8 ms·

Zed Editor automatically downloads binaries and NPM packages without consent

239 points by gantengx 2y ago

deleted 2y ago
[deleted]
james1120000 2y ago
I lost my investment capital and profits trading online, they kept on requesting for extra funds before a withdrawal request can be accepted and processed, in the end, I lost all my money. All efforts to reach out to their customer support desk had declined, I found it very hard to move on. God so kind I followed a broadcast that teaches on how scammed victims can recover their fund through the help of Gavin ray a recovery specialist, I contacted his email provided for consultation, I got feedback after some hours and I was asked to provide all legal details concerning my investment, I did exactly what they instructed me to do without delay, to my greatest surprise I was able to recover my money back including my profit which my capital generated. I said I will not hold this to myself but share it to the public so that all scammed victims can get their funds back. Contact his email:gavinray78@gmail.com or whatsapp +1 352 322 2096
coolgoose 2y ago
I don't get why having a modal for each tool asking for consent is too hard.
- whazor 2y ago
  Because people want a fast out of the box editing experience. Not clicking yes for every language server. But what they should have is a CDN with their own extensions and verified binaries. This way they can ship new versions of extensions without bumping their editor version.
  - mhd 2y ago
    > Not clicking yes for every language server. How many language servers are we talking about here for the average dev? Three?
    - theultdev 2y ago
      Yes, but you would have it for each time you opened a new workspace. The only point of this would be if you didn't want to download the language server for untrusted code. I think what people really want is workspace location permissions...
      - Ygg2 2y ago
        Wait, what. Why should you keep downloading Node per workspace? If you have one installed already?
        theultdev 2y ago
        Not downloading, but enabling. The downloading of Node isn't really the issue that people are trying to make it. The real problem is "running" the language server on untrusted code. That's where there should be a confirm dialog. But it's a separate issue about workspace permissions. That's the only vulnerability here and it exists on at least one some level in all editors in language servers. (VSCode's workspace permissions aren't that secure)
  - herrkanin 2y ago
    The versions should generally match what's specified in the user's package.json. It doesn't make much sense then to have a separate registry.
  - tjpnz 2y ago
    >Because people want a fast out of the box editing experience. Not clicking yes for every language server. That strikes me as more of a UX problem. Doing a bunch of sketchy things behind the user's back is absolutely not a solution though.
- diego_sandoval 2y ago
  Because it would turn into the popup fest that is vscode.
  - loa_in_ 2y ago
    All it takes is a "yes to all this session" button, which is way better than just doing it quietly.
  - chillfox 2y ago
    I can't remember the last time I saw a popup in vscode, maybe last year.
    - DangitBobby 2y ago
      Do you use it?
      - chillfox 2y ago
        Every day. Guess I just configured it differently to how most people do it.
        DangitBobby 2y ago
        I see a pop up for an update or extension that isn't working anymore pretty much every time I open it.
        chillfox 2y ago
        Well, that sucks. You should probably use a different editor that works better for you.
- consp 2y ago
  [flagged]
  - IshKebab 2y ago
    That's nothing to do with having a dialog to ask for each too. That's talking about the amount of work it would be to rewrite all these tools themselves so it was first party Rust code.
  - lucianbr 2y ago
    "Action would be too difficult / we don't like it" =/= "there is no action available". This is just refusing to take responsibility for their decision. "We don't feel like doing it" is the truth, and it would be best to state it plainly. Of course there is no obligation to do otherwise, which makes it strange to play with words.
  - WesolyKubeczek 2y ago
    Does it mean that it’s excruciatingly difficult to write a yes/no prompt in Rust? You can make an editor, but not a consent prompt…
    - wolvesechoes 2y ago
      There are more game engines written in Rust than games written in Rust. So maybe there are more GUI libraries than dialog windows written in Rust as well.
      - timeon 2y ago
        The referenced issue has nothing to do with Rust. One would have to dug deeper and not relay on random comment to figure out. So I'm not expecting you to do it when even content of your comment is bit lazy copy-paste. But even so, without checking the actual Github, it was already explained here [0], before you have posted. [0] https://news.ycombinator.com/item?id=40903577 https://news.ycombinator.com/item?id=40903577
  - Ygg2 2y ago
- cedws 2y ago
  I don’t want that. Popups are one of the reasons I stopped using VSCode. They drive me nuts. Just let me write code.
  - usr1106 2y ago
    Just let others silently run code on my computer? Sorry, but not for me.
    - jeroenhd 2y ago
      Isn't that the point of downloading an editor in the first place? Not having to write your own editor code?
