4 ms·

Really dislike the one line installer. How is it installing? Flatpak? Adding an apt repo? Manual install? Fortunately docs go into better detail, https://zed.d

Really dislike the one line installer. How is it installing? Flatpak? Adding an apt repo? Manual install? Fortunately docs go into better detail, https://zed.dev/docs/linux https://zed.dev/docs/linux I'm on Debian anyway so who am I kidding expecting this to be in apt :D

bscphil 2y ago
It's already in the Arch Linux repositories, which is pretty cool: https://archlinux.org/packages/extra/x86_64/zed/ https://archlinux.org/packages/extra/x86_64/zed/
- anotherhue 2y ago
  Am I missing something? NixOS has had it since April https://github.com/NixOS/nixpkgs/commits/nixos-unstable/pkgs/by-name/ze/zed-editor/package.nix https://github.com/NixOS/nixpkgs/commits/nixos-unstable/pkgs...
  - bscphil 2y ago
    Yeah apparently there have been working builds since at least January, that's when the PKGBUILD was created: https://gitlab.archlinux.org/archlinux/packaging/packages/zed/-/commit/6f66ba1d2b03acce3102d75579f05b787033ddb7 https://gitlab.archlinux.org/archlinux/packaging/packages/ze... It's been in the main repos since May.
porphyra 2y ago
You can just read the script that you're curling rather than pipe it into sh directly. It seems like it just extracts the binary from a tar.gz and puts it into ~/.local.
- fao_ 2y ago
  "reading a script" is actually a worse user experience on Linux than just using repositories or flatpak, though. It's pretty rude of software developers to put the onus on users to verify that they're not doing something outright malicious in terms of the installer.
  - jfvinueza 2y ago
    so you feel offended by this
    - fao_ 2y ago
      That's an incredibly weird response to a comment primarily concerned with the user experience of vendoring software on Linux. Not only does it not engage with my comment but it also virtue signals quite a bit, don't you think? It is incredibly ironic when looking at your post history that you state that you have "been involved on[sic] [...] the nuances of interface and user experience". Does my comment not meet that very criteria?
  - janalsncm 2y ago
    Instead of pasting it in terminal, I opened a new tab and read it. There’s maybe 200 lines, most of which aren’t relevant to my platform. Didn’t see anything unusual. I then proceeded to install tens of thousands of lines of code I didn’t read onto my machine. My point? People really seem to be bike shedding this install script bit. If I was a malicious actor I wouldn’t be hiding the bad parts in the install script.
    - whalesalad 2y ago
      200 lines versus the actual install steps which is 1. wget the tarball, 2. extract the tarball to .local/bin, 3. done, or a few more steps to add the desktop file.
  - shepherdjerred 2y ago
    Are you not concerned with the software developers doing something outright malicious in the software itself?
    - BanazirGalbasi 2y ago
      Most repositories have some sort of vetting process as far as I'm aware. In the case of Zed, because it's open-source, it can be examined more completely, although I don't think it's expected for every update to be heavily scrutinized. In the end, at some point you either have to inspect every line of code yourself or trust others to have done it for you. Package managers fall into the latter category.
abhinavk 2y ago
It's a basic download and extract script. Also creates directories as per XDG spec.
deciduously 2y ago
Pipe the script to cat before you pipe it to sh and take a look. It's downloading an executable to ~/.local/bin. If that's not your preference, there are many other options for obtaining the software, via your distribution or manually. I feel the backlash to this pattern is pretty overblown. They're not attempting to hide anything, just make the common case convenient.
- whalesalad 2y ago
  Sure, but that convenience will come to bite you later. What happens when you want to update it? Their full install docs is like 5 lines of code so it is much preferred to do it that way. Every distribution is different. The ideal install here would be to add a unique apt repo for zed and then it becomes part of my normal update process. Updating a binary in a directory is not the end of the world... but I would prefer to know that upfront versus needing to hunt down where it was placed in order to do the updates. edit its 4 lines. seeing this is much preferred to parsing a bash script that is intended to support all distributions: wget https://zed.dev/api/releases/stable/latest/zed-linux-x86_64.tar.gz mkdir -p ~/.local tar -xvf zed-linux-x86_64.tar.gz -C ~/.local ln -sf ~/.local/bin/zed ~/.local/zed.app/bin/zed
- pkage 2y ago
  A lot of the backlash is around the tool downloading and running an arbitrary shell script which could contain anything, and overlooks the fact that that shell script then downloads an opaque binary which could also contain anything. If you're paranoid about security read the code and build it from source, otherwise curl | bash is trusting the authors just as much as any other method.
  - cogman10 2y ago
    Probably the biggest problem with the `curl | sh` approach is it bypasses package maintainers. I agree it's really no different than if you compiled malicious code yourself (or pulled in a 3rd party bin repository). However, one of the functions of a package maintainer is finding/being notified of security issues. I'm thinking of the recent xz attack. Imagine how bad that would have been if xz was commonly installed via `curl | sh`. All this is to say `curl | sh` is probably fine if the org is reputable, however, you should be having second thoughts if this is a repo ran with a bus factor of 1.
deepsun 2y ago
Yep, it's the same as running random code with root permissions. Same as running random .exe from emails, but even without M$ signature. Apt packages also have the root access, but official repositories at least have some paper trail and release process.
- abhinavk 2y ago
  > Yep, it's the same as running random code with root permissions. It doesn't require root. You can read it before you run.
  - whalesalad 2y ago
    "reading before you run" eliminates all convenience of the one liner. Their linux docs are way better because it shows you exactly how to do it on a per-distribution basis. when it comes time to update the software I would prefer to know how exactly it is installed so that I can update it correctly.
    - rad_gruchalski 2y ago
      > when it comes time to update the software I would prefer to know how exactly it is installed so that I can update it correctly Then read the script you complain about.
      - whalesalad 2y ago
        Three months from now I won't remember using the script to install it. And the contents of the script could completely change. This is not a helpful take.
        rad_gruchalski 2y ago
        This is not a helpful take for you. The same method works fine for me over the last decade. Taking notes helps, having some helper scripts helps. If one’s invested in a technology, one finds a way to remember.
igorguerrero 2y ago
I hope it gets packaged, on NixOS there's a package already on stable and unstable.
figomore 2y ago
There is some support to flatpak already, see https://github.com/zed-industries/zed/blob/main/docs/src/development/linux.md#flatpak https://github.com/zed-industries/zed/blob/main/docs/src/dev...
deleted 2y ago
[deleted]

