Earlier quoted context omitted.
> I don't think a lot of people understand what they're missing Very true. There's an enormous tacit knowledge gap. Check this out: I have to use Mac for work. My WM is Yabai, which is controlled via Hammerspoon (great tool on its own), which means I can use Fennel, which means I can have a Lisp REPL. MCP connected to that REPL can query and inspect every single window I have on my screen. It can move them around, it…
This is very interesting! I've played around with Hammerspoon for a bit but nowhere near this level. Do you have a link to your config or could you give me a bit more detail on your setup?
I have officially retired from Emacs
211–220 of 221 posts
Re: I have officially retired from Emacs
#212Earlier quoted context omitted.
> Yeah, that's incredibly unsafe. Having a browser on your machines is unsafe. The browser is a massively more dangerous attack surface than an Emacs-based LLM tool. What I have is a curated set of Lisp functions exposed to an LLM through a protocol I control, running in a single-user process, on my machine, behind my firewall. The attack surface is comically small by comparison.
Any browser that I trust to not instantly[1] eat my face has sandboxing features to at least pretend it wants to be secure. I'm not aware of any text editor that has built in anything of the sort. It's a nice habit to get into if you can bring yourself to firejail your editor to $HOME/jail and keep all your r/w files in $HOME/jail/Documents and such. But only the most socially unacceptable of paranoid sysadmins do th…
A browser's sandbox exists because it routinely executes arbitrary code from untrusted remote origins. Emacs (or any other editor) with an LLM integration does not fetch and auto-execute code from random origins. Your firejail point proves too much, even though the idea sure is riveting. By that logic, my shell is also catastrophically insecure - it can rm -rf /, read my ssh keys, send some files anywhere. Yet nobody seriously argues shells need browser-style sandboxing. The implicit trust model is different: these are tools where you control what runs.
Yes, there are prompt injection risks, they are legit but that's the property of the LLM, not Emacs. A browser sandbox protects you from code you never chose to run. An editor integration runs code you asked for. These are different problems requiring different mitigations.
You guys keep patronizing me on this, you think I'm some truck driver/florist/butcher by day, and I put on my amateur coder suit at night? Just so you know, I spent years working on security.cisco.com team and went through SANS training and certification. Ever occurred to you that just maybe, perhaps, potentially, theoretically, hypothetically - I'm not completely, utterly ignorant about all this shit?
Re: I have officially retired from Emacs
#213Earlier quoted context omitted.
I'm a die-hard vimmer. I use vim motions in my editors, my IDEs, my browsers, my WMs, my terminals. I use vim-like navigation system-wide - e.g. for the volume control I switch to "media" mode and press "j/k". Neovim is great, I use it almost every day. But it just can't replace Emacs. That is the most annoying part of Emacs - there's simply no alternative to it. If you accept it with all its quirks and weirdness and…
Whoa. iLemming, I dub thee eLemming -- for Elite. Even among the everything-in-emacs crowd, that is some impressive next level stuff right there. In the past I've investigated emacs enough to appreciate that asking someone for their emacs config is a mix of Futile + Way Too Personal + Too Much Work (on their part, explaining etc). But do you perhaps have a blog or something somewhere about your setup, so noobs who as…
Wow, thank you of course, but honestly, you're giving me way too much credit. None of this stuff I mentioned requires some special skills - most of it is about finding the right package and installing it. My Emacs config is here¹ - there's nothing to hide there, it's all pretty much public knowledge.
- Org-Roam is a widely known and popular package. However, I moved to Vulpea, because it has much faster and improved indexing. Over the years I have accumulated few thousand notes and vanilla Org-Roam indexing became a bottleneck.
- For spaced repetition I use anki-editor and some yasnippet templates to quickly create cards. There exist multiple packages for Anki and other kind of cards.
- Tangling dotfiles (or any files) from Org is a known trick. Many manage their Emacs configs that way
- API investigations are a bunch of Org-mode source blocks. I use ob-http and verb.el
- For Reddit and Hackernews, I use hnreader and reddigg with some customizations on top
- For email I use notmuch. Some prefer mu4e
- For Telegram - telega.el
- For universal search - consult-omni
- For writing - mw-thesaurus, jinx, define-it, wiktionary-bro, google-translate, sdcv
- For LLMs - gptel-agent and ECA
- For PRs - code-review.el
- For watching videos a custom transient atop mpv.el
- For browser history - browser-hist.el
- Last two pieces are of my own doodling, you can find them in my config - I keep procrastinating, I need to make them into separate packages.
No, I do not have a blog - I'm a peculiar writer. Like Russians say: writing is like pissing - you should do it only when you can't hold it anymore². I guess I'm not there yet. I do occasionally publish some YouTube vids, I have a channel with a pretentious name³.
Feel free to ping me with any questions, it will be a real pleasure to be of help . I'm sure you can find a way to contact me directly - I'm pretty easy to find.