      - usr1106 2y ago
        The point was silently.
  - brabel 2y ago
    It annoys me a lot as well, though it took me a couple of minutes to turn off the popups. Once you've done that, it's similar to emacs for me, everything has to be evoked via a shortcut (or Action Palette which works very well in VS Code). The shortcut to show "help" or "docs" is Cmd+K Cmd+I, by the way - easy to type and remember...
  - switch007 2y ago
    The popups in VScode seem explicitly intended to annoy. Why is showing the release log the default for so many things? Is the average user really going to read them? It makes you wonder what they are doing with all that telemetry
zokier 2y ago
[flagged]
- consp 2y ago
  Maybe make a cve out of it since it is an obvious exploit path running unchecked automatically downloaded binaries without user interference.
  - bilekas 2y ago
    I don't know if this is sarcastic but doesn't a CVE require an actual proof of attack and not just hypothetical?
    - consp 2y ago
      It was sarcastic but on point, and many cves do not have poc exploits so at best it is murky.
- bilekas 2y ago
  I agree with you, it's a standalone package. It can be assumed to have some setup permissions. Also it's far better than the packaging the remote code with the installer or binary. The same people who will complain about this do t really understand how package managers work also. Take npm as an example, you manually install one package. You do not consent explicitly to have all of its dependencies added also. This sounds like typical Reddit behaviour. As you said, a better approach would have been to ask the maintainers to mention it in the readme. No drama required.
  - vladvasiliu 2y ago
    I don't use NPM, but that means NPM's behavior isn't that great and maybe shouldn't be an example for others to follow. Linux package managers with which I'm familiar will absolutely prompt you with the list of dependencies they'll install when you ask for some package and give you the possibility of bailing out.
theultdev 2y ago
I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.
- teo_zero 2y ago
  > Who wants to approve and configure all of their language servers? I think you're asking the wrong question. The correct one would be: "who wants to be asked if they want to approve and configure all of their language servers?" It's not what zed does, it's doing it behind your back!
- eptcyka 2y ago
  Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.
  - theultdev 2y ago
    Open it in something else then. If you use Zed you must have known the language server was running when you tried it, how did you think that was happening?
    - lucianbr 2y ago
      This kind of article or reddit post and discussion is how you know, at least for some people. Anyway, you asked who would care. Now the topic has moved to "what to do about it", which is hardly an issue. Of course people who think Zed has a problem will not use it. That does not make it a non-problem.
      - theultdev 2y ago
        tbh this "article" looks a lot like a reddit outrage post.
daghamm 2y ago
This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.
- pjmlp 2y ago
  Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.
  - ayewo 2y ago
    No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?
    - oefrha 2y ago
      > Golang... I can’t jump to definitions with Cmd + Click That’s absolutely false. Did you refuse to install gopls or something?
      - alias_neo 2y ago
        I think they must have, it's not quite on the level of Goland, but VSCode with all the necessary extensions works well for Go, and doesn't eat 32GB of my RAM to do it.
        oefrha 2y ago
        That would be quite funny. In a thread about additional components being installed without prompts, a user jumps out to complain about missing functionality in another editor because they refused to install an additional component when prompted.
AlexDragusin 2y ago
> We created the hackable text editor, Atom, and the pioneering software platform that launched an entirely new generation of desktop apps, Electron.
- lpcvoid 2y ago
  I'd rather wish they hadn't to be honest
  - AlexDragusin 2y ago
    That's the point I was trying to make :)
    - airhangerf15 2y ago
      I agree. Electron is cancer. They're proud of creating Javascript Cancer.
biosboiii 2y ago
Not asking the user for consent for software updates is quite common. My corpo rejects a lot software, because they do exactly that.
- zarzavat 2y ago
  Yes for first party updates. This is different. This is for third party extensions.
mxsjoberg 2y ago
[flagged]
rs_rs_rs_rs_rs 2y ago
At this point I really believe we need a consent popup after every letter typed, got forbid you typed a wrong letter.
DanielVZ 2y ago
This broke Zed for me and had to go back to Neovim at my workspace. The corporate AV software was going crazy with all these automated downloads and installations. It wasn’t blocking them but just vetting them was taking so long, I just didn’t find it worth using
as-cii 2y ago
