Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

Post reply on HN
Print view View original

51–60 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#51

Post by pynappo »

consp wrote: post #12
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

[flagged]

It's important to note that this isn't a dev response that is meant to directly address the issue in the OP. Someone else just saw that it was a dev comment in a related issue and linked it.

If you look at the linked thread the quote came from [1], the quote is actually answering a similar issue titled "Why are there nodejs files in my zed install". Judging by the response, the dev had interpreted the issue title as a "what does zed uses nodejs for" and not "why does zed downloads nodejs without informing the user" and answered accordingly.

There are more relevant links to PRs and comments further down the GitHub thread (the one in the OP) where the zed devs acknowledge that they are still thinking about how to best implement the UX for extensions downloading LSPs and whatnot.

[1]: https://github.com/zed-industries/zed/issues/7054#issuecomme...

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#52

Post by oefrha »

alias_neo wrote: post #48
oefrha wrote: post #45

Earlier quoted context omitted.

> Golang... I can’t jump to definitions with Cmd + Click That’s absolutely false. Did you refuse to install gopls or something?

I think they must have, it's not quite on the level of Goland, but VSCode with all the necessary extensions works well for Go, and doesn't eat 32GB of my RAM to do it.

That would be quite funny. In a thread about additional components being installed without prompts, a user jumps out to complain about missing functionality in another editor because they refused to install an additional component when prompted.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#53

Post by arp242 »

daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

> Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github.

Pretty much all of it seems to be on golang.org, github.com/google, or are by people working on gopls. The suggestions that there are tons of dependencies from random people is just not true.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#54

Post by avarun »

oefrha wrote: post #52
alias_neo wrote: post #48

Earlier quoted context omitted.

I think they must have, it's not quite on the level of Goland, but VSCode with all the necessary extensions works well for Go, and doesn't eat 32GB of my RAM to do it.

That would be quite funny. In a thread about additional components being installed without prompts, a user jumps out to complain about missing functionality in another editor because they refused to install an additional component when prompted.

Yeah I wonder why developers feel the need to auto install components…

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#55

Post by mxsjoberg »

theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

> I don't really see the big deal here. Who wants to approve and configure all of their language servers?

everyone

> If you open a file for that language, is there ever a time you would deny the download?

every time

default should be offline imo. want to download something? do it manually and place in folder etc

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#56

Post by shzhdbi09gv8ioi »

ayewo wrote: post #37
pjmlp wrote: post #29

Earlier quoted context omitted.

Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.

No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?

> Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java.

Odd, what extensions are you using? I use only go.dev extension and intellisense has been working great for golang dev for years.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#58

Post by Dobbs »

mxsjoberg wrote: post #55
theultdev wrote: post #7

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

> I don't really see the big deal here. Who wants to approve and configure all of their language servers? everyone > If you open a file for that language, is there ever a time you would deny the download? every time default should be offline imo. want to download something? do it manually and place in folder etc

Just migrated from Vim to NeoVim. Downloading and configuring all the various LSPs has genuinely been one of the most frustrating aspects.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#59

Post by elAhmo »

arp242 wrote: post #53
daghamm wrote: post #9

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

> Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. Pretty much all of it seems to be on golang.org, github.com/google, or are by people working on gopls. The suggestions that there are tons of dependencies from random people is just not true.

Comment states some of the tools, not tons of dependencies. Your comment that "pretty much all" is not a contradiction of what the parent comment said.
Post reply on HN