Live data from Hacker News

Zed Editor automatically downloads binaries and NPM packages without consent

old.reddit.com

91–100 of 183 posts

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#91
post #89

Earlier quoted context omitted.

It also supports preinstall and install scripts, for more obvious reasons.

I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.

dependency checking isn't simple

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#92
post #88

Earlier quoted context omitted.

I can confirm it is frustrating experience overall, I've moved on to GoLand and later to IntelliJ with Go plugin for Go development and never looked back. Sadly IDEA products fall apart for me in projects where multiple technologies are used, i.e. tailwind, Ruby, anything with JS, so I can't ditch VSCode yet...

Can you elaborate on that, at least for js? We are a large (1k) fullstack development company and do all of our js / typescript SPAs and others on Intellij and I am not aware of it being an unpleasant experience.

I do not have much experience with this as I've switched just a month ago, but for my codebases the editor tends to turn all project files red a few times a day and I have to use the "Restart IDE" and "Invalidate caches" quite often, this never happens with just Go codebase. It's a shame these actions have to even exist in IDE, it's like they know there's a bug in caching mechanism but can't find it, and no, I'm not using any fancy networked filesystems, just native macOS directories.

On another point I spent 2 hours setting up a Ruby interpretter because no matter what I did Intellij would not recognise my RVM ruby, I think compiling without yjit and setting up a specific gemset for the project plus a few Restart IDE and Invalidate caches later did it, but not sure.

For tailwind specifically the extension is lacking compared to VSCode, I do not have color squares for my color classes and the classes are not recognized in more difficult filetypes (i.e. erb templates). Many other extensions seem much less loved than on VSCode, i.e. continue.dev, you can read their reviews and quickly get a sense that it's much more niche ecosystem.

I love the editor experience overall and especially for Go projects, but can't switch fully yet.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#93
post #37

Earlier quoted context omitted.

No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?

Jetbrains has a decent golang IDE. I don't use it because I use Vim. Vim's not for everyone.

Their ideavim plugin is pretty good. I didn't know at first, but it support an .ideavimrc file that allows you to set your own commands. Pretty much anything that you can do in a jetbrains product is connected to a command id that you can connect to a vim shortcut.

Include the most popular vim plugins as well. Easy motion and Nerdtree. Doesn't support language specific plugins, but core jetbrains products covers that

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#94
post #89

Earlier quoted context omitted.

It also supports preinstall and install scripts, for more obvious reasons.

I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.

NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#95
post #85

Hey, Antonio here. Co-founder at Zed. Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything. I agree that we should ask users for consent before downloading language servers (and other executables). For everybody who's come across the ticket here or on Reddit…

Thanks for this response. Zed is awesome, haven't been able to switch to it full-time due to [1] https://github.com/zed-industries/zed/issues/5065, but do appreciate what's being built.

It's a new product, which is clearly seeing quick changes every week, so hopeful you'll get to this one soon. The internet will always be extreme around any issue, and make it seem like the end of the world, to those folks, maybe try zed again later? It's still a good editor to keep in mind.

Although one minor thing about this, getting users accustomed to this flow and then later asking for consent might also raise issues, like this one, just with a more "Zed now prompting for every little thing" in future. So might want to keep that in mind.

Loving zed for go development (especially with a decent suite of Vim bindings), just haven't been able to use things like Flutter , due to lack of debug support, which VSCode does quite well (albeit crashes a bunch).

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#96
post #45
post #37

Earlier quoted context omitted.

No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?

> Golang... I can’t jump to definitions with Cmd + Click That’s absolutely false. Did you refuse to install gopls or something?

Exactly. By the way, use F12 instead of clicking :).

Even on emacs, using gopls, `Meta+.` (go to definition) works.

I use some VS Code (when I need to do web stuff besides Go), some emacs, and both use gopls so support is pretty much equivalent in terms of functionality.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#97
post #67

Earlier quoted context omitted.

I really wish these "torch and pitchfork" posts were declared off-topic. A discussion on what/when to auto-download and how would be useful, but comments on these kind of submissions are almost always just ranting/complaining about how bad $x is, what idiots people are, and things like this. > And people wonder why foss devs burn out. I have slowly become convinced that the open source community has been infiltrated…

Turning issue trackers into Emoji riddled social media platforms will do that alright.

What does that have to do with anything...?

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#98

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

I usually don't use language servers at all. AI auto complete does the same for me faster... So yes, I would like to not download any of them.

IntelliJ now comes by default with a local-only AI auto-completer. I noticed that almost always, it "knows" the autocompletion better than the older intellisense.

However, sometimes (very often) you need to explore the API and just check every available method and check their docs to find which one is appropriate to use.

So, even though I can see AI replacing a lot of auto-completions, it just can't replace it completely.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#99
post #58

Earlier quoted context omitted.

> I don't really see the big deal here. Who wants to approve and configure all of their language servers? everyone > If you open a file for that language, is there ever a time you would deny the download? every time default should be offline imo. want to download something? do it manually and place in folder etc

Just migrated from Vim to NeoVim. Downloading and configuring all the various LSPs has genuinely been one of the most frustrating aspects.

With Vim + ALE this is dead easy: Install LSP servers via your OS package manager, and ALE will find them in $PATH and use them.

If you want to use NeoVim, then LSP-zero + Mason was also a decent experience last I tried.

Re: Zed Editor automatically downloads binaries and NPM packages without consent

#100
post #85

Hey, Antonio here. Co-founder at Zed. Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything. I agree that we should ask users for consent before downloading language servers (and other executables). For everybody who's come across the ticket here or on Reddit…

Hi Antonio, thanks for Zed, love it.

If I may offer a small piece of feedback based on your comment here:

Apart from its speed, the single thing I loved about Zed and made it stand out from the likes of vscode, was the built-in language support.

This made for a great first time experience where I didn't have to search and download anything and everything was working out of the box.

In fact it was so good an experience, that when I had to download another thing for terraform support, it struck me as much more annoying than usually

Reading that your plan is to move in the exact opposite direction is disappointing and, I'm sorry to say, I hope it doesn't come to pass.

Post reply on HN