Thursday, November 24, 2011

Re: Dubious scripts at vim.org

Excerpts from Yasuhiro MATSUMOTO's message of Fri Nov 25 04:21:39 +0100 2011:
> I'm administrator of http://vim-jp.org/ .
> Have I better to notify to all? Then, I'll post entry about this.
:) Great. That would be perfect. What to post?

There should be enough English text to understand what the plugin is
about.

The plugin contained executables. For the reasons given in this thread
it should be discouraged:
- less trustworthy
- avoid duplication and outdated software.
- avoid huge amounts of binary data.

If there are very strong reasons to contain executables - then it should
be easy to verify their origin.

Additionally it contains NERD_tree.vim which was taken from
The_NERD_tree plugin on www.vim.org.

For distributing sets of foreign plugins I personally recommend VAM
(vim-addon-manager [1]) because it can resolve dependencies - but does not
care about versions which seems to be just good enough for most use
cases.
Eg you add an addon-info.json file with these contents:

{'dependencies': {'The_NERD_tree':{}}}

Then VAM will fetch the up to date version of that plugin automatically.

The intention was writing a plugin making it easy to reuse other
people's work.

If you trust me http://www.mawercer.de/~marc/vam/index.php can be used
to checkout many plugins at once for Windows users - because installing
git and curl on Windows causes some work to setup (too much for my case)
If this implementation (which is running VAM zipping the fetch result)
is used more often I'll think about improving Windows support even more
so that everybody can checkout things himself without trusting my
website. VAM's documentation contains more info about what could be done
such as asking github to return .zip files for windows users.
This way dependencies on third people's homepages/scripts like me can be
dropped. I'm lazy - I only do what I need - or what some people ask me
to do. That's why comments exist right now.

Thanks for replying to this thread!

Marc Weber

[1]: github.com/MarcWeber/vim-addon-manager

--
You received this message from the "vim_use" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

No comments:

Post a Comment