@natkr@hachyderm.io @0xabad1dea@infosec.exchange @emily_s@mastodon.me.uk LSP is one of those things where things that should have nothing to do with each other, and which have vastly different security properties, have been equated for the sake of ridiculous corporate workflows. Here, something that was supposed to be about processing source text for syntax highlighting, cross-referencing definitions, etc. (all of which could take place fully sandboxed and safe) is doubling as a framework for executing arbitrary, untrusted-data-provided commands.