Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

Post reply on HN
Print view View original

161–170 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#161

Post by threatofrain »

bcardarella wrote: post #155
alberth wrote: post #146

Earlier quoted context omitted.

If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)

Actually, I'll do one better. For a rather large framework we are developing an engineer at DY introduced a somewhat similar problem. A binary was being installed, from a trusted source in this case but a binary was being compiled/installed none the less. It never made its way to an actual release and I personally took the time to change this approach so that we weren't installing binaries on people's machines withou…

For security, what’s the difference between prepackaging a binary vs downloading later?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#162

Post by bcardarella »

threatofrain wrote: post #161
bcardarella wrote: post #155

Earlier quoted context omitted.

Actually, I'll do one better. For a rather large framework we are developing an engineer at DY introduced a somewhat similar problem. A binary was being installed, from a trusted source in this case but a binary was being compiled/installed none the less. It never made its way to an actual release and I personally took the time to change this approach so that we weren't installing binaries on people's machines withou…

For security, what’s the difference between prepackaging a binary vs downloading later?

Vendoring the binary guarantees that I control what is running. It isn't installed, just run locally from the lib. I'll quote the OP issue on GH:

> Now I found that it downloads (here) even some proprietary binary from https://supermaven.com, i.e. unaudited and unauditable code, without any verification (except TLS)!

This opens Zed up to Man In The Middle attacks and Supply Chain attacks. And now that Zed has indicated that they won't fix the door is wide open to these vulnerabilities.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#163

Post by mardifoufs »

zokier wrote: post #3

[flagged]

And everything is now a "cyber security flaw" or exploit. I don't know why but it seems like there's been a recent crop of less technical people that know just enough to throw around cybersec buzzwords that are completely meaningless in context. Like I've seen people call this an exploit or a code execution vuln (on other platforms). Like what the hell.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#165

Post by jazzyjackson »

michaelt wrote: post #102
jazzyjackson wrote: post #49

Earlier quoted context omitted.

yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116

Is that something people really expect of their IDEs these days? In my mind, an IDE needs to be able to read all the files I can read myself, it needs to be able run arbitary tools like compilers and linkers then run the resulting compiled code, it needs a debugger that can attach to running processes and mess with them, it needs to be able to pull from the language's package repository when you ask it to, it needs t…

Having network access from within the IDE so I can use tools that reach out to package managers and remote git servers - yes, of course that is expected behavior.

If I want to install an extension that gives me syntax highlighting and code intelligence for an obscure template language, why should I expect that extension to have unfettered network access to exfiltrate my ptivate files?

Like the dead guy said, when working with private customer data it's just not on the table to take the risk, I am stuck running vanilla vs code.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#166

Post by [deleted] »

crimsonnoodle58 wrote: post #144
jazzyjackson wrote: post #49

Earlier quoted context omitted.

yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116

At our org we run code-server in docker with no network access except pre-allowed DNS, and a white listed squid proxy, due to this. It works really well for us and prevents potentially bad extensions, python libraries, etc exfilling our code, data, etc.

[deleted]

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#167

Post by chillfox »

DangitBobby wrote: post #130
chillfox wrote: post #80

Earlier quoted context omitted.

I can't remember the last time I saw a popup in vscode, maybe last year.

Do you use it?

Every day. Guess I just configured it differently to how most people do it.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#168

Post by chillfox »

brabel wrote: post #98
chillfox wrote: post #75

Earlier quoted context omitted.

I usually don't use language servers at all. AI auto complete does the same for me faster... So yes, I would like to not download any of them.

IntelliJ now comes by default with a local-only AI auto-completer. I noticed that almost always, it "knows" the autocompletion better than the older intellisense. However, sometimes (very often) you need to explore the API and just check every available method and check their docs to find which one is appropriate to use. So, even though I can see AI replacing a lot of auto-completions, it just can't replace it comple…

Guess it depends on upon what you do.

I mostly make crud endpoints, so I can remember most of what I need. And for the times when I can't I prefer to view the API docs in a browser.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#169

Post by DangitBobby »

chillfox wrote: post #167
DangitBobby wrote: post #130

Earlier quoted context omitted.

Do you use it?

Every day. Guess I just configured it differently to how most people do it.

I see a pop up for an update or extension that isn't working anymore pretty much every time I open it.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#170

Post by alfiedotwtf »

zamadatix wrote: post #126
alfiedotwtf wrote: post #116

Earlier quoted context omitted.

This is a fallacy though, unless you’re also code reviewing all of the Archb libraries you pull down

I think the main add of distro repositories is the repo maintainers sit as a review step between you and the project updates on e.g. GitHub, not that it enables you to better audit the code yourself. I'm not sure it's really all that effective in practical terms though.

Distros raise the probability that something will get caught, but it’s only that - increasing your chances not getting pwned… it’s still not bulletproof
Post reply on HN