Earlier quoted context omitted.
Just let others silently run code on my computer? Sorry, but not for me.
Isn't that the point of downloading an editor in the first place? Not having to write your own editor code?
The point was silently.
Zed Editor automatically downloads binaries and NPM packages without consent
81–90 of 183 posts
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#82Earlier quoted context omitted.
I agree with you, it's a standalone package. It can be assumed to have some setup permissions. Also it's far better than the packaging the remote code with the installer or binary. The same people who will complain about this do t really understand how package managers work also. Take npm as an example, you manually install one package. You do not consent explicitly to have all of its dependencies added also. This so…
I don't use NPM, but that means NPM's behavior isn't that great and maybe shouldn't be an example for others to follow. Linux package managers with which I'm familiar will absolutely prompt you with the list of dependencies they'll install when you ask for some package and give you the possibility of bailing out.
I don't think NPM is a model for anyone to follow to be honest, my gripe is just the hill to die on isn't Zed for this issue.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#83This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.
> Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. Pretty much all of it seems to be on golang.org, github.com/google, or are by people working on gopls. The suggestions that there are tons of dependencies from random people is just not true.
Pretty much all of it isn't remotely the same as all of it.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#84Earlier quoted context omitted.
Does it mean that it’s excruciatingly difficult to write a yes/no prompt in Rust? You can make an editor, but not a consent prompt…
There are more game engines written in Rust than games written in Rust. So maybe there are more GUI libraries than dialog windows written in Rust as well.
The referenced issue has nothing to do with Rust. One would have to dug deeper and not relay on random comment to figure out. So I'm not expecting you to do it when even content of your comment is bit lazy copy-paste.
But even so, without checking the actual Github, it was already explained here [0], before you have posted.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#85Hey, Antonio here. Co-founder at Zed.
Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything.
I agree that we should ask users for consent before downloading language servers (and other executables).
For everybody who's come across the ticket here or on Reddit and hasn't worked with the Zed codebase yet, let me provide some context on how language support is implemented.
In Zed, we have three ways of supporting a language (and its language servers):
1. Extensions that users can install from the `zed-extensions` repository [0]
2. Pre-bundled extensions that ship with the Zed binary, but still need to be installed [1]
3. Built-in language support [2].
For (2) and (3), the code is owned by the Zed team and we make a conscious effort to review contributions from the community in that area.
That code can automatically download language servers, but we try to vet which exact scripts/binaries are downloaded from where. For example: we heavily use rust-analyzer ourselves and keep up to date with its releases, the Go language server `gopls` is downloaded from the Go team using the official `go` tooling, the ESLint language server comes from Microsoft, etc.
For the longest time, we only had built-in language support (3). A couple of months ago, we shipped extensions for Zed (point 1 and 2 above, parts of it described in [3]). The goal was for built-in language support (3) to gradually move to pre-bundled extensions (2) so that users had the ability to choose which ones to install. We did make some progress, but we haven't ported all languages yet.
We're a small team and can only do so many things at once. So after investing quite a bit of time into extensions, we chose to pause that work and invest into other areas for a while (porting Zed to Linux, for example). Once those areas are in a better state, we plan to come back to extensions, build them out some more, and port the remaining languages.
So, TL;DR: we hear you loud and clear. We try to vet things that are currently installed automatically. But we agree that we should ask users whether they want to install arbitrary binaries on their computer. We also plan to transition all language support to manually-installed extensions once we finish other projects.
[0]: https://github.com/zed-industries/extensions
[1]: https://github.com/zed-industries/zed/tree/main/extensions
[2]: https://github.com/zed-industries/zed/tree/main/crates/langu...
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#86Earlier quoted context omitted.
That would be quite funny. In a thread about additional components being installed without prompts, a user jumps out to complain about missing functionality in another editor because they refused to install an additional component when prompted.
Quite. VSCode asks with a little pop-up in the bottom right (for me, on Gnome) when you open a project that might benefit from a particular component, and you can accept or decline it. It tells you what/why it's needed, it's up to you to accept or decline, but you should accept that things won't work well if you don't. I'm no Microsoft fan (quite the opposite), but VSCode handles this about as well as anything could.
except for giving network access to extensions having no way to audit if not open source.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#87I don't get why having a modal for each tool asking for consent is too hard.
Because people want a fast out of the box editing experience. Not clicking yes for every language server. But what they should have is a CDN with their own extensions and verified binaries. This way they can ship new versions of extensions without bumping their editor version.
>Because people want a fast out of the box editing experience. Not clicking yes for every language server.
That strikes me as more of a UX problem. Doing a bunch of sketchy things behind the user's back is absolutely not a solution though.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#88Earlier quoted context omitted.
No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?
I can confirm it is frustrating experience overall, I've moved on to GoLand and later to IntelliJ with Go plugin for Go development and never looked back. Sadly IDEA products fall apart for me in projects where multiple technologies are used, i.e. tailwind, Ruby, anything with JS, so I can't ditch VSCode yet...
Can you elaborate on that, at least for js? We are a large (1k) fullstack development company and do all of our js / typescript SPAs and others on Intellij and I am not aware of it being an unpleasant experience.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#89Earlier quoted context omitted.
Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.
It also supports preinstall and install scripts, for more obvious reasons.
I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.
Re: Zed Editor automatically downloads binaries and NPM packages without consent
#90Hey, Antonio here. Co-founder at Zed. Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything. I agree that we should ask users for consent before downloading language servers (and other executables). For everybody who's come across the ticket here or on Reddit…
this answer makes things even worse. "we are a small team so its ok for us to expose your pc to risks".
If you dont have the bandwidth to do things securely dont do them at all.you are asking the devs to wait until you have time to return to it to plug the holes you have opened because you needed a bulletpoint for your release.
and this is not just a lack of time, its your attitude in regard to the devs, see also the optout telemetry for another example of total lack of respect for privacy.