Hey, Antonio here. Co-founder at Zed. Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything. I agree that we should ask users for consent before downloading language servers (and other executables). For everybody who's come across the ticket here or on Reddit and hasn't worked with the Zed codebase yet, let me provide some context on how language support is implemented. In Zed, we have three ways of supporting a language (and its language servers): 1. Extensions that users can install from the `zed-extensions` repository [0] 2. Pre-bundled extensions that ship with the Zed binary, but still need to be installed [1] 3. Built-in language support [2]. For (2) and (3), the code is owned by the Zed team and we make a conscious effort to review contributions from the community in that area. That code can automatically download language servers, but we try to vet which exact scripts/binaries are downloaded from where. For example: we heavily use rust-analyzer ourselves and keep up to date with its releases, the Go language server `gopls` is downloaded from the Go team using the official `go` tooling, the ESLint language server comes from Microsoft, etc. For the longest time, we only had built-in language support (3). A couple of months ago, we shipped extensions for Zed (point 1 and 2 above, parts of it described in [3]). The goal was for built-in language support (3) to gradually move to pre-bundled extensions (2) so that users had the ability to choose which ones to install. We did make some progress, but we haven't ported all languages yet. We're a small team and can only do so many things at once. So after investing quite a bit of time into extensions, we chose to pause that work and invest into other areas for a while (porting Zed to Linux, for example). Once those areas are in a better state, we plan to come back to extensions, build them out some more, and port the remaining languages. So, TL;DR: we hear you loud and clear. We try to vet things that are currently installed automatically. But we agree that we should ask users whether they want to install arbitrary binaries on their computer. We also plan to transition all language support to manually-installed extensions once we finish other projects. [0]: https://github.com/zed-industries/extensions https://github.com/zed-industries/extensions [1]: https://github.com/zed-industries/zed/tree/main/extensions https://github.com/zed-industries/zed/tree/main/extensions [2]: https://github.com/zed-industries/zed/tree/main/crates/languages/src https://github.com/zed-industries/zed/tree/main/crates/langu... [3]: https://zed.dev/blog/language-extensions-part-1 https://zed.dev/blog/language-extensions-part-1
jarule 2y ago
This is why you never want to sell to developers.
notorandit 2y ago
Being it binary or not, it doesn't make any difference. It's the "modern times" craze about plugins pulled from different unauditable, unknown sources. The fact that it is on GitHub or any other "publicly available" source it is irrelevant. I keep using vim and Kate and manually install anything I need form my distro (Arch Linux) repos. If it is not there, then, sorry I cannot use it.
- alfiedotwtf 2y ago
  This is a fallacy though, unless you’re also code reviewing all of the Archb libraries you pull down
  - zamadatix 2y ago
    I think the main add of distro repositories is the repo maintainers sit as a review step between you and the project updates on e.g. GitHub, not that it enables you to better audit the code yourself. I'm not sure it's really all that effective in practical terms though.
    - alfiedotwtf 2y ago
      Distros raise the probability that something will get caught, but it’s only that - increasing your chances not getting pwned… it’s still not bulletproof
perryizgr8 2y ago
There is a balance between asking too many confirmations and not asking at all. VS code had this feature called "Workspace Trust" or something like that. It was so incredibly annoying. Always asking me for my own repos or repos which are in my org, if I trust the authors. I ended up disabling it completely and it will remain that way. I hope Zed finds a way to strike the balance in a better way than bombarding the user with confirmations, otherwise I'll be completely disabling that too, probably to the detriment of the security of my computer.
mapcars 2y ago
Zed is version 0.1-something, you can't expect them realistically have their own maintained packages at this stage. And these things do happen when you use software at the early stages, just wait for 1.0 and see what happens then.
xpe 2y ago
Zed is my favorite editor, but I'm not going to minimize concerns that people raise simply because I think the editor is stupefyingly awesome overall. Questions: What control does a user have right now over what gets installed automatically? What are the levers we can pull to get more control? (These levers include configuration options, pushing back on the project, and so on.) P.S. Not that this is an excuse, but VS Code's security posture (sandboxing, prompting users, etc.) probably didn't happen overnight without user pressure. Who knows the history?
- xpe 2y ago
  Some highlights from the Github issues thread [1]: > Ideally you would be able to turn off auto-download but still be able to use a [language server] if it’s already on the users system. > There is not a binary choice between "friendly to end users" and "secure". You can have your cake and eat it too. The main thing that should be considered is less of a user facing popup or preference (where opt-in vs. opt-out is an issue, as is noise & friction), but developer facing options. If Zed offered compile time configuration this could be fixed to everybody's satisfaction. Distros could ship a pre-configured package with all the dependencies already provided so that the user experience is just "install and run" while also not having an app that downloads (or attempts to download) binaries behind teh users back. Meanwhile if Zed wants to ship a binary package upstream that defaults to downloading things they can. [1]: https://github.com/zed-industries/zed/issues/12589 https://github.com/zed-industries/zed/issues/12589
