4 ms·

My God, the list of npm dependencies some projects I've worked on had. Endless. Anyway, it could have been me. I don't inspect vim plugins before install, gen

by qup 3y ago

My God, the list of npm dependencies some projects I've worked on had. Endless. Anyway, it could have been me. I don't inspect vim plugins before install, generally. Security is hard. Even if you're an expert, it's a lot of work.

throwaway290 3y ago
I always give source code a glance, unless it's by a sufficiently prominent and reputable maintainer.
- maccard 3y ago
  Do you check _their_ dependencies though? And do you check every file?
  - throwaway290 3y ago
    I don't check every file but I use very sophisticated proprietary heuristics such as "intuition" and "hunch" for how far to dig. I use vim so dependencies are explicit. But when using npm packages in work I give dependencies a look before I look anywhere else. An unfamiliar dependency gets looked at. It's easier since npm web browser allows inspecting code. It's a very imperfect process.
    - qup 3y ago
      Have you ever caught anything?
      - throwaway290 3y ago
        No, that would be a different story:) ended up not using dozens of plugins and libs stuff after a look at their dependencies and code though
  - anthk 3y ago
    Emacs has deps on libraries such as pdf-tools with mupdf and telega with tdlib, but these are installed from the OS repos so they are trustful.
  - Jorengarenar 3y ago
    Only handful of Vim plugins have dependencies and even then you need to install them explicitly
deleted 3y ago
[deleted]
PhilipRoman 3y ago
As a bare minimum security measure, when using plugins (all 9 of them), my Vim runs in a bubblewrap sandbox with only my project folder mounted as writable. Network and IPC access is completely disabled. It is secure enough to stop practically all non-targeted attacks. Generally I try to install plugins whose authors I know. And whenever I update them (once a year) I re-read the entire source code. Some small plugins I just integrate in vimrc directly. I hate to say this but Vim isn't the most secure editor, considering features like modelines which some environments enable by default and an aggressive plugin installing culture.
- anthk 3y ago
  So it's Emacs, but we want features and not to be locked. Don't run propietary crap, trust Elisp repo like ELPA and NonGNU and you will be mostly safe.
  - rollcat 3y ago
    Isn't MELPA just serving the latest git master of whatever it happens to be at the time package-refresh-contents was called? With MELPA stable likewise just serving the latest tag? That doesn't spell trust.
    - medo-bear 3y ago
      Using Emacs is not going to help you to avoid supply chain attacks per se. What it might do, however, is give you unparalleled power to inspect your environment - calls and source. If you run untrusted code you are exposed, and thats that. Development tools should assume that you, a programmer, know what you are programming. Emacs and lisp is focused on providing power, not security. These often do not go hand in hand.
      - rollcat 3y ago
        > What it might do, however, is give you unparalleled power to inspect your environment [...] The "read the source" argument. It doesn't scale. I don't have 17 lifetimes to study a single release of every bit of software I run. I really do appreciate Emacs for the introspection capabilities, but it's not a solution to the trust chain issue.

by qup 3y ago

throwaway290 3y ago

I always give source code a glance, unless it's by a sufficiently prominent and reputable maintainer.

maccard 3y ago
Do you check _their_ dependencies though? And do you check every file?
- throwaway290 3y ago
  I don't check every file but I use very sophisticated proprietary heuristics such as "intuition" and "hunch" for how far to dig. I use vim so dependencies are explicit. But when using npm packages in work I give dependencies a look before I look anywhere else. An unfamiliar dependency gets looked at. It's easier since npm web browser allows inspecting code. It's a very imperfect process.
  - qup 3y ago
    Have you ever caught anything?
    - throwaway290 3y ago
      No, that would be a different story:) ended up not using dozens of plugins and libs stuff after a look at their dependencies and code though
- anthk 3y ago
  Emacs has deps on libraries such as pdf-tools with mupdf and telega with tdlib, but these are installed from the OS repos so they are trustful.
- Jorengarenar 3y ago
  Only handful of Vim plugins have dependencies and even then you need to install them explicitly

deleted 3y ago

[deleted]

PhilipRoman 3y ago

As a bare minimum security measure, when using plugins (all 9 of them), my Vim runs in a bubblewrap sandbox with only my project folder mounted as writable. Network and IPC access is completely disabled. It is secure enough to stop practically all non-targeted attacks. Generally I try to install plugins whose authors I know. And whenever I update them (once a year) I re-read the entire source code. Some small plugins I just integrate in vimrc directly. I hate to say this but Vim isn't the most secure editor, considering features like modelines which some environments enable by default and an aggressive plugin installing culture.

anthk 3y ago
So it's Emacs, but we want features and not to be locked. Don't run propietary crap, trust Elisp repo like ELPA and NonGNU and you will be mostly safe.
- rollcat 3y ago
  Isn't MELPA just serving the latest git master of whatever it happens to be at the time package-refresh-contents was called? With MELPA stable likewise just serving the latest tag? That doesn't spell trust.
  - medo-bear 3y ago
    Using Emacs is not going to help you to avoid supply chain attacks per se. What it might do, however, is give you unparalleled power to inspect your environment - calls and source. If you run untrusted code you are exposed, and thats that. Development tools should assume that you, a programmer, know what you are programming. Emacs and lisp is focused on providing power, not security. These often do not go hand in hand.
    - rollcat 3y ago
      > What it might do, however, is give you unparalleled power to inspect your environment [...] The "read the source" argument. It doesn't scale. I don't have 17 lifetimes to study a single release of every bit of software I run. I really do appreciate Emacs for the introspection capabilities, but it's not a solution to the trust chain issue.