Zed Editor automatically downloads binaries and NPM packages without consent

This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.

While I share similar concerns, I also want to point out that:<p><pre><code> - Zed is (currently) free - still pre 1.0 release - being developed quickly by a small group of developers </code></pre> <i>For those of us who enjoy Zed, we should give appreciation for what they have created.</i><p>As someone who&#x27;s maintains OSS myself, the onslaught of people who can swarm in fast to piss on your hard&#x2F;long efforts can demoralize you.<p>So let&#x27;s be kind in our words (and tone) to these folks.

I don&#x27;t really see the big deal here. Who wants to approve and configure all of their language servers?<p>If you open a file for that language, is there ever a time you would deny the download?<p>I just don&#x27;t want a huge amount of popups like VSCode.<p>Also, the binaries are downloaded from their release on github. As long as that is secure I don&#x27;t see a problem.

This broke Zed for me and had to go back to Neovim at my workspace. The corporate AV software was going crazy with all these automated downloads and installations. It wasn’t blocking them but just vetting them was taking so long, I just didn’t find it worth using

Zed is my favorite editor, but I&#x27;m not going to minimize concerns that people raise simply because I think the editor is stupefyingly awesome overall.<p>Questions: What control does a user have right now over what gets installed automatically? What are the levers we can pull to get more control? (These levers include configuration options, pushing back on the project, and so on.)<p>P.S. Not that this is an excuse, but VS Code&#x27;s security posture (sandboxing, prompting users, etc.) probably didn&#x27;t happen overnight without user pressure. Who knows the history?

Zed is supposed to be a lightweigh and fast text editor. That was my hope when trying it. This is not the case. When I was editing some JS or HTML file I noticed that my laptop is quite warm. I checked all processes and there was some node process taking up 100% of one of CPUs. It was some language server running in the background in some non-efficient way. The problem with Zed is that its mission is to be &quot;engineered for performance&quot;, while in the background they cut corners and run some heavy unoptimized stuff. I think this is not a right strategy, even cosindering it is still in beta.

They could ask during install whether silent installation of LSPs should be done or whether Zed should ask explicitly for every LSP.<p>With Zed, I have another issue. I don&#x27;t understand which niche it is trying to fill. The advertising story doesn&#x27;t convince me. The performance bottlenecks are typically the LSPs after all, not if text is rendered in 10 or 20 ms. Startup time is secondary. Yes, memory usage is a concern. I get that and that&#x27;s where Zed is miles ahead of VS Code and Jetbrains IDEs. But overall I think:<p>- If you want easy and free, go VS Code.<p>- If you want ultimate IDE features and mouse and GUI, go Jetbrains.<p>- If you want ultimate productivity, follow this beautiful guide: <a href="https:&#x2F;&#x2F;lazyvim-ambitious-devs.phillips.codes&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lazyvim-ambitious-devs.phillips.codes&#x2F;</a>

I don&#x27;t get why having a modal for each tool asking for consent is too hard.

Being it binary or not, it doesn&#x27;t make any difference.<p>It&#x27;s the &quot;modern times&quot; craze about plugins pulled from different unauditable, unknown sources. The fact that it is on GitHub or any other &quot;publicly available&quot; source it is irrelevant.<p>I keep using vim and Kate and manually install anything I need form my distro (Arch Linux) repos. If it is not there, then, sorry I cannot use it.

Zed is version 0.1-something, you can&#x27;t expect them realistically have their own maintained packages at this stage. And these things do happen when you use software at the early stages, just wait for 1.0 and see what happens then.

The security side of free editors and IDEs is not great anywhere today for JS development. Once you start wanting more features and integrations, you start facing an apparent choose-any-2 of security, convenience, and productivity.<p>I don&#x27;t think it has to be this way. I think we can have both better compartmentalization and tighter workflow integration without having it becoming a part-time job.<p>Here is my ongoing attempt at addressing the issue, currently scoped for neovim[0]:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;legobeat&#x2F;l7-devenv">https:&#x2F;&#x2F;github.com&#x2F;legobeat&#x2F;l7-devenv</a><p>(I did share this to crickets as a Show HN the other day, hope it&#x27;s on-topic enough to OK to reshare here)<p>[0]: The same framework should, at least in theory, be extensible to do something similar with Code&#x2F;VSCodium. While working on this I realized there is some overlap with their Dev Containers and am yet to look into if and how one would run those in a similar fashion and if they could be leveraged to the same end

This was also documented here, nearly 1-year ago:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;zed&#x2F;discussions&#x2F;6659">https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;zed&#x2F;discussions&#x2F;6659</a><p>Where there is a VSCode theme importer for Zed.<p>And what it does is silently install a Home Brew package and attempt to execute it on your machine.

