> We created the hackable text editor, Atom, and the pioneering software platform that launched an entirely new generation of desktop apps, Electron.
Zed Editor automatically downloads binaries and NPM packages without consent
11–20 of 183 posts
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#12I don't get why having a modal for each tool asking for consent is too hard.
[flagged]
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#13Earlier quoted context omitted.
Maybe make a cve out of it since it is an obvious exploit path running unchecked automatically downloaded binaries without user interference.
I don't know if this is sarcastic but doesn't a CVE require an actual proof of attack and not just hypothetical?
It was sarcastic but on point, and many cves do not have poc exploits so at best it is murky.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#14Re: Zed Editor automatically downloads binaries and NPM packages without consent
#15I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#16I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
What if one language server adds a function to use your code for AI training? Are you okay with that as long as it came as a gitthub binary?
And these modern editors introduce another issue with their modularazied design. For each supported language Vscode installs tons of other crap beside the language server itself. And the language server alone has a quite long list of dependencies
https://github.com/golang/vscode-go/blob/master/extension/go...
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#17I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.
Open it in something else then.
If you use Zed you must have known the language server was running when you tried it, how did you think that was happening?
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#18Re: Zed Editor automatically downloads binaries and NPM packages without consent
#19I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
GitHub release builds provide no whatsoever guarantee of having been built by GitHub from the corresponding source, if I remember correctly
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#20I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.
That’s a completely separate concern, it’s not like a new language server is downloaded for each file you open. I don’t know if Zed has a “safe mode” like some other editors, if it doesn’t you should ask for that instead. Unless of course you never open untrusted files in a language you’re familiar with, which would make you extremely peculiar.