or if a normal way of fetching a repository automatically set up and executed the hook.

Re: Mad Bugs: Vim vs. Emacs vs. Claude

#9

Post by normie3000 » Wed, Apr 01, 2026, 6:46 AM UTC

normie3000 wrote: post #6

I'd be interested to understand what modelines are for, and if this is a class of bug that can be disabled via vim settings. Also, are there editors which could not be affected by this class of bug?

Struggling to find a source, but apparently modelines are disabled by default in debian and perhaps other common distros.

Re: Mad Bugs: Vim vs. Emacs vs. Claude

#10

Post by 000ooo000 » Wed, Apr 01, 2026, 6:47 AM UTC

tldr

    /* vim: set showtabpanel=2 tabpanel=%{%autocmd_add([{'event'\:'SafeStateAgain','pattern'\:'*','cmd'\:'!id>/tmp/calif-vim-rce-poc','once'\:1}])%}: */