deleted 2y ago
[deleted]
legobeet 2y ago
The security side of free editors and IDEs is not great anywhere today for JS development. Once you start wanting more features and integrations, you start facing an apparent choose-any-2 of security, convenience, and productivity. I don't think it has to be this way. I think we can have both better compartmentalization and tighter workflow integration without having it becoming a part-time job. Here is my ongoing attempt at addressing the issue, currently scoped for neovim[0]: https://github.com/legobeat/l7-devenv https://github.com/legobeat/l7-devenv (I did share this to crickets as a Show HN the other day, hope it's on-topic enough to OK to reshare here) [0]: The same framework should, at least in theory, be extensible to do something similar with Code/VSCodium. While working on this I realized there is some overlap with their Dev Containers and am yet to look into if and how one would run those in a similar fashion and if they could be leveraged to the same end
haddr 2y ago
Zed is supposed to be a lightweigh and fast text editor. That was my hope when trying it. This is not the case. When I was editing some JS or HTML file I noticed that my laptop is quite warm. I checked all processes and there was some node process taking up 100% of one of CPUs. It was some language server running in the background in some non-efficient way. The problem with Zed is that its mission is to be "engineered for performance", while in the background they cut corners and run some heavy unoptimized stuff. I think this is not a right strategy, even cosindering it is still in beta.
- DrBazza 2y ago
  The language server isn't part of Zed though is it? You should report the issues on their github page.
  - haddr 2y ago
    it is not, but as the title says: it all happens in the background, without you being aware what happens. The good thing is that this can be turned off with this option: "enable_language_server": false
throwaway202407 2y ago
This was also documented here, nearly 1-year ago: https://github.com/zed-industries/zed/discussions/6659 https://github.com/zed-industries/zed/discussions/6659 Where there is a VSCode theme importer for Zed. And what it does is silently install a Home Brew package and attempt to execute it on your machine.
- timeon 2y ago
  > silently install a Home Brew package Only thing i found in your link that mentions this is about VSCode extension [0] - not Zed extension. How is that relevant here? [0] https://marketplace.visualstudio.com/items?itemName=degreat.theme-to-zed https://marketplace.visualstudio.com/items?itemName=degreat....
deleted 2y ago
[deleted]
alberth 2y ago
While I share similar concerns, I also want to point out that: - Zed is (currently) free - still pre 1.0 release - being developed quickly by a small group of developers For those of us who enjoy Zed, we should give appreciation for what they have created. As someone who's maintains OSS myself, the onslaught of people who can swarm in fast to piss on your hard/long efforts can demoralize you. So let's be kind in our words (and tone) to these folks.
- bcardarella 2y ago
  I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.
  - alberth 2y ago
    If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)
    - yamumsahoe 2y ago
      oh god, no. users exist to give you money and feedback, not emotional support. when your software enters other people's personal devices, their concern is their safety, security, and privacy, not your feelings.
      - AA-BA-94-2A-56 2y ago
        I actually completely agree with you, although at the very least users can be expected to not be rude. Although, I don't think anyone in this thread (so far) has been rude.
    - bcardarella 2y ago
WuxiFingerHold 2y ago
They could ask during install whether silent installation of LSPs should be done or whether Zed should ask explicitly for every LSP. With Zed, I have another issue. I don't understand which niche it is trying to fill. The advertising story doesn't convince me. The performance bottlenecks are typically the LSPs after all, not if text is rendered in 10 or 20 ms. Startup time is secondary. Yes, memory usage is a concern. I get that and that's where Zed is miles ahead of VS Code and Jetbrains IDEs. But overall I think: - If you want easy and free, go VS Code. - If you want ultimate IDE features and mouse and GUI, go Jetbrains. - If you want ultimate productivity, follow this beautiful guide: https://lazyvim-ambitious-devs.phillips.codes/ https://lazyvim-ambitious-devs.phillips.codes/
ZackLeo 2y ago
[flagged]
idk1 2y ago
This might be a very very silly question so bear with me, why would it need to download these binaries? I'm on sublime text atm, and I can't think of a reason why it would download anything other than the app itself or an update to the app when I'm asked. I know that might sound very stupid and I'm sorry.