bscphil 2y ago

It's already in the Arch Linux repositories, which is pretty cool: https://archlinux.org/packages/extra/x86_64/zed/ https://archlinux.org/packages/extra/x86_64/zed/

anotherhue 2y ago
Am I missing something? NixOS has had it since April https://github.com/NixOS/nixpkgs/commits/nixos-unstable/pkgs/by-name/ze/zed-editor/package.nix https://github.com/NixOS/nixpkgs/commits/nixos-unstable/pkgs...
- bscphil 2y ago
  Yeah apparently there have been working builds since at least January, that's when the PKGBUILD was created: https://gitlab.archlinux.org/archlinux/packaging/packages/zed/-/commit/6f66ba1d2b03acce3102d75579f05b787033ddb7 https://gitlab.archlinux.org/archlinux/packaging/packages/ze... It's been in the main repos since May.

porphyra 2y ago

You can just read the script that you're curling rather than pipe it into sh directly. It seems like it just extracts the binary from a tar.gz and puts it into ~/.local.

fao_ 2y ago
"reading a script" is actually a worse user experience on Linux than just using repositories or flatpak, though. It's pretty rude of software developers to put the onus on users to verify that they're not doing something outright malicious in terms of the installer.
- jfvinueza 2y ago
  so you feel offended by this
  - fao_ 2y ago
    That's an incredibly weird response to a comment primarily concerned with the user experience of vendoring software on Linux. Not only does it not engage with my comment but it also virtue signals quite a bit, don't you think? It is incredibly ironic when looking at your post history that you state that you have "been involved on[sic] [...] the nuances of interface and user experience". Does my comment not meet that very criteria?
- janalsncm 2y ago
  Instead of pasting it in terminal, I opened a new tab and read it. There’s maybe 200 lines, most of which aren’t relevant to my platform. Didn’t see anything unusual. I then proceeded to install tens of thousands of lines of code I didn’t read onto my machine. My point? People really seem to be bike shedding this install script bit. If I was a malicious actor I wouldn’t be hiding the bad parts in the install script.
  - whalesalad 2y ago
    200 lines versus the actual install steps which is 1. wget the tarball, 2. extract the tarball to .local/bin, 3. done, or a few more steps to add the desktop file.
- shepherdjerred 2y ago
  Are you not concerned with the software developers doing something outright malicious in the software itself?
  - BanazirGalbasi 2y ago
    Most repositories have some sort of vetting process as far as I'm aware. In the case of Zed, because it's open-source, it can be examined more completely, although I don't think it's expected for every update to be heavily scrutinized. In the end, at some point you either have to inspect every line of code yourself or trust others to have done it for you. Package managers fall into the latter category.

