Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

Post reply on HN
Print view View original

61–70 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#61

Post by wolvesechoes »

WesolyKubeczek wrote: post #33
consp wrote: post #12

Earlier quoted context omitted.

[flagged]

Does it mean that it’s excruciatingly difficult to write a yes/no prompt in Rust? You can make an editor, but not a consent prompt…

There are more game engines written in Rust than games written in Rust. So maybe there are more GUI libraries than dialog windows written in Rust as well.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#63

Post by the_gipsy »

zokier wrote: post #3

[flagged]

Zed is OSS but not free. There's a company behind it, not volunteers. They are doing quite some marketing lately. I don't see anything wrong with calling the current issue "completely unacceptable". Forced opt-in is what happens if the language is not offensive.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#64

Post by bachmeier »

zokier wrote: post #3

[flagged]

The language used to report the issue is very reasonable. Maybe it's cultural, but the fake version you're suggesting is something I'd find insulting, in addition to upsetting me because it's wasting my time. I prefer it if they get to the point.

> And people wonder why foss devs burn out.

These are full-time devs, working for an investor-backed company that plans to make money off the editor. The FOSS part allows them to profit off the work of volunteers.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#65

Post by usr1106 »

cedws wrote: post #38
coolgoose wrote: post #2

I don't get why having a modal for each tool asking for consent is too hard.

I don’t want that. Popups are one of the reasons I stopped using VSCode. They drive me nuts. Just let me write code.

Just let others silently run code on my computer? Sorry, but not for me.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#66

Post by nrabulinski »

Dobbs wrote: post #58
mxsjoberg wrote: post #55

Earlier quoted context omitted.

> I don't really see the big deal here. Who wants to approve and configure all of their language servers? everyone > If you open a file for that language, is there ever a time you would deny the download? every time default should be offline imo. want to download something? do it manually and place in folder etc

Just migrated from Vim to NeoVim. Downloading and configuring all the various LSPs has genuinely been one of the most frustrating aspects.

Then you’d click the „yes and never ask me again” if a prompt about whether you want to download a random binary showed up. But a lot of people wouldn’t want to click that and would either click „no and never ask me again” or vet each case one by one

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#67

Post by arp242 »

zokier wrote: post #3

[flagged]

I really wish these "torch and pitchfork" posts were declared off-topic. A discussion on what/when to auto-download and how would be useful, but comments on these kind of submissions are almost always just ranting/complaining about how bad $x is, what idiots people are, and things like this.

> And people wonder why foss devs burn out.

I have slowly become convinced that the open source community has been infiltrated by trolls from, eh, I don't know – something or someone that doesn't like open source. I have no direct evidence for this, but it does seem to align with observed facts.

A few days ago someone posted some hobby project they worked on, and of course one of the replies was some unhinged rant about how the chosen $language wasn't any good and how they would "rather kill myself" than use that language... Okay... I don't think any normal personal can get get that triggered by someone's hobby project, hence my conclusion: infiltration by trolls.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#68

Post by kmarc »

vergessenmir wrote: post #47
ayewo wrote: post #37

Earlier quoted context omitted.

No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?

Jetbrains has a decent golang IDE. I don't use it because I use Vim. Vim's not for everyone.

I do the same (not for golang tho). However, vim plug-ins also "have network access", in fact they can just "system()" and call anything. No sandboxing at all. At least the source code of these plug-ins are not obfuscated/compressed.

However, this makes me wonder how much of a surface attack this is.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#69

Post by alias_neo »

oefrha wrote: post #52
alias_neo wrote: post #48

Earlier quoted context omitted.

I think they must have, it's not quite on the level of Goland, but VSCode with all the necessary extensions works well for Go, and doesn't eat 32GB of my RAM to do it.

That would be quite funny. In a thread about additional components being installed without prompts, a user jumps out to complain about missing functionality in another editor because they refused to install an additional component when prompted.

Quite. VSCode asks with a little pop-up in the bottom right (for me, on Gnome) when you open a project that might benefit from a particular component, and you can accept or decline it.

It tells you what/why it's needed, it's up to you to accept or decline, but you should accept that things won't work well if you don't.

I'm no Microsoft fan (quite the opposite), but VSCode handles this about as well as anything could.

Post reply on HN