> The first one seems to indeed be a real RCE in vim.
Barely, since there is little restriction as to what options modelines can set they should be largely considered equivalent to eval (if unintentionally). And generally they are which is why distros typically disable them by default.
IMHO in this day and age securemodelines should just be the default.
I don't know much about vim, but from the report it sounds like part of the issue was that disabling modelines would not prevent it:
> tabpanel is missing P_MLE
Unlike statusline and tabline, tabpanel is not marked with the P_MLE flag. This allows a modeline to inject %{...} expressions even when modelineexpr is disabled.
Edit: Upon re-reading the above I guess disabling modelineexpr is not the same as disabling modelines, and disabling modelines altogether might indeed prevent the issue.
This, although it's not merely "easier/cheaper", it's "impossible" (unless you sacrifice a ton of performance)
Same reason as a) GDDR on dGPUs (I think I read somewhere that GDDR is very much like regular DDR, just with much tighter paths and thus soldered in) and b) Framework Desktop (performance would reportedly halve if RAM were not soldered)
SSD reasons I seem to recall are architectural for security: some parts (controller?) that usually sit on a NVMe SSD are embedded in the SoC next to (or inside?) the secure enclave processor or whatever the equivalent of the T2 thing is in Mx chips, so what you'd swap would be a bank of raw storage chips which don't match the controller.
Fun fact: "chambrer le vin" i.e getting (usually red) wine from storage temperature to "room temperature" comes from a time where said room temperature was well below 20 degC (more like 13-15 degC), not the comfortable 20+ degC that people like to enjoy these days.
A sommelier friend of mine says that the best way to taste wine is the one you enjoy; if you want to have a glass of chilled powerful Haut-Médoc with some delicate fish, have at it.
Having the same experience. My kids enjoy getting new sets, but most of them are quickly customized or just destroyed to build something completely new. Terrible take in the parent.
While I agree with the spirit of the thread and dearly love my mini, I think this reasoning doesn’t account for a substantial reduction in bezels: my iPhone 5S had more than a centimetre of black bars above and below its 4" display (altogether it was 5.4" in diagonal), I bet those phablets you mentioned had even bigger bezels and were closer to modern 8.5" phones.
Barely, since there is little restriction as to what options modelines can set they should be largely considered equivalent to eval (if unintentionally). And generally they are which is why distros typically disable them by default.
IMHO in this day and age securemodelines should just be the default.
https://www.vim.org/scripts/script.php?script_id=1876
reply