Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have officially retired from Emacs

nullprogram.com

Post reply on HN
Print view View original

201–210 of 221 posts

Re: I have officially retired from Emacs

#201

Post by i_think_so »

SoftTalker wrote: post #126
Blackthorn wrote: post #72

Earlier quoted context omitted.

Emacs has full system access with arbitrary execution so full emacs access -> full system access.

What? You run emacs as root? Anything an LLM does on your computer should happen it its own account. No sudo config of course, or at most one that is strictly limited to what you want to allow it to do (risk here, as many programs have non-obvious paths to general command execution). It should have zero access to your private home directory or your system configs. You can have access to its files of course. That's th…

How many devs really do run damned near everything from a single account that also has sudo/runas/various_osx_methods access? This threat model has a decidedly non-zero target market.

Even those folks who are cautious enough to require passwords (sudo or plain su) to elevate are still at risk of having their account thoroughly brought under control of an attacker. Just imagine what a baddie could inject into your .bashrc if your editor can change it.

If you run your clanker-controlled emacs in console mode under a restricted user account, best case scenario, system compromise is only one unpatched privesc vuln away from Shai-Hulud completely pwning you.

Doing it in a locked down VM is much better but even then you're only better off by matter of degrees than if you had done a yolo curl - | bash because VM host attacks and even escapes are very much a thing.

These HNers expressing concern about giving a LLM control of an editor are 100% thinking rightly.

Re: I have officially retired from Emacs

#202

Post by i_think_so »

habinero wrote: post #110
iLemming wrote: post #81

Earlier quoted context omitted.

So? My terminal has the same full system access. If I didn't use Emacs, I'd be using Claude code in it. It's contained locally on my computer, I don't see any problem here. I use Emacs like my OS-layer. Why would I complain that my OS has access to something? It would be weird and annoying if it's the opposite.

Yeah, that's incredibly unsafe. You made a footgun machine and you're firing it with no shoes on. Don't run that on any machine with credentials you care about. At the very least, run it in Docker. It's not a security tool, but it's at least some kind of guardrail against data loss and exfiltration.

> It's not a security tool,

Amen to that, brother.

I'm sure somebody can google up a better example page than this. https://web.archive.org/web/20260322141827/https://www.simpl...

Re: I have officially retired from Emacs

#203

Post by i_think_so »

iLemming wrote: post #196
habinero wrote: post #110

Earlier quoted context omitted.

Yeah, that's incredibly unsafe. You made a footgun machine and you're firing it with no shoes on. Don't run that on any machine with credentials you care about. At the very least, run it in Docker. It's not a security tool, but it's at least some kind of guardrail against data loss and exfiltration.

> Yeah, that's incredibly unsafe. Having a browser on your machines is unsafe. The browser is a massively more dangerous attack surface than an Emacs-based LLM tool. What I have is a curated set of Lisp functions exposed to an LLM through a protocol I control, running in a single-user process, on my machine, behind my firewall. The attack surface is comically small by comparison.

Any browser that I trust to not instantly[1] eat my face has sandboxing features to at least pretend it wants to be secure. I'm not aware of any text editor that has built in anything of the sort.

It's a nice habit to get into if you can bring yourself to firejail your editor to $HOME/jail and keep all your r/w files in $HOME/jail/Documents and such. But only the most socially unacceptable of paranoid sysadmins do that. Ahem.

[1] FF/Chrome/javascriptless ones. The others are put in prison with no chance of parole and strict visitation policies.

Re: I have officially retired from Emacs

#204

Post by i_think_so »

habinero wrote: post #138
iLemming wrote: post #134

Earlier quoted context omitted.

Ah come on, guys, let's talk pragmatically. "Malleable editor as an OS layer" has benefits beyond subjective reasoning. Emacs has had M-x shell-command and arbitrary elisp eval forever. A metacircular MCP isn't some new capability class. Even if I didn't use Emacs - my shell, my editor, my browser extensions, my npm install, my VSCode plugins, my curl | bash from yesterday - they all have the same access. Singling ou…

It's your computer and you can do whatever yolo nonsense you want, my dude, but put those goalposts back where they were. "Don't run that shit on a credentialed box with data you care about" is addressing real threats, not some goofy nation state thing or abstract security research. If you let the footgun machine constantly generate new code and run it on your computer, you're just asking for data loss and bad shit t…

> That's not paranoia, that's, like, normal.

For some of us. Unfortunately, not enough... :sad keanu:

(...or security wouldn't be such a widespread problem)

Re: I have officially retired from Emacs

#205

Post by i_think_so »

kqr wrote: post #139
krautsauer wrote: post #107

Earlier quoted context omitted.

