Zed Editor automatically downloads binaries and NPM packages without consent

Re:Zed Editor automatically downloads binaries and NPM packa... by kmarc on Monday July 08, 2024 @04:53AM (#40903743)

I do the same (not for golang tho). However, vim plug-ins also "have network access", in fact they can just "system()" and call anything. No sandboxing at all. At least the source code of these plug-ins are not obfuscated/compressed.

However, this makes me wonder how much of a surface attack this is.

[ Parent | on HN ]

Re:Zed Editor automatically downloads binaries and NPM packa... by rfoo on Monday July 08, 2024 @08:21AM (#40904761)

Do you pin your plugins down to commit hash?

[ Parent | on HN ]

Re:Zed Editor automatically downloads binaries and NPM packa... by kmarc on Monday July 08, 2024 @11:45AM (#40906402)

I did in the past.

Now I just run `:PlugUpdate` and hope that whatever comes from GitHub, is seen by the manyeyeballs. I certainly don't check all the diffs.

[ Parent | on HN ]