Post by @dalias@hachyderm.io

2026-01-21 18:44 UTC

@natkr@hachyderm.io @0xabad1dea@infosec.exchange @emily_s@mastodon.me.uk That's hilarous that emacs added support for these backdoor shenanigans. It's bonkers to me that people think build recipes, CI stuff, etc. should be something you're even able to run in the same execution/privilege context as your editor without very very explicit opt-in.

Replies (2)

@dalias@hachyderm.io 2026-01-21 18:53

@natkr@hachyderm.io @0xabad1dea@infosec.exchange @emily_s@mastodon.me.uk LSP is one of those things where things that should have nothing to do with each other, and which have vastly different security properties, have been equated for the sake of ridiculous corporate workflows. Here, something that was supposed to be about processing source text for syntax highlighting, cross-referencing definitions, etc. (all of which could take place fully sandboxed and safe) is doubling as a framework for executing arbitrary, untrusted-data-provided commands.

Open ##2198493
@natkr@hachyderm.io 2026-01-21 19:44

@dalias@hachyderm.io @0xabad1dea@infosec.exchange @emily_s@mastodon.me.uk Good analysis (autocomplete, inline errors, etc), metaprogramming (whether that's macros, codegen, or just plain dynamic typing), fully static analysis: pick two. LSP is the cool baby to hate on, but flycheck&co were mainstream before that and had the same issues.

Open ##2198494