Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

Post reply on HN
Print view View original

31–40 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#31

Post by broeng »

theultdev wrote: post #22
g-b-r wrote: post #19

Earlier quoted context omitted.

GitHub release builds provide no whatsoever guarantee of having been built by GitHub from the corresponding source, if I remember correctly

So the worry is the Zed team themselves will inject something into the binary?

The xz backdoor was an example of exploiting this disconnect. It was not present in the repository, it was inserted only into the release artifacts. Anyone getting xz by checking out the repository and building it themselves, would not be affected by it.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#32

Post by broeng »

compootr wrote: post #21
theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge

Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#33

Post by WesolyKubeczek »

consp wrote: post #12
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

[flagged]

Does it mean that it’s excruciatingly difficult to write a yes/no prompt in Rust? You can make an editor, but not a consent prompt…

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#34

Post by herrkanin »

whazor wrote: post #4
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

Because people want a fast out of the box editing experience. Not clicking yes for every language server. But what they should have is a CDN with their own extensions and verified binaries. This way they can ship new versions of extensions without bumping their editor version.

The versions should generally match what's specified in the user's package.json. It doesn't make much sense then to have a separate registry.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#35

Post by Ygg2 »

theultdev wrote: post #28
mhd wrote: post #25

Earlier quoted context omitted.

> Not clicking yes for every language server. How many language servers are we talking about here for the average dev? Three?

Yes, but you would have it for each time you opened a new workspace. The only point of this would be if you didn't want to download the language server for untrusted code. I think what people really want is workspace location permissions...

Wait, what. Why should you keep downloading Node per workspace? If you have one installed already?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#37

Post by ayewo »

pjmlp wrote: post #29
daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.

No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java.

It there a decent alternative for Golang on the Visual Studio Code marketplace?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#39

Post by Ygg2 »

consp wrote: post #12
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

[flagged]

That's not a Rust issue (not having a prompt to update LSPs). Lapce[1] is also a Rust editor, and it didn't keep downloading JS or stuff without a prompt. You can do what VSCode does, have extensions that ask for update, then update on change (even if using binary is the only solution, which I also doubt). Or if the issue is running LSP, ask if you trust a project folder on project start.

[1]https://github.com/lapce/lapce

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#40

Post by superb_dev »

daghamm wrote: post #16
theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

What if one language server adds a function to use your code for AI training? Are you okay with that as long as it came as a gitthub binary? And these modern editors introduce another issue with their modularazied design. For each supported language Vscode installs tons of other crap beside the language server itself. And the language server alone has a quite long list of dependencies https://github.com/golang/vscode…

I wouldn’t be okay with that, but I doubt I would be able to tell from the download button
Post reply on HN