Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

Post reply on HN
Print view View original

141–150 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#141

Post by broeng »

nijave wrote: post #117
broeng wrote: post #31

Earlier quoted context omitted.

The xz backdoor was an example of exploiting this disconnect. It was not present in the repository, it was inserted only into the release artifacts. Anyone getting xz by checking out the repository and building it themselves, would not be affected by it.

I think that's a slight mischaracterization. It was present in the repo but obfuscated and rigged to only apply in release artifacts. A sufficiently technical user could have found it but that bar was pretty high to clear.

I'm pretty sure that's incorrect. One portion of the build-to-host buildfile was only present in the release tarball.

https://www.openwall.com/lists/oss-security/2024/03/29/4

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#142

Post by anotherpov_ta »

michaelt wrote: post #102
jazzyjackson wrote: post #49

Earlier quoted context omitted.

yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116

Is that something people really expect of their IDEs these days? In my mind, an IDE needs to be able to read all the files I can read myself, it needs to be able run arbitary tools like compilers and linkers then run the resulting compiled code, it needs a debugger that can attach to running processes and mess with them, it needs to be able to pull from the language's package repository when you ask it to, it needs t…

Just adding another point of view.

I'm a data scientist, intrinsic to my job is to work with private data that is usually vital to the company or 3rd party, the thought of running any plugins/software from untrusted sources is just insane in this environment.

Basically anything that isn't in the internal repository is a big no, so that rules out the pulling from the language package repository.

Access to the git server is handled at network level outside the workstation, I can only access a few services anyway, not regular internet access, the ssh keys are only valid for a period of time & current project, preconfigured in an image.

Some of us just have different needs.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#143

Post by broeng »

andyferris wrote: post #94
broeng wrote: post #89

Earlier quoted context omitted.

I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.

NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.

It seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#144

Post by crimsonnoodle58 »

jazzyjackson wrote: post #49
daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116

At our org we run code-server in docker with no network access except pre-allowed DNS, and a white listed squid proxy, due to this.

It works really well for us and prevents potentially bad extensions, python libraries, etc exfilling our code, data, etc.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#145

Post by bcardarella »

alberth wrote: post #140

While I share similar concerns, I also want to point out that: - Zed is (currently) free - still pre 1.0 release - being developed quickly by a small group of developers For those of us who enjoy Zed, we should give appreciation for what they have created. As someone who's maintains OSS myself, the onslaught of people who can swarm in fast to piss on your hard/long efforts can demoralize you. So let's be kind in our…

I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#146

Post by alberth »

bcardarella wrote: post #145
alberth wrote: post #140

While I share similar concerns, I also want to point out that: - Zed is (currently) free - still pre 1.0 release - being developed quickly by a small group of developers For those of us who enjoy Zed, we should give appreciation for what they have created. As someone who's maintains OSS myself, the onslaught of people who can swarm in fast to piss on your hard/long efforts can demoralize you. So let's be kind in our…

I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.

If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion.

(It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#147

Post by KomoD »

mxsjoberg wrote: post #55
theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

> I don't really see the big deal here. Who wants to approve and configure all of their language servers? everyone > If you open a file for that language, is there ever a time you would deny the download? every time default should be offline imo. want to download something? do it manually and place in folder etc

> everyone

Not true, everyone is not you, I don't want to.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#148

Post by airhangerf15 »

AlexDragusin wrote: post #123
lpcvoid wrote: post #57

Earlier quoted context omitted.

I'd rather wish they hadn't to be honest

That's the point I was trying to make :)

I agree. Electron is cancer. They're proud of creating Javascript Cancer.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#149

Post by yamumsahoe »

alberth wrote: post #146
bcardarella wrote: post #145

Earlier quoted context omitted.

I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.

If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)

oh god, no. users exist to give you money and feedback, not emotional support.

when your software enters other people's personal devices, their concern is their safety, security, and privacy, not your feelings.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#150

Post by xpe »

xpe wrote: post #115

Zed is my favorite editor, but I'm not going to minimize concerns that people raise simply because I think the editor is stupefyingly awesome overall. Questions: What control does a user have right now over what gets installed automatically? What are the levers we can pull to get more control? (These levers include configuration options, pushing back on the project, and so on.) P.S. Not that this is an excuse, but VS…

Some highlights from the Github issues thread [1]:

> Ideally you would be able to turn off auto-download but still be able to use a [language server] if it’s already on the users system.

> There is not a binary choice between "friendly to end users" and "secure". You can have your cake and eat it too. The main thing that should be considered is less of a user facing popup or preference (where opt-in vs. opt-out is an issue, as is noise & friction), but developer facing options. If Zed offered compile time configuration this could be fixed to everybody's satisfaction. Distros could ship a pre-configured package with all the dependencies already provided so that the user experience is just "install and run" while also not having an app that downloads (or attempts to download) binaries behind teh users back. Meanwhile if Zed wants to ship a binary package upstream that defaults to downloading things they can.

[1]: https://github.com/zed-industries/zed/issues/12589

Post reply on HN