131–140 of 183 posts
https://github.com/zed-industries/zed/discussions/6659
Where there is a VSCode theme importer for Zed.
And what it does is silently install a Home Brew package and attempt to execute it on your machine.
Zed is supposed to be a lightweigh and fast text editor. That was my hope when trying it. This is not the case. When I was editing some JS or HTML file I noticed that my laptop is quite warm. I checked all processes and there was some node process taking up 100% of one of CPUs. It was some language server running in the background in some non-efficient way. The problem with Zed is that its mission is to be "engineere…
Zed is supposed to be a lightweigh and fast text editor. That was my hope when trying it. This is not the case. When I was editing some JS or HTML file I noticed that my laptop is quite warm. I checked all processes and there was some node process taking up 100% of one of CPUs. It was some language server running in the background in some non-efficient way. The problem with Zed is that its mission is to be "engineere…
The language server isn't part of Zed though is it? You should report the issues on their github page.
The good thing is that this can be turned off with this option: "enable_language_server": false
Earlier quoted context omitted.
Jetbrains has a decent golang IDE. I don't use it because I use Vim. Vim's not for everyone.
I do the same (not for golang tho). However, vim plug-ins also "have network access", in fact they can just "system()" and call anything. No sandboxing at all. At least the source code of these plug-ins are not obfuscated/compressed. However, this makes me wonder how much of a surface attack this is.
Earlier quoted context omitted.
Quite. VSCode asks with a little pop-up in the bottom right (for me, on Gnome) when you open a project that might benefit from a particular component, and you can accept or decline it. It tells you what/why it's needed, it's up to you to accept or decline, but you should accept that things won't work well if you don't. I'm no Microsoft fan (quite the opposite), but VSCode handles this about as well as anything could.
except for giving network access to extensions having no way to audit if not open source.
This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.
I just want a dumb text editor that doesn't bundle shitton of crap I don't want (like LLMs), doesn't phone home, isn't bloated and slow. I feel that still the only good editor that does this apart from vim+emacs is sublime text.
Earlier quoted context omitted.
yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116
Is that something people really expect of their IDEs these days? In my mind, an IDE needs to be able to read all the files I can read myself, it needs to be able run arbitary tools like compilers and linkers then run the resulting compiled code, it needs a debugger that can attach to running processes and mess with them, it needs to be able to pull from the language's package repository when you ask it to, it needs t…
With some compilers leaning on user side, rather than system side, toolchain management (e.g. Rust), I would imagine that plugins managing that would be desirable as well.
Keep in mind, computers are about automation. We should be able to reap the benefits of that automation to the greatest degree possible. Alas, we can't due to bad actors.
I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
What's really funny is it was found because it was crashing and the user was running another libc. If they're really concerned about 14MB of download, they should add a firewall or something, but they saw it crashing. Finally, all these versions of everything sitting around, nodeJS, glibc, etc, very UNIX, a recipe for small breakages. Though I guess that's just the problem we deal with.
- Zed is (currently) free
- still pre 1.0 release
- being developed quickly by a small group of developers
As someone who's maintains OSS myself, the onslaught of people who can swarm in fast to piss on your hard/long efforts can demoralize you.
So let's be kind in our words (and tone) to these folks.