8 ms·

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a t

I don't really see the big deal here. Who wants to approve and configure all of their language servers? If you open a file for that language, is there ever a time you would deny the download? I just don't want a huge amount of popups like VSCode. Also, the binaries are downloaded from their release on github. As long as that is secure I don't see a problem.

eptcyka 2y ago
Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.
- theultdev 2y ago
  Open it in something else then. If you use Zed you must have known the language server was running when you tried it, how did you think that was happening?
  - lucianbr 2y ago
    This kind of article or reddit post and discussion is how you know, at least for some people. Anyway, you asked who would care. Now the topic has moved to "what to do about it", which is hardly an issue. Of course people who think Zed has a problem will not use it. That does not make it a non-problem.
    - theultdev 2y ago
      tbh this "article" looks a lot like a reddit outrage post.
- oefrha 2y ago
  That’s a completely separate concern, it’s not like a new language server is downloaded for each file you open. I don’t know if Zed has a “safe mode” like some other editors, if it doesn’t you should ask for that instead. Unless of course you never open untrusted files in a language you’re familiar with, which would make you extremely peculiar.
  - eptcyka 2y ago
    No, but one would be downloaded the first time I'm opening some NPM backdoorfest.
daghamm 2y ago
What if one language server adds a function to use your code for AI training? Are you okay with that as long as it came as a gitthub binary? And these modern editors introduce another issue with their modularazied design. For each supported language Vscode installs tons of other crap beside the language server itself. And the language server alone has a quite long list of dependencies https://github.com/golang/vscode-go/blob/master/extension/go.mod https://github.com/golang/vscode-go/blob/master/extension/go...
- superb_dev 2y ago
  I wouldn’t be okay with that, but I doubt I would be able to tell from the download button
g-b-r 2y ago
GitHub release builds provide no whatsoever guarantee of having been built by GitHub from the corresponding source, if I remember correctly
- theultdev 2y ago
  So the worry is the Zed team themselves will inject something into the binary?
  - broeng 2y ago
    The xz backdoor was an example of exploiting this disconnect. It was not present in the repository, it was inserted only into the release artifacts. Anyone getting xz by checking out the repository and building it themselves, would not be affected by it.
    - nijave 2y ago
      I think that's a slight mischaracterization. It was present in the repo but obfuscated and rigged to only apply in release artifacts. A sufficiently technical user could have found it but that bar was pretty high to clear.
      - broeng 2y ago
        I'm pretty sure that's incorrect. One portion of the build-to-host buildfile was only present in the release tarball. https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4
        nijave 2y ago
        Right but it was injected from data in a "corrupt" xz file in the repo under certain conditions >This injects an obfuscated script to be executed at the end of configure. This script is fairly obfuscated and data from "test" .xz files in the repository. >The files containing the bulk of the exploit are in an obfuscated form in tests/files/bad-3-corrupt_lzma2.xz tests/files/good-large_compressed.lzma committed upstream
compootr 2y ago
> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge
- broeng 2y ago
  Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.
  - ErikBjare 2y ago
    It also supports preinstall and install scripts, for more obvious reasons.
    - broeng 2y ago
      I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.
      - deafpolygon 2y ago
        dependency checking isn't simple
      - andyferris 2y ago
        NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.
        broeng 2y ago
        It seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.
mxsjoberg 2y ago
> I don't really see the big deal here. Who wants to approve and configure all of their language servers? everyone > If you open a file for that language, is there ever a time you would deny the download? every time default should be offline imo. want to download something? do it manually and place in folder etc
- Dobbs 2y ago
  Just migrated from Vim to NeoVim. Downloading and configuring all the various LSPs has genuinely been one of the most frustrating aspects.
  - nrabulinski 2y ago
    Then you’d click the „yes and never ask me again” if a prompt about whether you want to download a random binary showed up. But a lot of people wouldn’t want to click that and would either click „no and never ask me again” or vet each case one by one
    - theultdev 2y ago
      How are you going to "vet" the language server when it pops up? It's not a "random binary" either, it's a hosted binary for language features coming from the zed developers github release. Even if the binary was compiled on demand when you clicked the button, were you going to go through the entire source of node to verify?
      - wtetzner 2y ago
        > How are you going to "vet" the language server when it pops up? You may not vet the source of the language server, but you might want to determine which ones you are willing to trust/take the risk, and which ones you aren't.
  - Woshiwuja 2y ago
    just use mason
chillfox 2y ago
I usually don't use language servers at all. AI auto complete does the same for me faster... So yes, I would like to not download any of them.
- brabel 2y ago
  IntelliJ now comes by default with a local-only AI auto-completer. I noticed that almost always, it "knows" the autocompletion better than the older intellisense. However, sometimes (very often) you need to explore the API and just check every available method and check their docs to find which one is appropriate to use. So, even though I can see AI replacing a lot of auto-completions, it just can't replace it completely.
  - chillfox 2y ago
    Guess it depends on upon what you do. I mostly make crud endpoints, so I can remember most of what I need. And for the times when I can't I prefer to view the API docs in a browser.
seeknotfind 2y ago
It's okay for a browser to download and use anything from any site, maybe, with mature cross origin policies and billions in security work, but the fact it's done without saying anything is just a bug that can be fixed. Fixing clarity is the real win. What's really funny is it was found because it was crashing and the user was running another libc. If they're really concerned about 14MB of download, they should add a firewall or something, but they saw it crashing. Finally, all these versions of everything sitting around, nodeJS, glibc, etc, very UNIX, a recipe for small breakages. Though I guess that's just the problem we deal with.
teo_zero 2y ago
> Who wants to approve and configure all of their language servers? I think you're asking the wrong question. The correct one would be: "who wants to be asked if they want to approve and configure all of their language servers?" It's not what zed does, it's doing it behind your back!

