4 ms·

So, what prevents any Atom package from being silently taken over and turned into a private code Hoover? Is there anything in Atom's packaging APIs that ensures

So, what prevents any Atom package from being silently taken over and turned into a private code Hoover? Is there anything in Atom's packaging APIs that ensures plugins that can read source cannot also access the network without permission?

jchw 9y ago
As far as I know: nothing yet. It hasn't been necessary. I don't think people even thought about it. But I think now it's going to become an ordeal...
- TeMPOraL 9y ago
  This is why we can't have nice things. As you say, such limits weren't necessary - because people in the community weren't assholes. Now, thanks to Kite's abuse, somebody will have to implement a permission system to editor plugins...
  - toyg 9y ago
    Man, where does this crap end? A permission system to click on a menu or type a character? A permission system to draw windows...? I think there has to be some responsibility from projects that pack such plugins, to police their ecosystem. I can understand browsers having security layers, because they work exclusively with the biggest cesspool of them all (the internet), but stuff as basic as a text editor should not need something like that - if it does, something else has gone deeply wrong with the project.
    - jdbernard 9y ago
      Interesting that you use browsers as the example of the other end of the spectrum. This particular text editor is built on a browser.
      - toyg 9y ago
        That's very true - it's also the reason I stay the hell away from it :)
  - Freak_NL 9y ago
    That is probably a long time overdue though in the case of editors like Atom. Simply put; if some unethical corporation can hijack projects like this, then a much more malicious actor can as well. One that isn't as easy to detect, and does much more harm (like harvesting any code or input that looks like it could be private data such as credit cards numbers, SSNs, email and passwordish strings found near each other, etc.). Extensions, plugins, and what have you are cool, but straying outside of the fairly monitored confines of you OS's controlled packages carries a risk.

jchw 9y ago

As far as I know: nothing yet. It hasn't been necessary. I don't think people even thought about it. But I think now it's going to become an ordeal...

TeMPOraL 9y ago
This is why we can't have nice things. As you say, such limits weren't necessary - because people in the community weren't assholes. Now, thanks to Kite's abuse, somebody will have to implement a permission system to editor plugins...
- toyg 9y ago
  Man, where does this crap end? A permission system to click on a menu or type a character? A permission system to draw windows...? I think there has to be some responsibility from projects that pack such plugins, to police their ecosystem. I can understand browsers having security layers, because they work exclusively with the biggest cesspool of them all (the internet), but stuff as basic as a text editor should not need something like that - if it does, something else has gone deeply wrong with the project.
  - jdbernard 9y ago
    Interesting that you use browsers as the example of the other end of the spectrum. This particular text editor is built on a browser.
    - toyg 9y ago
      That's very true - it's also the reason I stay the hell away from it :)
- Freak_NL 9y ago
  That is probably a long time overdue though in the case of editors like Atom. Simply put; if some unethical corporation can hijack projects like this, then a much more malicious actor can as well. One that isn't as easy to detect, and does much more harm (like harvesting any code or input that looks like it could be private data such as credit cards numbers, SSNs, email and passwordish strings found near each other, etc.). Extensions, plugins, and what have you are cool, but straying outside of the fairly monitored confines of you OS's controlled packages carries a risk.