239 points by gantengx 2y ago

deleted 2y ago

[deleted]

james1120000 2y ago

I lost my investment capital and profits trading online, they kept on requesting for extra funds before a withdrawal request can be accepted and processed, in the end, I lost all my money. All efforts to reach out to their customer support desk had declined, I found it very hard to move on. God so kind I followed a broadcast that teaches on how scammed victims can recover their fund through the help of Gavin ray a recovery specialist, I contacted his email provided for consultation, I got feedback after some hours and I was asked to provide all legal details concerning my investment, I did exactly what they instructed me to do without delay, to my greatest surprise I was able to recover my money back including my profit which my capital generated. I said I will not hold this to myself but share it to the public so that all scammed victims can get their funds back. Contact his email:gavinray78@gmail.com or whatsapp +1 352 322 2096

coolgoose 2y ago

I don't get why having a modal for each tool asking for consent is too hard.

whazor 2y ago
Because people want a fast out of the box editing experience. Not clicking yes for every language server. But what they should have is a CDN with their own extensions and verified binaries. This way they can ship new versions of extensions without bumping their editor version.
- mhd 2y ago
  > Not clicking yes for every language server. How many language servers are we talking about here for the average dev? Three?
  - theultdev 2y ago
    Yes, but you would have it for each time you opened a new workspace. The only point of this would be if you didn't want to download the language server for untrusted code. I think what people really want is workspace location permissions...
    - Ygg2 2y ago
      Wait, what. Why should you keep downloading Node per workspace? If you have one installed already?
      - theultdev 2y ago
        Not downloading, but enabling. The downloading of Node isn't really the issue that people are trying to make it. The real problem is "running" the language server on untrusted code. That's where there should be a confirm dialog. But it's a separate issue about workspace permissions. That's the only vulnerability here and it exists on at least one some level in all editors in language servers. (VSCode's workspace permissions aren't that secure)
- herrkanin 2y ago
  The versions should generally match what's specified in the user's package.json. It doesn't make much sense then to have a separate registry.
- tjpnz 2y ago
  >Because people want a fast out of the box editing experience. Not clicking yes for every language server. That strikes me as more of a UX problem. Doing a bunch of sketchy things behind the user's back is absolutely not a solution though.
diego_sandoval 2y ago
Because it would turn into the popup fest that is vscode.
- loa_in_ 2y ago
  All it takes is a "yes to all this session" button, which is way better than just doing it quietly.
- chillfox 2y ago
  I can't remember the last time I saw a popup in vscode, maybe last year.
  - DangitBobby 2y ago
    Do you use it?
    - chillfox 2y ago
      Every day. Guess I just configured it differently to how most people do it.
      - DangitBobby 2y ago
        I see a pop up for an update or extension that isn't working anymore pretty much every time I open it.
        chillfox 2y ago
        Well, that sucks. You should probably use a different editor that works better for you.
consp 2y ago
[flagged]
- IshKebab 2y ago
  That's nothing to do with having a dialog to ask for each too. That's talking about the amount of work it would be to rewrite all these tools themselves so it was first party Rust code.
- lucianbr 2y ago
  "Action would be too difficult / we don't like it" =/= "there is no action available". This is just refusing to take responsibility for their decision. "We don't feel like doing it" is the truth, and it would be best to state it plainly. Of course there is no obligation to do otherwise, which makes it strange to play with words.
- WesolyKubeczek 2y ago
  Does it mean that it’s excruciatingly difficult to write a yes/no prompt in Rust? You can make an editor, but not a consent prompt…
  - wolvesechoes 2y ago
    There are more game engines written in Rust than games written in Rust. So maybe there are more GUI libraries than dialog windows written in Rust as well.
    - timeon 2y ago
      The referenced issue has nothing to do with Rust. One would have to dug deeper and not relay on random comment to figure out. So I'm not expecting you to do it when even content of your comment is bit lazy copy-paste. But even so, without checking the actual Github, it was already explained here [0], before you have posted. [0] https://news.ycombinator.com/item?id=40903577 https://news.ycombinator.com/item?id=40903577
- Ygg2 2y ago
cedws 2y ago
I don’t want that. Popups are one of the reasons I stopped using VSCode. They drive me nuts. Just let me write code.
- usr1106 2y ago
  Just let others silently run code on my computer? Sorry, but not for me.
  - jeroenhd 2y ago
    Isn't that the point of downloading an editor in the first place? Not having to write your own editor code?
    - usr1106 2y ago
      The point was silently.
- brabel 2y ago
  It annoys me a lot as well, though it took me a couple of minutes to turn off the popups. Once you've done that, it's similar to emacs for me, everything has to be evoked via a shortcut (or Action Palette which works very well in VS Code). The shortcut to show "help" or "docs" is Cmd+K Cmd+I, by the way - easy to type and remember...
- switch007 2y ago
  The popups in VScode seem explicitly intended to annoy. Why is showing the release log the default for so many things? Is the average user really going to read them? It makes you wonder what they are doing with all that telemetry

