News for hackers. Stuff that matters.

A comment on Zed Editor automatically downloads binaries and NPM packages without consent. Parent comment

Re:Zed Editor automatically downloads binaries and NPM packa... by alfiedotwtf on Monday July 08, 2024 @08:01AM (#40904595)
How is that any different from the VS Code extensions that have one star and are just copies of other extensions… waiting to get high stars and then switch-a-roo? Same goes for browser extensions.

Unless you’re auditing everything while taking Trusting Trust into account, you’re drawing the line somewhere saying “ok I can’t be bothered past this point verifying”.

… everyone has a line somewhere on the trust-but-verify spectrum

[ Parent | on HN ]
Re:Zed Editor automatically downloads binaries and NPM packa... by wtetzner on Wednesday July 10, 2024 @05:41PM (#40931804)
> … everyone has a line somewhere on the trust-but-verify spectrum

Sure, and by making the automatic downloads optional, users are given the choice of where they want to draw that line.

[ Parent | on HN ]