Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

Post reply on HN
Print view View original

101–110 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#101

Post by brabel »

cedws wrote: post #38
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

I don’t want that. Popups are one of the reasons I stopped using VSCode. They drive me nuts. Just let me write code.

It annoys me a lot as well, though it took me a couple of minutes to turn off the popups.

Once you've done that, it's similar to emacs for me, everything has to be evoked via a shortcut (or Action Palette which works very well in VS Code). The shortcut to show "help" or "docs" is Cmd+K Cmd+I, by the way - easy to type and remember...

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#102

Post by michaelt »

jazzyjackson wrote: post #49
daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116

Is that something people really expect of their IDEs these days?

In my mind, an IDE needs to be able to read all the files I can read myself, it needs to be able run arbitary tools like compilers and linkers then run the resulting compiled code, it needs a debugger that can attach to running processes and mess with them, it needs to be able to pull from the language's package repository when you ask it to, it needs to talk to your git server when needed, it needs access to your SSH keys to do that. About the only thing the IDE doesn't need is to run as root - and if you're working with Docker it basically needs that too.

The idea of an IDE with pluggable language support safely running plugins from untrusted sources? I can't imagine how such a thing could even be possible?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#103

Post by api »

jazzyjackson wrote: post #49
daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116

The idea of everything on a system having open net access is going to have to go, not just for this reason but also privacy. It’s kind of amazing it’s still the default everywhere.

Also supply chain attacks are a freight train barreling down the tracks. The gate is down and the crossing bells are dinging but our car is stuck on the tracks.

Ever since the xz thing almost worked every black hat group on the entire planet is trying their hand at this. The days of software dev as a high trust environment are going to be over fast.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#104

Post by Dobbs »

Woshiwuja wrote: post #77
Dobbs wrote: post #58

Earlier quoted context omitted.

Just migrated from Vim to NeoVim. Downloading and configuring all the various LSPs has genuinely been one of the most frustrating aspects.

just use mason

mason can install them, but there isn't a way to "ensure-installed" built in. So that was a second package I needed. Then I needed a third package to configure things.

Maybe I'm missing something, but it was definitely more complicated than "just use mason".

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#105

Post by mrweasel »

vladvasiliu wrote: post #46
bilekas wrote: post #8

Earlier quoted context omitted.

I agree with you, it's a standalone package. It can be assumed to have some setup permissions. Also it's far better than the packaging the remote code with the installer or binary. The same people who will complain about this do t really understand how package managers work also. Take npm as an example, you manually install one package. You do not consent explicitly to have all of its dependencies added also. This so…

I don't use NPM, but that means NPM's behavior isn't that great and maybe shouldn't be an example for others to follow. Linux package managers with which I'm familiar will absolutely prompt you with the list of dependencies they'll install when you ask for some package and give you the possibility of bailing out.

From the report on Github it seems like Zed will also download LSP for other languages without prompting, so it is initially an issue with Zed, but enhanced by the fact that NPM is misused. It should be noted that other package managers can also run post install scripts.

That being said, I also don't use NPM and actively discard any software that requires me to run an NPM command. It's somewhat funny to me that people are complaining that Python have a package management problem, while we at the same time have NPM which basically took the ideas from Python and said "What if we made this worse?".

The worst NPM misuse, from my perspective, is people viewing NPM as a platform agnostic package manager. I can understand not wanting to build .deb, .rpm and Brew packages, but that doesn't mean that just plunking a pre-build binary into NPM is a good choice.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#106

Post by notorandit »

Being it binary or not, it doesn't make any difference.

It's the "modern times" craze about plugins pulled from different unauditable, unknown sources. The fact that it is on GitHub or any other "publicly available" source it is irrelevant.

I keep using vim and Kate and manually install anything I need form my distro (Arch Linux) repos. If it is not there, then, sorry I cannot use it.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#107

Post by andrepd »

daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

I just want a dumb text editor that doesn't bundle shitton of crap I don't want (like LLMs), doesn't phone home, isn't bloated and slow. I feel that still the only good editor that does this apart from vim+emacs is sublime text.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#108

Post by LightFog »

arp242 wrote: post #97
LightFog wrote: post #76

Earlier quoted context omitted.

Turning issue trackers into Emoji riddled social media platforms will do that alright.

What does that have to do with anything...?

It is easy to jump back and forward between this social media platform and the issue tracker. What do you think is incentivising the pitchforks you are complaining about - where do you think they want the angry mob to vent? The gamified issue tracker is where.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#109

Post by perryizgr8 »

There is a balance between asking too many confirmations and not asking at all. VS code had this feature called "Workspace Trust" or something like that. It was so incredibly annoying. Always asking me for my own repos or repos which are in my org, if I trust the authors. I ended up disabling it completely and it will remain that way. I hope Zed finds a way to strike the balance in a better way than bombarding the user with confirmations, otherwise I'll be completely disabling that too, probably to the detriment of the security of my computer.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#110

Post by arp242 »

LightFog wrote: post #108
arp242 wrote: post #97

Earlier quoted context omitted.

What does that have to do with anything...?

It is easy to jump back and forward between this social media platform and the issue tracker. What do you think is incentivising the pitchforks you are complaining about - where do you think they want the angry mob to vent? The gamified issue tracker is where.

There is nothing "gamified" about the issue tracker; it's just an issue tracker. The ability to vote is useful or many reasons and something many issue trackers have, going back decades. And these type of submissions happen with e.g. the Firefox bugzilla tracker too, and some other things.
Post reply on HN