eptcyka 2y ago

Yes, whenever I’m reading untrusted code, I don’t want to be using a language server - most of them execute arbitrary code, and I do not want that.

theultdev 2y ago
Open it in something else then. If you use Zed you must have known the language server was running when you tried it, how did you think that was happening?
- lucianbr 2y ago
  This kind of article or reddit post and discussion is how you know, at least for some people. Anyway, you asked who would care. Now the topic has moved to "what to do about it", which is hardly an issue. Of course people who think Zed has a problem will not use it. That does not make it a non-problem.
  - theultdev 2y ago
    tbh this "article" looks a lot like a reddit outrage post.
oefrha 2y ago
That’s a completely separate concern, it’s not like a new language server is downloaded for each file you open. I don’t know if Zed has a “safe mode” like some other editors, if it doesn’t you should ask for that instead. Unless of course you never open untrusted files in a language you’re familiar with, which would make you extremely peculiar.
- eptcyka 2y ago
  No, but one would be downloaded the first time I'm opening some NPM backdoorfest.

daghamm 2y ago

What if one language server adds a function to use your code for AI training? Are you okay with that as long as it came as a gitthub binary? And these modern editors introduce another issue with their modularazied design. For each supported language Vscode installs tons of other crap beside the language server itself. And the language server alone has a quite long list of dependencies https://github.com/golang/vscode-go/blob/master/extension/go.mod https://github.com/golang/vscode-go/blob/master/extension/go...

superb_dev 2y ago
I wouldn’t be okay with that, but I doubt I would be able to tell from the download button

g-b-r 2y ago

GitHub release builds provide no whatsoever guarantee of having been built by GitHub from the corresponding source, if I remember correctly

theultdev 2y ago
So the worry is the Zed team themselves will inject something into the binary?
- broeng 2y ago
  The xz backdoor was an example of exploiting this disconnect. It was not present in the repository, it was inserted only into the release artifacts. Anyone getting xz by checking out the repository and building it themselves, would not be affected by it.
  - nijave 2y ago
    I think that's a slight mischaracterization. It was present in the repo but obfuscated and rigged to only apply in release artifacts. A sufficiently technical user could have found it but that bar was pretty high to clear.
    - broeng 2y ago
      I'm pretty sure that's incorrect. One portion of the build-to-host buildfile was only present in the release tarball. https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4
      - nijave 2y ago
        Right but it was injected from data in a "corrupt" xz file in the repo under certain conditions >This injects an obfuscated script to be executed at the end of configure. This script is fairly obfuscated and data from "test" .xz files in the repository. >The files containing the bulk of the exploit are in an obfuscated form in tests/files/bad-3-corrupt_lzma2.xz tests/files/good-large_compressed.lzma committed upstream

