171–180 of 183 posts
Earlier quoted context omitted.
Every day. Guess I just configured it differently to how most people do it.
I see a pop up for an update or extension that isn't working anymore pretty much every time I open it.
Earlier quoted context omitted.
yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap. https://github.com/microsoft/vscode/issues/52116
The idea of everything on a system having open net access is going to have to go, not just for this reason but also privacy. It’s kind of amazing it’s still the default everywhere. Also supply chain attacks are a freight train barreling down the tracks. The gate is down and the crossing bells are dinging but our car is stuck on the tracks. Ever since the xz thing almost worked every black hat group on the entire plan…
That's good
Quite tired of being the only one in my org with outbound firewall rules
Earlier quoted context omitted.
I think that's a slight mischaracterization. It was present in the repo but obfuscated and rigged to only apply in release artifacts. A sufficiently technical user could have found it but that bar was pretty high to clear.
I'm pretty sure that's incorrect. One portion of the build-to-host buildfile was only present in the release tarball. https://www.openwall.com/lists/oss-security/2024/03/29/4
>This injects an obfuscated script to be executed at the end of configure. This script is fairly obfuscated and data from "test" .xz files in the repository.
>The files containing the bulk of the exploit are in an obfuscated form in tests/files/bad-3-corrupt_lzma2.xz tests/files/good-large_compressed.lzma committed upstream
Hey, Antonio here. Co-founder at Zed. Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything. I agree that we should ask users for consent before downloading language servers (and other executables). For everybody who's come across the ticket here or on Reddit…
Earlier quoted context omitted.
GitHub release builds provide no whatsoever guarantee of having been built by GitHub from the corresponding source, if I remember correctly
Ah, I think you might be pleasantly surprised that this is an area being focused on right now with attestations[1] for example, here are the attestations for the GitHub CLI[2]. 1: https://github.blog/2024-05-02-introducing-artifact-attestat... 2: https://github.com/cli/cli/attestations
This looks so complex that it might well be just smoke and mirrors
I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
> I don't really see the big deal here. Who wants to approve and configure all of their language servers? everyone > If you open a file for that language, is there ever a time you would deny the download? every time default should be offline imo. want to download something? do it manually and place in folder etc
absolutely incorrect, i loved that it does it for me and do not care even in the slightest and in fact this is 1000x preferable to vscode asking me.
what on earth made you think this was a reasonable reply.
Earlier quoted context omitted.
If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)
oh god, no. users exist to give you money and feedback, not emotional support. when your software enters other people's personal devices, their concern is their safety, security, and privacy, not your feelings.
Earlier quoted context omitted.
> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge
How is that any different from the VS Code extensions that have one star and are just copies of other extensions… waiting to get high stars and then switch-a-roo? Same goes for browser extensions. Unless you’re auditing everything while taking Trusting Trust into account, you’re drawing the line somewhere saying “ok I can’t be bothered past this point verifying”. … everyone has a line somewhere on the trust-but-verif…
Sure, and by making the automatic downloads optional, users are given the choice of where they want to draw that line.