abhinavk 2y ago

It's a basic download and extract script. Also creates directories as per XDG spec.

deciduously 2y ago

Pipe the script to cat before you pipe it to sh and take a look. It's downloading an executable to ~/.local/bin. If that's not your preference, there are many other options for obtaining the software, via your distribution or manually. I feel the backlash to this pattern is pretty overblown. They're not attempting to hide anything, just make the common case convenient.

whalesalad 2y ago
Sure, but that convenience will come to bite you later. What happens when you want to update it? Their full install docs is like 5 lines of code so it is much preferred to do it that way. Every distribution is different. The ideal install here would be to add a unique apt repo for zed and then it becomes part of my normal update process. Updating a binary in a directory is not the end of the world... but I would prefer to know that upfront versus needing to hunt down where it was placed in order to do the updates. edit its 4 lines. seeing this is much preferred to parsing a bash script that is intended to support all distributions: wget https://zed.dev/api/releases/stable/latest/zed-linux-x86_64.tar.gz mkdir -p ~/.local tar -xvf zed-linux-x86_64.tar.gz -C ~/.local ln -sf ~/.local/bin/zed ~/.local/zed.app/bin/zed
pkage 2y ago
A lot of the backlash is around the tool downloading and running an arbitrary shell script which could contain anything, and overlooks the fact that that shell script then downloads an opaque binary which could also contain anything. If you're paranoid about security read the code and build it from source, otherwise curl | bash is trusting the authors just as much as any other method.
- cogman10 2y ago
  Probably the biggest problem with the `curl | sh` approach is it bypasses package maintainers. I agree it's really no different than if you compiled malicious code yourself (or pulled in a 3rd party bin repository). However, one of the functions of a package maintainer is finding/being notified of security issues. I'm thinking of the recent xz attack. Imagine how bad that would have been if xz was commonly installed via `curl | sh`. All this is to say `curl | sh` is probably fine if the org is reputable, however, you should be having second thoughts if this is a repo ran with a bus factor of 1.

deepsun 2y ago

Yep, it's the same as running random code with root permissions. Same as running random .exe from emails, but even without M$ signature. Apt packages also have the root access, but official repositories at least have some paper trail and release process.

abhinavk 2y ago
> Yep, it's the same as running random code with root permissions. It doesn't require root. You can read it before you run.
- whalesalad 2y ago
  "reading before you run" eliminates all convenience of the one liner. Their linux docs are way better because it shows you exactly how to do it on a per-distribution basis. when it comes time to update the software I would prefer to know how exactly it is installed so that I can update it correctly.
  - rad_gruchalski 2y ago
    > when it comes time to update the software I would prefer to know how exactly it is installed so that I can update it correctly Then read the script you complain about.
    - whalesalad 2y ago
      Three months from now I won't remember using the script to install it. And the contents of the script could completely change. This is not a helpful take.
      - rad_gruchalski 2y ago
        This is not a helpful take for you. The same method works fine for me over the last decade. Taking notes helps, having some helper scripts helps. If one’s invested in a technology, one finds a way to remember.

igorguerrero 2y ago

I hope it gets packaged, on NixOS there's a package already on stable and unstable.

figomore 2y ago

There is some support to flatpak already, see https://github.com/zed-industries/zed/blob/main/docs/src/development/linux.md#flatpak https://github.com/zed-industries/zed/blob/main/docs/src/dev...

deleted 2y ago

[deleted]