Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

Post reply on HN
Print view View original

21–30 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#21

Post by compootr »

theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

> I don't really see the big deal here

Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed

Now, my untrusted code is running on your machine, probably without your knowledge

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#22

Post by theultdev »

g-b-r wrote: post #19
theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

GitHub release builds provide no whatsoever guarantee of having been built by GitHub from the corresponding source, if I remember correctly

So the worry is the Zed team themselves will inject something into the binary?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#24

Post by lucianbr »

theultdev wrote: post #17
eptcyka wrote: post #15

Earlier quoted context omitted.

Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.

Open it in something else then. If you use Zed you must have known the language server was running when you tried it, how did you think that was happening?

This kind of article or reddit post and discussion is how you know, at least for some people.

Anyway, you asked who would care. Now the topic has moved to "what to do about it", which is hardly an issue. Of course people who think Zed has a problem will not use it. That does not make it a non-problem.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#25

Post by mhd »

whazor wrote: post #4
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

Because people want a fast out of the box editing experience. Not clicking yes for every language server. But what they should have is a CDN with their own extensions and verified binaries. This way they can ship new versions of extensions without bumping their editor version.

> Not clicking yes for every language server.

How many language servers are we talking about here for the average dev? Three?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#26

Post by theultdev »

lucianbr wrote: post #24
theultdev wrote: post #17

Earlier quoted context omitted.

Open it in something else then. If you use Zed you must have known the language server was running when you tried it, how did you think that was happening?

This kind of article or reddit post and discussion is how you know, at least for some people. Anyway, you asked who would care. Now the topic has moved to "what to do about it", which is hardly an issue. Of course people who think Zed has a problem will not use it. That does not make it a non-problem.

tbh this "article" looks a lot like a reddit outrage post.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#27

Post by lucianbr »

consp wrote: post #12
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

[flagged]

"Action would be too difficult / we don't like it" =/= "there is no action available".

This is just refusing to take responsibility for their decision. "We don't feel like doing it" is the truth, and it would be best to state it plainly. Of course there is no obligation to do otherwise, which makes it strange to play with words.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#28

Post by theultdev »

mhd wrote: post #25
whazor wrote: post #4

Earlier quoted context omitted.

Because people want a fast out of the box editing experience. Not clicking yes for every language server. But what they should have is a CDN with their own extensions and verified binaries. This way they can ship new versions of extensions without bumping their editor version.

> Not clicking yes for every language server. How many language servers are we talking about here for the average dev? Three?

Yes, but you would have it for each time you opened a new workspace.

The only point of this would be if you didn't want to download the language server for untrusted code.

I think what people really want is workspace location permissions...

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#29

Post by pjmlp »

daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#30

Post by juliangmp »

daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

Not sure if it was always like that, the C/C++ extension used to download the language server and some tools during startup as well. They now bundle it with the extension, which is a lot better especially in an offline environment.
Post reply on HN