Not asking the user for consent for software updates is quite common.<p>My corpo rejects a lot software, because they do exactly that.

There is a balance between asking too many confirmations and not asking at all. VS code had this feature called &quot;Workspace Trust&quot; or something like that. It was so incredibly annoying. Always asking me for my own repos or repos which are in my org, if I trust the authors. I ended up disabling it completely and it will remain that way. I hope Zed finds a way to strike the balance in a better way than bombarding the user with confirmations, otherwise I&#x27;ll be completely disabling that too, probably to the detriment of the security of my computer.

I lost my investment capital and profits trading online, they kept on requesting for extra funds before a withdrawal request can be accepted and processed, in the end, I lost all my money. All efforts to reach out to their customer support desk had declined, I found it very hard to move on. God so kind I followed a broadcast that teaches on how scammed victims can recover their fund through the help of Gavin ray a recovery specialist, I contacted his email provided for consultation, I got feedback after some hours and I was asked to provide all legal details concerning my investment, I did exactly what they instructed me to do without delay, to my greatest surprise I was able to recover my money back including my profit which my capital generated. I said I will not hold this to myself but share it to the public so that all scammed victims can get their funds back. Contact his email:gavinray78@gmail.com or whatsapp +1 352 322 2096

This might be a very very silly question so bear with me, why would it need to download these binaries? I&#x27;m on sublime text atm, and I can&#x27;t think of a reason why it would download anything other than the app itself or an update to the app when I&#x27;m asked. I know that might sound very stupid and I&#x27;m sorry.

This is why you never want to sell to developers.

Hey, Antonio here. Co-founder at Zed.<p>Sorry that we haven&#x27;t replied to that GitHub issue yet. We try our best to listen to the community (here, on GitHub, on Discord, ...), but we&#x27;re a small team and, admittedly, it&#x27;s tricky to keep up with everything.<p>I agree that we should ask users for consent before downloading language servers (and other executables).<p>For everybody who&#x27;s come across the ticket here or on Reddit and hasn&#x27;t worked with the Zed codebase yet, let me provide some context on how language support is implemented.<p>In Zed, we have three ways of supporting a language (and its language servers):<p>1. Extensions that users can install from the `zed-extensions` repository [0]<p>2. Pre-bundled extensions that ship with the Zed binary, but still need to be installed [1]<p>3. Built-in language support [2].<p>For (2) and (3), the code is owned by the Zed team and we make a conscious effort to review contributions from the community in that area.<p>That code can automatically download language servers, but we try to vet which exact scripts&#x2F;binaries are downloaded from where. For example: we heavily use rust-analyzer ourselves and keep up to date with its releases, the Go language server `gopls` is downloaded from the Go team using the official `go` tooling, the ESLint language server comes from Microsoft, etc.<p>For the longest time, we only had built-in language support (3). A couple of months ago, we shipped extensions for Zed (point 1 and 2 above, parts of it described in [3]). The goal was for built-in language support (3) to gradually move to pre-bundled extensions (2) so that users had the ability to choose which ones to install. We did make some progress, but we haven&#x27;t ported all languages yet.<p>We&#x27;re a small team and can only do so many things at once. So after investing quite a bit of time into extensions, we chose to pause that work and invest into other areas for a while (porting Zed to Linux, for example). Once those areas are in a better state, we plan to come back to extensions, build them out some more, and port the remaining languages.<p>So, TL;DR: we hear you loud and clear. We try to vet things that are currently installed automatically. But we agree that we should ask users whether they want to install arbitrary binaries on their computer. We also plan to transition all language support to manually-installed extensions once we finish other projects.<p>[0]: <a href="https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;extensions">https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;extensions</a><p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;zed&#x2F;tree&#x2F;main&#x2F;extensions">https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;zed&#x2F;tree&#x2F;main&#x2F;extensions</a><p>[2]: <a href="https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;zed&#x2F;tree&#x2F;main&#x2F;crates&#x2F;languages&#x2F;src">https:&#x2F;&#x2F;github.com&#x2F;zed-industries&#x2F;zed&#x2F;tree&#x2F;main&#x2F;crates&#x2F;langu...</a><p>[3]: <a href="https:&#x2F;&#x2F;zed.dev&#x2F;blog&#x2F;language-extensions-part-1" rel="nofollow">https:&#x2F;&#x2F;zed.dev&#x2F;blog&#x2F;language-extensions-part-1</a>

&gt; We created the hackable text editor, Atom, and the pioneering software platform that launched an entirely new generation of desktop apps, Electron.

At this point I really believe we need a consent popup after every letter typed, got forbid you typed a wrong letter.