Zed Editor automatically downloads binaries and NPM packages without consent
1–10 of 183 posts
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#2I don't get why having a modal for each tool asking for consent is too hard.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#3[flagged]
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#4I don't get why having a modal for each tool asking for consent is too hard.
Because people want a fast out of the box editing experience. Not clicking yes for every language server.
But what they should have is a CDN with their own extensions and verified binaries. This way they can ship new versions of extensions without bumping their editor version.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#5[flagged]
Maybe make a cve out of it since it is an obvious exploit path running unchecked automatically downloaded binaries without user interference.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#6I don't get why having a modal for each tool asking for consent is too hard.
Because it would turn into the popup fest that is vscode.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#7I don't really see the big deal here. Who wants to approve and configure all of their language servers?
If you open a file for that language, is there ever a time you would deny the download?
I just don't want a huge amount of popups like VSCode.
Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#8[flagged]
I agree with you, it's a standalone package. It can be assumed to have some setup permissions. Also it's far better than the packaging the remote code with the installer or binary.
The same people who will complain about this do t really understand how package managers work also. Take npm as an example, you manually install one package. You do not consent explicitly to have all of its dependencies added also.
This sounds like typical Reddit behaviour.
As you said, a better approach would have been to ask the maintainers to mention it in the readme. No drama required.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#9This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.