We're talking about https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim... ? One example: it disables the default Ctrl-F search function but its own search function is subpar (no match counts/hlsearch, e.g.) and often clashes with website's built-in search (on Github, e.g.). It doesn't work on the default newtab either, and changing the default newtab somehow makes opening a new tab slower (that's FF's fault…

You can type /phrase and then press ctrl-F for the full search bar. A more annoying problem is that some websites capture / presses, making it harder to initiate a page search. Then you have to shift-esc ctrl-f to search.

THANK YOU! I never knew those little quality of life hacks. I am going to beat them into my brain so I never forget them, and I suspect each time I use them I will remember the nice strange from HN who made it possible. <3

Re: I have officially retired from Emacs

#206

Post by i_think_so »

iLemming wrote: post #197
fingerlocks wrote: post #99

Earlier quoted context omitted.

can you elaborate? Heavy vim user here, have considered using emacs in vim mode to quell a decades long nagging curiosity. Just need a compelling nudge.

I'm a die-hard vimmer. I use vim motions in my editors, my IDEs, my browsers, my WMs, my terminals. I use vim-like navigation system-wide - e.g. for the volume control I switch to "media" mode and press "j/k". Neovim is great, I use it almost every day. But it just can't replace Emacs. That is the most annoying part of Emacs - there's simply no alternative to it. If you accept it with all its quirks and weirdness and…

Whoa. iLemming, I dub thee eLemming -- for Elite. Even among the everything-in-emacs crowd, that is some impressive next level stuff right there.

In the past I've investigated emacs enough to appreciate that asking someone for their emacs config is a mix of Futile + Way Too Personal + Too Much Work (on their part, explaining etc). But do you perhaps have a blog or something somewhere about your setup, so noobs who aspire to that kind of emacsdom could get an idea of what is possible and how you're doing it?

Re: I have officially retired from Emacs

#207

Post by i_think_so »

johntash wrote: post #154
fingerlocks wrote: post #99

Earlier quoted context omitted.

can you elaborate? Heavy vim user here, have considered using emacs in vim mode to quell a decades long nagging curiosity. Just need a compelling nudge.

If you haven't used it before, give it a shot. Worst case you waste a few years of your life. Doom emacs and Spacemacs are both good starter kits to give you an idea of what you could do.

> Worst case you waste a few years of your life.

Yeah, come on. NBD yo.

;-)

Re: I have officially retired from Emacs

#208

Post by uint32_t »

iLemming wrote: post #80
devin wrote: post #55

Earlier quoted context omitted.

Big same. I have been doing a lot of clojure development, and hooking up my app to a live REPL has given me an absolutely fantastic feedback loop for the LLM. I don't think a lot of people understand what they're missing.

> I don't think a lot of people understand what they're missing Very true. There's an enormous tacit knowledge gap. Check this out: I have to use Mac for work. My WM is Yabai, which is controlled via Hammerspoon (great tool on its own), which means I can use Fennel, which means I can have a Lisp REPL. MCP connected to that REPL can query and inspect every single window I have on my screen. It can move them around, it…

This is very interesting! I've played around with Hammerspoon for a bit but nowhere near this level. Do you have a link to your config or could you give me a bit more detail on your setup?

Re: I have officially retired from Emacs

#209

Post by wwarner »

fingerlocks wrote: post #99
wwarner wrote: post #70

My usage of emacs is so vim-like that I’ve tried switching a few times. Vim is definitely faster, and overlays and cursor placement is much simpler and more intuitive. But there were still feature gaps and configuration issues that prevented full adoption.

can you elaborate? Heavy vim user here, have considered using emacs in vim mode to quell a decades long nagging curiosity. Just need a compelling nudge.

I run emacs without graphics from this docker image i maintain https://hub.docker.com/r/wwarner/emacs-native

I just use emacs for programming, not note taking or email reading or the other things people love it for. Strengths: magit, wgrep, vterm, buffer management, plugins & packaging. Weaknesses, irritations, embarrassments: yaml-mode, responsiveness, overlays & mini-buffers.

Re: I have officially retired from Emacs

#210

Post by h3lp »

SoftTalker wrote: post #126
Blackthorn wrote: post #72

Earlier quoted context omitted.

Emacs has full system access with arbitrary execution so full emacs access -> full system access.

What? You run emacs as root? Anything an LLM does on your computer should happen it its own account. No sudo config of course, or at most one that is strictly limited to what you want to allow it to do (risk here, as many programs have non-obvious paths to general command execution). It should have zero access to your private home directory or your system configs. You can have access to its files of course. That's th…

In the interconnected, online world, you can do more damage without root access

     "they can read my email, take my money, and impersonate me to my friends, but at least they can't install drivers without my permission"

   https://xkcd.com/1200/
Post reply on HN