The language used to report the issue is very reasonable. Maybe it's cultural, but the fake version you're suggesting is something I'd find insulting, in addition to upsetting me because it's wasting my time. I prefer it if they get to the point.

> And people wonder why foss devs burn out.

These are full-time devs, working for an investor-backed company that plans to make money off the editor. The FOSS part allows them to profit off the work of volunteers.

Zed is OSS but not free. There's a company behind it, not volunteers. They are doing quite some marketing lately. I don't see anything wrong with calling the current issue "completely unacceptable". Forced opt-in is what happens if the language is not offensive.

I agree with you, it's a standalone package. It can be assumed to have some setup permissions. Also it's far better than the packaging the remote code with the installer or binary.

The same people who will complain about this do t really understand how package managers work also. Take npm as an example, you manually install one package. You do not consent explicitly to have all of its dependencies added also.

This sounds like typical Reddit behaviour.

As you said, a better approach would have been to ask the maintainers to mention it in the readme. No drama required.

Maybe make a cve out of it since it is an obvious exploit path running unchecked automatically downloaded binaries without user interference.

> Instead they go on calling it "completely unacceptable " repeatedly, using language that implies that the devs have caused grave offense.

Downloading and executing untrusted code is a security vulnerability. If a library does so accidentally, avoiding such an accident should be the primary focus of the report. If a library does so intentionally due to an accidental error in design of a feature, then the report can focus on how to provide the same functionality without introducing a security vulnerability.

This is neither of those cases. This is a feature whose core functionality, automatic download and execution of arbitrary code, cannot be introduced without causing a security vulnerability. This trade-off, in which marginal functionality is introduced by sacrificing any and all security, was a decision made at some point.

> but would it have killed the person reporting it to have formulated it something like "I appreciate the convenience of automatic downloads but I'd prefer to be able to opt-out because of [...]".

This phrasing is not equivalent. Stating "I appreciate the convenience of automatic downloads" does not seem accurate at all. Nowhere does the convenience show up as something that the reporter appreciates. Stating "I'd prefer to be able to opt-out" implies that an opt-out is sufficient. Avoiding a security vulnerability based on a per-user opt-out is something that should only be done for a hotfix until a better solution can be implemented.

I could see the report being updated with a minimum list of design changes that would be necessary for the feature to be implemented in a safe manner: "While locating and recommending a package to be downloaded is convenient, the download must only be performed when the user explicitly approves it, with the user informed of the recommended package, its version and checksum, and the download URL prior to any download. Anything less than that is a security vulnerability." However, I don't fault the report for not doing so, as a reporter may not be familiar with a project's design roadmap. Describing an existing feature's design as "completely unacceptable" is sufficient.

And everything is now a "cyber security flaw" or exploit. I don't know why but it seems like there's been a recent crop of less technical people that know just enough to throw around cybersec buzzwords that are completely meaningless in context. Like I've seen people call this an exploit or a code execution vuln (on other platforms). Like what the hell.

I really wish these "torch and pitchfork" posts were declared off-topic. A discussion on what/when to auto-download and how would be useful, but comments on these kind of submissions are almost always just ranting/complaining about how bad $x is, what idiots people are, and things like this.

> And people wonder why foss devs burn out.

I have slowly become convinced that the open source community has been infiltrated by trolls from, eh, I don't know – something or someone that doesn't like open source. I have no direct evidence for this, but it does seem to align with observed facts.

A few days ago someone posted some hobby project they worked on, and of course one of the replies was some unhinged rant about how the chosen $language wasn't any good and how they would "rather kill myself" than use that language... Okay... I don't think any normal personal can get get that triggered by someone's hobby project, hence my conclusion: infiltration by trolls.

Everything is now rage-bait. No need for politics to spark it.