zokier 2y ago

[flagged]

consp 2y ago
Maybe make a cve out of it since it is an obvious exploit path running unchecked automatically downloaded binaries without user interference.
- bilekas 2y ago
  I don't know if this is sarcastic but doesn't a CVE require an actual proof of attack and not just hypothetical?
  - consp 2y ago
    It was sarcastic but on point, and many cves do not have poc exploits so at best it is murky.
bilekas 2y ago
I agree with you, it's a standalone package. It can be assumed to have some setup permissions. Also it's far better than the packaging the remote code with the installer or binary. The same people who will complain about this do t really understand how package managers work also. Take npm as an example, you manually install one package. You do not consent explicitly to have all of its dependencies added also. This sounds like typical Reddit behaviour. As you said, a better approach would have been to ask the maintainers to mention it in the readme. No drama required.
- vladvasiliu 2y ago
  I don't use NPM, but that means NPM's behavior isn't that great and maybe shouldn't be an example for others to follow. Linux package managers with which I'm familiar will absolutely prompt you with the list of dependencies they'll install when you ask for some package and give you the possibility of bailing out.

theultdev 2y ago

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

teo_zero 2y ago
> Who wants to approve and configure all of their language servers? I think you're asking the wrong question. The correct one would be: "who wants to be asked if they want to approve and configure all of their language servers?" It's not what zed does, it's doing it behind your back!
eptcyka 2y ago
Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.
- theultdev 2y ago
  Open it in something else then. If you use Zed you must have known the language server was running when you tried it, how did you think that was happening?
  - lucianbr 2y ago
    This kind of article or reddit post and discussion is how you know, at least for some people. Anyway, you asked who would care. Now the topic has moved to "what to do about it", which is hardly an issue. Of course people who think Zed has a problem will not use it. That does not make it a non-problem.
    - theultdev 2y ago
      tbh this "article" looks a lot like a reddit outrage post.

daghamm 2y ago

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

pjmlp 2y ago
Go suppport on VSCode was originally done by an intern at Microsoft, and then later there was an agreement with Google, for Google Go team to take over it.
- ayewo 2y ago
  No wonder. Of all the languages I code in in VSCode, Golang is the most frustrating to use as I can’t jump to definitions with Cmd + Click the way I can in JS, PHP or Java. It there a decent alternative for Golang on the Visual Studio Code marketplace?
  - oefrha 2y ago
    > Golang... I can’t jump to definitions with Cmd + Click That’s absolutely false. Did you refuse to install gopls or something?
    - alias_neo 2y ago
      I think they must have, it's not quite on the level of Goland, but VSCode with all the necessary extensions works well for Go, and doesn't eat 32GB of my RAM to do it.
      - oefrha 2y ago
        That would be quite funny. In a thread about additional components being installed without prompts, a user jumps out to complain about missing functionality in another editor because they refused to install an additional component when prompted.

AlexDragusin 2y ago

> We created the hackable text editor, Atom, and the pioneering software platform that launched an entirely new generation of desktop apps, Electron.

lpcvoid 2y ago
I'd rather wish they hadn't to be honest
- AlexDragusin 2y ago
  That's the point I was trying to make :)
  - airhangerf15 2y ago
    I agree. Electron is cancer. They're proud of creating Javascript Cancer.

biosboiii 2y ago

Not asking the user for consent for software updates is quite common. My corpo rejects a lot software, because they do exactly that.

zarzavat 2y ago
Yes for first party updates. This is different. This is for third party extensions.

mxsjoberg 2y ago

[flagged]

rs_rs_rs_rs_rs 2y ago

At this point I really believe we need a consent popup after every letter typed, got forbid you typed a wrong letter.

DanielVZ 2y ago

This broke Zed for me and had to go back to Neovim at my workspace. The corporate AV software was going crazy with all these automated downloads and installations. It wasn’t blocking them but just vetting them was taking so long, I just didn’t find it worth using

