Not asking the user for consent for software updates is quite common. My corpo rejects a lot software, because they do exactly that.
Yes for first party updates. This is different. This is for third party extensions.
Zed Editor automatically downloads binaries and NPM packages without consent
41–50 of 183 posts
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#42Earlier quoted context omitted.
Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.
That’s a completely separate concern, it’s not like a new language server is downloaded for each file you open. I don’t know if Zed has a “safe mode” like some other editors, if it doesn’t you should ask for that instead. Unless of course you never open untrusted files in a language you’re familiar with, which would make you extremely peculiar.
No, but one would be downloaded the first time I'm opening some NPM backdoorfest.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#43Re: Zed Editor automatically downloads binaries and NPM packages without consent
#44Earlier quoted context omitted.
> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge
Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.
It also supports preinstall and install scripts, for more obvious reasons.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#45Earlier quoted context omitted.
Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.
No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?
> Golang... I can’t jump to definitions with Cmd + Click
That’s absolutely false. Did you refuse to install gopls or something?
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#46[flagged]
I agree with you, it's a standalone package. It can be assumed to have some setup permissions. Also it's far better than the packaging the remote code with the installer or binary. The same people who will complain about this do t really understand how package managers work also. Take npm as an example, you manually install one package. You do not consent explicitly to have all of its dependencies added also. This so…
I don't use NPM, but that means NPM's behavior isn't that great and maybe shouldn't be an example for others to follow.
Linux package managers with which I'm familiar will absolutely prompt you with the list of dependencies they'll install when you ask for some package and give you the possibility of bailing out.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#47Earlier quoted context omitted.
Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.
No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?
Jetbrains has a decent golang IDE. I don't use it because I use Vim. Vim's not for everyone.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#48Earlier quoted context omitted.
No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?
> Golang... I can’t jump to definitions with Cmd + Click That’s absolutely false. Did you refuse to install gopls or something?
I think they must have, it's not quite on the level of Goland, but VSCode with all the necessary extensions works well for Go, and doesn't eat 32GB of my RAM to do it.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#49This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.
yea I was recently dismayed to find vscode extensions have full network access and there's no way to prevent it. It's been an open issue since 2018 and not on the roadmap.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#50Earlier quoted context omitted.
Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.
No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?
I can confirm it is frustrating experience overall, I've moved on to GoLand and later to IntelliJ with Go plugin for Go development and never looked back. Sadly IDEA products fall apart for me in projects where multiple technologies are used, i.e. tailwind, Ruby, anything with JS, so I can't ditch VSCode yet...