Re:Zed Editor automatically downloads binaries and NPM packa...
by myaccountonhn on Monday July 08, 2024 @07:48AM
(#40904516)
Well a permission model is one way, like OSes have. Another is something like elm with controlled effects, so you can just search the source code and see if something is off.
Re:Zed Editor automatically downloads binaries and NPM packa...
by II2II on Monday July 08, 2024 @08:30AM
(#40904824)
A different (Visual Studio Code) example that uses network access and runs executables from untrusted sources: embedded development. You have everything from tools like PlatformIO, that manages the toolchain for microcontrollers from multiple vendors; to ESP-IDF, that manages the toolchain for microcontrollers based upon multiple architectures; to Raspberry Pi Pico, which uses the IDE as a simplified installer for their toolchain.
With some compilers leaning on user side, rather than system side, toolchain management (e.g. Rust), I would imagine that plugins managing that would be desirable as well.
Keep in mind, computers are about automation. We should be able to reap the benefits of that automation to the greatest degree possible. Alas, we can't due to bad actors.
Re:Zed Editor automatically downloads binaries and NPM packa...
by jazzyjackson on Monday July 08, 2024 @07:41PM
(#40910986)
Having network access from within the IDE so I can use tools that reach out to package managers and remote git servers - yes, of course that is expected behavior.
If I want to install an extension that gives me syntax highlighting and code intelligence for an obscure template language, why should I expect that extension to have unfettered network access to exfiltrate my ptivate files?
Like the dead guy said, when working with private customer data it's just not on the table to take the risk, I am stuck running vanilla vs code.
In my mind, an IDE needs to be able to read all the files I can read myself, it needs to be able run arbitary tools like compilers and linkers then run the resulting compiled code, it needs a debugger that can attach to running processes and mess with them, it needs to be able to pull from the language's package repository when you ask it to, it needs to talk to your git server when needed, it needs access to your SSH keys to do that. About the only thing the IDE doesn't need is to run as root - and if you're working with Docker it basically needs that too.
The idea of an IDE with pluggable language support safely running plugins from untrusted sources? I can't imagine how such a thing could even be possible?