---
¹ https://github.com/agzam/.doom.d
² "to write" and "to piss" in Russian is the same word - писать. The difference only in pronouncing.
Re: I have officially retired from Emacs
#214Earlier quoted context omitted.
What? You run emacs as root? Anything an LLM does on your computer should happen it its own account. No sudo config of course, or at most one that is strictly limited to what you want to allow it to do (risk here, as many programs have non-obvious paths to general command execution). It should have zero access to your private home directory or your system configs. You can have access to its files of course. That's th…
How many devs really do run damned near everything from a single account that also has sudo/runas/various_osx_methods access? This threat model has a decidedly non-zero target market. Even those folks who are cautious enough to require passwords (sudo or plain su) to elevate are still at risk of having their account thoroughly brought under control of an attacker. Just imagine what a baddie could inject into your .ba…
This is a textbook motte-and-bailey. You're telescoping threat escalation - chaining together "what if" steps until everything sounds equally catastrophic:
"Your editor can write to .bashrc. Therefore an attacker controls your shell. You probably have sudo. Therefore full system compromise. Even a VM does not help because VM escapes exist. Therefore this is basically curl|bash."
By this reasoning, every program you run under your user account is equally dangerous. Your shell, your file manager, git, make, pip install, npm install, docker, any program that writes files. The argument proves too much, therefore proves nothing.
This is all unhinged poetry - philosophical argy-bargy without any concrete, well-grounded argumentation. I'm just baffled for why none of you guys crying wolf even tried to ask me reasonably productive questions of what do I actually do in my setup.
- My LLM use is mainly not about code generation. Especially it is not about autonomous code generation and execution.
- Why nobody's asking about scope of the LLM file access, audit logs, tool use confirmation, allowlists/denylists, rate limiting/circuit breakers - pre-tool hooks, scoped tool sets per context, etc.?
Whatever. If you think it's unsafe - just don't do what I'm doing. Just please spare me from security-as-ritual, I don't believe in prayers, I preach security-as-engineering. None of you proposed a threat model. None of you started with: "here is the specific attack, here is the attack vector, here is the probability, here is the blast radius", it's all just: "imagine what a baddie could do" followed by an escalation chain that terminates in total system compromise. By that reasoning you should not run any software.
Re: I have officially retired from Emacs
#215Earlier quoted context omitted.
This is very interesting! I've played around with Hammerspoon for a bit but nowhere near this level. Do you have a link to your config or could you give me a bit more detail on your setup?
https://github.com/agzam/spacehammer https://github.com/agzam/.spacehammer
Note, these are two different repos. One is the toolkit, the other is my custom config on top of it.
Re: I have officially retired from Emacs
#216Earlier quoted context omitted.
Care to explain? Why is it? You think it's dangerous or some other reasons?
It's definitely dangerous. Do you have credentials anywhere within reach of that session? Can you open your bank account in a browser ... within reach of that session? Are your contacts available within reach of that session? What about personal notes/emails/goals or other sensitive information? That people think these can't be added together in one very socially/monetarily destructive fell swoop is ... telling. Igno…
[dead]
Re: I have officially retired from Emacs
#217Earlier quoted context omitted.
FWIW the lem editor (basically emacs in common lisp) has its own version of magit, called legit. https://github.com/lem-project/lem/blob/main/extensions/legi... But I guess if you're leaving GNU emacs, you're probably not eager to jump into another emacsen.
Thanks, I left due to rsi from the chords.
I mean, both have the ability to do modal or CUA combinations instead.
Re: I have officially retired from Emacs
#218Re: I have officially retired from Emacs
#219Earlier quoted context omitted.
Arguably NixOS is the most config heavy platform but it solves the pain point of having to reconfigure on different systems. Especially in the LLM era where I can configure Emacs and my OS decoratively.
How do you nixify your Emacs configuration? I've looked into it but at the time the advice was to specify dependencies both in Nix and in .emacs.d, which seemed redundant to me. Is there something like callCabal2Nix for Emacs? Edit: Or do you mean "declaratively" in the sense of using something like straight.el?
I do it declaratively, however I specifically use an unstraightened version. [[https://github.com/marienz/nix-doom-emacs-unstraightened][marienz/nix-doom-emacs-unstraightened: Builds Doom Emacs using Nix]]
I use a doom emacs overlay that uses pgtk so it works flawlessly on wayland, since I only learned recently that it uses X by default. You can inspect my dotfiles here: [[https://github.com/ArikRahman/dotfiles][ArikRahman/dotfiles: Arik's Dotfiles]]
Re: I have officially retired from Emacs
#220Earlier quoted context omitted.
I use ^a to go to the beginning of a line and ^e to go to the end nearly everywhere. Many Emacs keystrokes are so pervasive that they're not often thought of as Emacs keystrokes.
Aren't they actually readline keystrokes, and emacs is "readline-aware"?
Strangely enough I tried using vi mode for readline and hated it even though I use them constantly in vim. I just hated having to switch modes on my terminal