compootr 2y ago

> I don't really see the big deal here Here's an idea: someone sends a dev at some company, or even a freelancer, some code. Code references a module with a malicious npm package (say, with a postinstall script). Dev opens it in zed Now, my untrusted code is running on your machine, probably without your knowledge

broeng 2y ago
Why the hell does npm support a postinstall script? There really shouldn't be a need to run arbitrary code provided by the package for something like this.
- ErikBjare 2y ago
  It also supports preinstall and install scripts, for more obvious reasons.
  - broeng 2y ago
    I don't really think thats more obvious. It's expected to install dev libraries, not system services, it shouldn't have that need.
    - deafpolygon 2y ago
      dependency checking isn't simple
    - andyferris 2y ago
      NodeJS isn't very sandboxed. Many "dev libraries" are native and will either download and link to binary blobs, or build e.g. C code, which AFAICT is what all the various install scripts are for.
      - broeng 2y ago
        It seems like a bad design choice, that, besides allowing for running untrusted code directly at download time, also makes it difficult to properly mirror artifacts, and I'd assume, make platform portability inconsistent, at best.

mxsjoberg 2y ago

> I don't really see the big deal here. Who wants to approve and configure all of their language servers? everyone > If you open a file for that language, is there ever a time you would deny the download? every time default should be offline imo. want to download something? do it manually and place in folder etc

Dobbs 2y ago
Just migrated from Vim to NeoVim. Downloading and configuring all the various LSPs has genuinely been one of the most frustrating aspects.
- nrabulinski 2y ago
  Then you’d click the „yes and never ask me again” if a prompt about whether you want to download a random binary showed up. But a lot of people wouldn’t want to click that and would either click „no and never ask me again” or vet each case one by one
  - theultdev 2y ago
    How are you going to "vet" the language server when it pops up? It's not a "random binary" either, it's a hosted binary for language features coming from the zed developers github release. Even if the binary was compiled on demand when you clicked the button, were you going to go through the entire source of node to verify?
    - wtetzner 2y ago
      > How are you going to "vet" the language server when it pops up? You may not vet the source of the language server, but you might want to determine which ones you are willing to trust/take the risk, and which ones you aren't.
- Woshiwuja 2y ago
  just use mason

chillfox 2y ago

I usually don't use language servers at all. AI auto complete does the same for me faster... So yes, I would like to not download any of them.

brabel 2y ago
IntelliJ now comes by default with a local-only AI auto-completer. I noticed that almost always, it "knows" the autocompletion better than the older intellisense. However, sometimes (very often) you need to explore the API and just check every available method and check their docs to find which one is appropriate to use. So, even though I can see AI replacing a lot of auto-completions, it just can't replace it completely.
- chillfox 2y ago
  Guess it depends on upon what you do. I mostly make crud endpoints, so I can remember most of what I need. And for the times when I can't I prefer to view the API docs in a browser.

seeknotfind 2y ago

It's okay for a browser to download and use anything from any site, maybe, with mature cross origin policies and billions in security work, but the fact it's done without saying anything is just a bug that can be fixed. Fixing clarity is the real win. What's really funny is it was found because it was crashing and the user was running another libc. If they're really concerned about 14MB of download, they should add a firewall or something, but they saw it crashing. Finally, all these versions of everything sitting around, nodeJS, glibc, etc, very UNIX, a recipe for small breakages. Though I guess that's just the problem we deal with.

teo_zero 2y ago

> Who wants to approve and configure all of their language servers? I think you're asking the wrong question. The correct one would be: "who wants to be asked if they want to approve and configure all of their language servers?" It's not what zed does, it's doing it behind your back!