151–160 of 183 posts
This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.
I just want a dumb text editor that doesn't bundle shitton of crap I don't want (like LLMs), doesn't phone home, isn't bloated and slow. I feel that still the only good editor that does this apart from vim+emacs is sublime text.
This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.
I just want a dumb text editor that doesn't bundle shitton of crap I don't want (like LLMs), doesn't phone home, isn't bloated and slow. I feel that still the only good editor that does this apart from vim+emacs is sublime text.
Earlier quoted context omitted.
I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.
If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)
Earlier quoted context omitted.
I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.
If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)
Earlier quoted context omitted.
I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.
If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)
https://github.com/liveview-native/liveview-client-swiftui/p...
Compassion for those putting others in harms way is such a stupid take.
Earlier quoted context omitted.
I do the same (not for golang tho). However, vim plug-ins also "have network access", in fact they can just "system()" and call anything. No sandboxing at all. At least the source code of these plug-ins are not obfuscated/compressed. However, this makes me wonder how much of a surface attack this is.
Do you pin your plugins down to commit hash?
Now I just run `:PlugUpdate` and hope that whatever comes from GitHub, is seen by the manyeyeballs. I certainly don't check all the diffs.
Earlier quoted context omitted.
Yes, but you would have it for each time you opened a new workspace. The only point of this would be if you didn't want to download the language server for untrusted code. I think what people really want is workspace location permissions...
Wait, what. Why should you keep downloading Node per workspace? If you have one installed already?
The real problem is "running" the language server on untrusted code. That's where there should be a confirm dialog.
But it's a separate issue about workspace permissions.
That's the only vulnerability here and it exists on at least one some level in all editors in language servers. (VSCode's workspace permissions aren't that secure)
This was also documented here, nearly 1-year ago: https://github.com/zed-industries/zed/discussions/6659 Where there is a VSCode theme importer for Zed. And what it does is silently install a Home Brew package and attempt to execute it on your machine.
Only thing i found in your link that mentions this is about VSCode extension [0] - not Zed extension. How is that relevant here?
[0] https://marketplace.visualstudio.com/items?itemName=degreat....
With Zed, I have another issue. I don't understand which niche it is trying to fill. The advertising story doesn't convince me. The performance bottlenecks are typically the LSPs after all, not if text is rendered in 10 or 20 ms. Startup time is secondary. Yes, memory usage is a concern. I get that and that's where Zed is miles ahead of VS Code and Jetbrains IDEs. But overall I think:
- If you want easy and free, go VS Code.
- If you want ultimate IDE features and mouse and GUI, go Jetbrains.
- If you want ultimate productivity, follow this beautiful guide: https://lazyvim-ambitious-devs.phillips.codes/
Earlier quoted context omitted.
Just migrated from Vim to NeoVim. Downloading and configuring all the various LSPs has genuinely been one of the most frustrating aspects.
Then you’d click the „yes and never ask me again” if a prompt about whether you want to download a random binary showed up. But a lot of people wouldn’t want to click that and would either click „no and never ask me again” or vet each case one by one
It's not a "random binary" either, it's a hosted binary for language features coming from the zed developers github release.
Even if the binary was compiled on demand when you clicked the button, were you going to go through the entire source of node to verify?