← Back to context

Comment by theteapot

11 hours ago

VSCode extensions and the ecosystem is a security time-bomb. Zed looks to be doing things better.

Zed literally downloads random executables and runs them by default without asking

  • What?! Really?! Link? I'm not a Zed user. That comment was based off a few minutes of research, and I guess a small dose hopium of a VSCode user and understanding what a shit show the extensions setup is and wanting someone to do better.

    • Yep, it pulls stuff from at least npm, it’s not a secret - check the source code.

      Actually it pulls latest versions (checking registry then installing that exact version, not sure why they sidestep normal resolution algorithms) no matter what .npmrc may say, so min-release-age breaks almost everywhere it integrates with JS/TS ecosystem (most visibly, Copilot). I probably should’ve filed an issue.

      It also installs Go packages but I haven’t looked into that.

  • Yes, this is annoying. When doing editor testing, I always also have to open the activity monitor and force quit all extra processes started by Zed.