as-cii 2y ago

Hey, Antonio here. Co-founder at Zed. Sorry that we haven't replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we're a small team and, admittedly, it's tricky to keep up with everything. I agree that we should ask users for consent before downloading language servers (and other executables). For everybody who's come across the ticket here or on Reddit and hasn't worked with the Zed codebase yet, let me provide some context on how language support is implemented. In Zed, we have three ways of supporting a language (and its language servers): 1. Extensions that users can install from the `zed-extensions` repository [0] 2. Pre-bundled extensions that ship with the Zed binary, but still need to be installed [1] 3. Built-in language support [2]. For (2) and (3), the code is owned by the Zed team and we make a conscious effort to review contributions from the community in that area. That code can automatically download language servers, but we try to vet which exact scripts/binaries are downloaded from where. For example: we heavily use rust-analyzer ourselves and keep up to date with its releases, the Go language server `gopls` is downloaded from the Go team using the official `go` tooling, the ESLint language server comes from Microsoft, etc. For the longest time, we only had built-in language support (3). A couple of months ago, we shipped extensions for Zed (point 1 and 2 above, parts of it described in [3]). The goal was for built-in language support (3) to gradually move to pre-bundled extensions (2) so that users had the ability to choose which ones to install. We did make some progress, but we haven't ported all languages yet. We're a small team and can only do so many things at once. So after investing quite a bit of time into extensions, we chose to pause that work and invest into other areas for a while (porting Zed to Linux, for example). Once those areas are in a better state, we plan to come back to extensions, build them out some more, and port the remaining languages. So, TL;DR: we hear you loud and clear. We try to vet things that are currently installed automatically. But we agree that we should ask users whether they want to install arbitrary binaries on their computer. We also plan to transition all language support to manually-installed extensions once we finish other projects. [0]: https://github.com/zed-industries/extensions https://github.com/zed-industries/extensions [1]: https://github.com/zed-industries/zed/tree/main/extensions https://github.com/zed-industries/zed/tree/main/extensions [2]: https://github.com/zed-industries/zed/tree/main/crates/languages/src https://github.com/zed-industries/zed/tree/main/crates/langu... [3]: https://zed.dev/blog/language-extensions-part-1 https://zed.dev/blog/language-extensions-part-1

jarule 2y ago

This is why you never want to sell to developers.

notorandit 2y ago

Being it binary or not, it doesn't make any difference. It's the "modern times" craze about plugins pulled from different unauditable, unknown sources. The fact that it is on GitHub or any other "publicly available" source it is irrelevant. I keep using vim and Kate and manually install anything I need form my distro (Arch Linux) repos. If it is not there, then, sorry I cannot use it.

alfiedotwtf 2y ago
This is a fallacy though, unless you’re also code reviewing all of the Archb libraries you pull down
- zamadatix 2y ago
  I think the main add of distro repositories is the repo maintainers sit as a review step between you and the project updates on e.g. GitHub, not that it enables you to better audit the code yourself. I'm not sure it's really all that effective in practical terms though.
  - alfiedotwtf 2y ago
    Distros raise the probability that something will get caught, but it’s only that - increasing your chances not getting pwned… it’s still not bulletproof

perryizgr8 2y ago

There is a balance between asking too many confirmations and not asking at all. VS code had this feature called "Workspace Trust" or something like that. It was so incredibly annoying. Always asking me for my own repos or repos which are in my org, if I trust the authors. I ended up disabling it completely and it will remain that way. I hope Zed finds a way to strike the balance in a better way than bombarding the user with confirmations, otherwise I'll be completely disabling that too, probably to the detriment of the security of my computer.

mapcars 2y ago

Zed is version 0.1-something, you can't expect them realistically have their own maintained packages at this stage. And these things do happen when you use software at the early stages, just wait for 1.0 and see what happens then.

xpe 2y ago

Zed is my favorite editor, but I'm not going to minimize concerns that people raise simply because I think the editor is stupefyingly awesome overall. Questions: What control does a user have right now over what gets installed automatically? What are the levers we can pull to get more control? (These levers include configuration options, pushing back on the project, and so on.) P.S. Not that this is an excuse, but VS Code's security posture (sandboxing, prompting users, etc.) probably didn't happen overnight without user pressure. Who knows the history?

xpe 2y ago
Some highlights from the Github issues thread [1]: > Ideally you would be able to turn off auto-download but still be able to use a [language server] if it’s already on the users system. > There is not a binary choice between "friendly to end users" and "secure". You can have your cake and eat it too. The main thing that should be considered is less of a user facing popup or preference (where opt-in vs. opt-out is an issue, as is noise & friction), but developer facing options. If Zed offered compile time configuration this could be fixed to everybody's satisfaction. Distros could ship a pre-configured package with all the dependencies already provided so that the user experience is just "install and run" while also not having an app that downloads (or attempts to download) binaries behind teh users back. Meanwhile if Zed wants to ship a binary package upstream that defaults to downloading things they can. [1]: https://github.com/zed-industries/zed/issues/12589 https://github.com/zed-industries/zed/issues/12589

