Zed Editor automatically downloads binaries and NPM packages without consent • Hacker News Board

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#111

Post by nijave » Mon, Jul 08, 2024, 11:11 AM UTC

karolist wrote: post #50

ayewo wrote: post #37

Earlier quoted context omitted.

No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?

I can confirm it is frustrating experience overall, I've moved on to GoLand and later to IntelliJ with Go plugin for Go development and never looked back. Sadly IDEA products fall apart for me in projects where multiple technologies are used, i.e. tailwind, Ruby, anything with JS, so I can't ditch VSCode yet...

If you're using IDEA with plugins for each technology you should be able to add submodules which get their own interpreter.

You may need to add interpreters first then there's a modules page in project settings you can select path and tool

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#112

Post by mapcars » Mon, Jul 08, 2024, 11:13 AM UTC

Zed is version 0.1-something, you can't expect them realistically have their own maintained packages at this stage. And these things do happen when you use software at the early stages, just wait for 1.0 and see what happens then.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#113

Post by nijave » Mon, Jul 08, 2024, 11:15 AM UTC

compootr wrote: post #21

theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge

>someone sends a dev at some company, or even a freelancer, some code

The code itself could be malicious and have backdoors. Really you shouldn't run anything untrusted outside a sandbox or some other form of isolation

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#114

Post by nijave » Mon, Jul 08, 2024, 11:17 AM UTC

broeng wrote: post #32

compootr wrote: post #21

Earlier quoted context omitted.

> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge

Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.

The package itself is arbitrary code. You're running arbitrary code either way whether it's preinstall, install, post install, or when the package code gets ran.

It's common to need to setup tool chains for code that gets compiled (i.e. a node module that adds language bindings to a C library)

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#115

Post by xpe » Mon, Jul 08, 2024, 11:21 AM UTC

Zed is my favorite editor, but I'm not going to minimize concerns that people raise simply because I think the editor is stupefyingly awesome overall.

Questions: What control does a user have right now over what gets installed automatically? What are the levers we can pull to get more control? (These levers include configuration options, pushing back on the project, and so on.)

P.S. Not that this is an excuse, but VS Code's security posture (sandboxing, prompting users, etc.) probably didn't happen overnight without user pressure. Who knows the history?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#116

Post by alfiedotwtf » Mon, Jul 08, 2024, 11:21 AM UTC

notorandit wrote: post #106

Being it binary or not, it doesn't make any difference. It's the "modern times" craze about plugins pulled from different unauditable, unknown sources. The fact that it is on GitHub or any other "publicly available" source it is irrelevant. I keep using vim and Kate and manually install anything I need form my distro (Arch Linux) repos. If it is not there, then, sorry I cannot use it.

This is a fallacy though, unless you’re also code reviewing all of the Archb libraries you pull down

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#117

Post by nijave » Mon, Jul 08, 2024, 11:24 AM UTC

broeng wrote: post #31

theultdev wrote: post #22

Earlier quoted context omitted.

So the worry is the Zed team themselves will inject something into the binary?

The xz backdoor was an example of exploiting this disconnect. It was not present in the repository, it was inserted only into the release artifacts. Anyone getting xz by checking out the repository and building it themselves, would not be affected by it.

I think that's a slight mischaracterization. It was present in the repo but obfuscated and rigged to only apply in release artifacts.

A sufficiently technical user could have found it but that bar was pretty high to clear.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#118

Post by nijave » Mon, Jul 08, 2024, 11:29 AM UTC

as-cii wrote: post #85

Hey, Antonio here. Co-founder at Zed. Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything. I agree that we should ask users for consent before downloading language servers (and other executables). For everybody who's come across the ticket here or on Reddit…

I think some middle ground might be including an extension lock file that gets committed to the repo. For internal projects, users will get auto configured by trusting the other internal users that setup the repo.

For external projects, users need to trust the project they're pulling down anyway since it's arbitrary code.

That would also help mitigate the risk of supply chain attacks (since versions are pinned and ideally verify package integrity)

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#119

Post by jarule » Mon, Jul 08, 2024, 11:32 AM UTC

This is why you never want to sell to developers.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#120

Post by myaccountonhn » Mon, Jul 08, 2024, 11:48 AM UTC

michaelt wrote: post #102

jazzyjackson wrote: post #49

Earlier quoted context omitted.

yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116

Is that something people really expect of their IDEs these days? In my mind, an IDE needs to be able to read all the files I can read myself, it needs to be able run arbitary tools like compilers and linkers then run the resulting compiled code, it needs a debugger that can attach to running processes and mess with them, it needs to be able to pull from the language's package repository when you ask it to, it needs t…

Well a permission model is one way, like OSes have. Another is something like elm with controlled effects, so you can just search the source code and see if something is off.