Re: [PATCH] Add project-wide .vimrc configuration

From: Felipe Contreras <felipe.contreras@gmail.com>
Date: Dec 9, 2020, 06:28 UTC
Message-ID: <CAMP44s3-38WJXxzFJhhxvB-PVNzRuu+oaC3aVb=VF+P42S8WOw@mail.gmail.com>
In-Reply-To: <X9Al3u9/jw3QWN7q@pug.qqx.org>

On Tue, Dec 8, 2020 at 7:18 PM Aaron Schrab <aaron@schrab.com> wrote:

Show 13 quoted lines

>
> At 18:26 -0600 08 Dec 2020, Felipe Contreras <felipe.contreras@gmail.com> wrote:
> >By default it's ignored, you need the following in your ~/.vimrc
> >
> >  set exrc
>
> Running `:help 'exrc'` in vim includes the text:
>
>          Setting this option is a potential security leak.  E.g., consider
>          unpacking a package or fetching files from github, a .vimrc in there
>          might be a trojan horse.  BETTER NOT SET THIS OPTION!
>          Instead, define an autocommand in your .vimrc to set options for a
>          matching directory.

Yeah, but if they *really* didn't want people to set this option they would remove it.

Yes, it's dangerous, but that's why it's an option.

Anyway, I wrote a simple loader that should take care of this security risk, in the same way other local vimrc loaders do.

> So I don't think it's a good idea to encourage people to do that by
> using a name that invites it. Also I think that the file would be more
> discoverable for people to incorporate into their own configuration if
> not named as a hidden file.

Perhaps. There's already an .editorconfig so we would be following similar steps, and also this is what other vimrc loaders already use.

Since I'm adding a contrib/vim directory maye a README file would make sense.

Check v2 and let me know what you think.

-- 
Felipe Contreras