deleted 2y ago

[deleted]

legobeet 2y ago

The security side of free editors and IDEs is not great anywhere today for JS development. Once you start wanting more features and integrations, you start facing an apparent choose-any-2 of security, convenience, and productivity. I don't think it has to be this way. I think we can have both better compartmentalization and tighter workflow integration without having it becoming a part-time job. Here is my ongoing attempt at addressing the issue, currently scoped for neovim[0]: https://github.com/legobeat/l7-devenv https://github.com/legobeat/l7-devenv (I did share this to crickets as a Show HN the other day, hope it's on-topic enough to OK to reshare here) [0]: The same framework should, at least in theory, be extensible to do something similar with Code/VSCodium. While working on this I realized there is some overlap with their Dev Containers and am yet to look into if and how one would run those in a similar fashion and if they could be leveraged to the same end

haddr 2y ago

Zed is supposed to be a lightweigh and fast text editor. That was my hope when trying it. This is not the case. When I was editing some JS or HTML file I noticed that my laptop is quite warm. I checked all processes and there was some node process taking up 100% of one of CPUs. It was some language server running in the background in some non-efficient way. The problem with Zed is that its mission is to be "engineered for performance", while in the background they cut corners and run some heavy unoptimized stuff. I think this is not a right strategy, even cosindering it is still in beta.

DrBazza 2y ago
The language server isn't part of Zed though is it? You should report the issues on their github page.
- haddr 2y ago
  it is not, but as the title says: it all happens in the background, without you being aware what happens. The good thing is that this can be turned off with this option: "enable_language_server": false

throwaway202407 2y ago

This was also documented here, nearly 1-year ago: https://github.com/zed-industries/zed/discussions/6659 https://github.com/zed-industries/zed/discussions/6659 Where there is a VSCode theme importer for Zed. And what it does is silently install a Home Brew package and attempt to execute it on your machine.

timeon 2y ago
> silently install a Home Brew package Only thing i found in your link that mentions this is about VSCode extension [0] - not Zed extension. How is that relevant here? [0] https://marketplace.visualstudio.com/items?itemName=degreat.theme-to-zed https://marketplace.visualstudio.com/items?itemName=degreat....

deleted 2y ago

[deleted]

alberth 2y ago

While I share similar concerns, I also want to point out that: - Zed is (currently) free - still pre 1.0 release - being developed quickly by a small group of developers For those of us who enjoy Zed, we should give appreciation for what they have created. As someone who's maintains OSS myself, the onslaught of people who can swarm in fast to piss on your hard/long efforts can demoralize you. So let's be kind in our words (and tone) to these folks.

bcardarella 2y ago
I just don't buy this argument. None of what you've listed gives the right to install binaries without permission. A simple opt-in notification could resolve this but they decided against this for ease of use. Free or not, pre 1.0 or not, small team or not this puts users at risk for a pretty bad attack vector.
- alberth 2y ago
  If DockYard.com had a security incident for a free/beta service, I'm sure you'd want users to show some compassion. (It doesn't make it right, all I'm saying is - showing compassion goes a long way with developers while they re-evaluate)
  - yamumsahoe 2y ago
    oh god, no. users exist to give you money and feedback, not emotional support. when your software enters other people's personal devices, their concern is their safety, security, and privacy, not your feelings.
    - AA-BA-94-2A-56 2y ago
      I actually completely agree with you, although at the very least users can be expected to not be rude. Although, I don't think anyone in this thread (so far) has been rude.
  - bcardarella 2y ago

WuxiFingerHold 2y ago

They could ask during install whether silent installation of LSPs should be done or whether Zed should ask explicitly for every LSP. With Zed, I have another issue. I don't understand which niche it is trying to fill. The advertising story doesn't convince me. The performance bottlenecks are typically the LSPs after all, not if text is rendered in 10 or 20 ms. Startup time is secondary. Yes, memory usage is a concern. I get that and that's where Zed is miles ahead of VS Code and Jetbrains IDEs. But overall I think: - If you want easy and free, go VS Code. - If you want ultimate IDE features and mouse and GUI, go Jetbrains. - If you want ultimate productivity, follow this beautiful guide: https://lazyvim-ambitious-devs.phillips.codes/ https://lazyvim-ambitious-devs.phillips.codes/

ZackLeo 2y ago

[flagged]

idk1 2y ago

This might be a very very silly question so bear with me, why would it need to download these binaries? I'm on sublime text atm, and I can't think of a reason why it would download anything other than the app itself or an update to the app when I'm asked. I know that might sound very stupid and I'm sorry.