Zed Editor automatically downloads binaries and NPM packages without consent

Re:Zed Editor automatically downloads binaries and NPM packa... by alias_neo on Monday July 08, 2024 @04:58AM (#40903773)

Quite. VSCode asks with a little pop-up in the bottom right (for me, on Gnome) when you open a project that might benefit from a particular component, and you can accept or decline it.

It tells you what/why it's needed, it's up to you to accept or decline, but you should accept that things won't work well if you don't.

I'm no Microsoft fan (quite the opposite), but VSCode handles this about as well as anything could.

[ Parent | on HN ]

Re:Zed Editor automatically downloads binaries and NPM packa... by bippihippi1 on Monday July 08, 2024 @05:29AM (#40903936)

except for giving network access to extensions having no way to audit if not open source.

[ Parent | on HN ]

Re:Zed Editor automatically downloads binaries and NPM packa... by rfoo on Monday July 08, 2024 @08:26AM (#40904801)

oh come on, if an extension comes with no source code it means it comes with a native binary (because otherwise it's JavaScript and there, are, no, good, JavaScript, obfuscation, in, this, world, period), and does it really matter if it has network access ??? it may as well just inject cryptominer to your ~/.bashrc.

[ Parent | on HN ]