This is what I hate about vscode, and they at least ask for consent. Some of the stuff vscode needs for golang are (to me) developed by Random Joe on github. It's just a matter of time before it is abused for supply chain attacks.
Pretty much all of it seems to be on golang.org, github.com/google, or are by people working on gopls. The suggestions that there are tons of dependencies from random people is just not true.
In my mind, an IDE needs to be able to read all the files I can read myself, it needs to be able run arbitary tools like compilers and linkers then run the resulting compiled code, it needs a debugger that can attach to running processes and mess with them, it needs to be able to pull from the language's package repository when you ask it to, it needs to talk to your git server when needed, it needs access to your SSH keys to do that. About the only thing the IDE doesn't need is to run as root - and if you're working with Docker it basically needs that too.
The idea of an IDE with pluggable language support safely running plugins from untrusted sources? I can't imagine how such a thing could even be possible?
With some compilers leaning on user side, rather than system side, toolchain management (e.g. Rust), I would imagine that plugins managing that would be desirable as well.
Keep in mind, computers are about automation. We should be able to reap the benefits of that automation to the greatest degree possible. Alas, we can't due to bad actors.
I'm a data scientist, intrinsic to my job is to work with private data that is usually vital to the company or 3rd party, the thought of running any plugins/software from untrusted sources is just insane in this environment.
Basically anything that isn't in the internal repository is a big no, so that rules out the pulling from the language package repository.
Access to the git server is handled at network level outside the workstation, I can only access a few services anyway, not regular internet access, the ssh keys are only valid for a period of time & current project, preconfigured in an image.
Some of us just have different needs.
If I want to install an extension that gives me syntax highlighting and code intelligence for an obscure template language, why should I expect that extension to have unfettered network access to exfiltrate my ptivate files?
Like the dead guy said, when working with private customer data it's just not on the table to take the risk, I am stuck running vanilla vs code.
Also supply chain attacks are a freight train barreling down the tracks. The gate is down and the crossing bells are dinging but our car is stuck on the tracks.
Ever since the xz thing almost worked every black hat group on the entire planet is trying their hand at this. The days of software dev as a high trust environment are going to be over fast.
That's good
Quite tired of being the only one in my org with outbound firewall rules
It works really well for us and prevents potentially bad extensions, python libraries, etc exfilling our code, data, etc.
It there a decent alternative for Golang on the Visual Studio Code marketplace?
That’s absolutely false. Did you refuse to install gopls or something?
It tells you what/why it's needed, it's up to you to accept or decline, but you should accept that things won't work well if you don't.
I'm no Microsoft fan (quite the opposite), but VSCode handles this about as well as anything could.
Even on emacs, using gopls, `Meta+.` (go to definition) works.
I use some VS Code (when I need to do web stuff besides Go), some emacs, and both use gopls so support is pretty much equivalent in terms of functionality.
However, this makes me wonder how much of a surface attack this is.
Now I just run `:PlugUpdate` and hope that whatever comes from GitHub, is seen by the manyeyeballs. I certainly don't check all the diffs.
Include the most popular vim plugins as well. Easy motion and Nerdtree. Doesn't support language specific plugins, but core jetbrains products covers that
On another point I spent 2 hours setting up a Ruby interpretter because no matter what I did Intellij would not recognise my RVM ruby, I think compiling without yjit and setting up a specific gemset for the project plus a few Restart IDE and Invalidate caches later did it, but not sure.
For tailwind specifically the extension is lacking compared to VSCode, I do not have color squares for my color classes and the classes are not recognized in more difficult filetypes (i.e. erb templates). Many other extensions seem much less loved than on VSCode, i.e. continue.dev, you can read their reviews and quickly get a sense that it's much more niche ecosystem.
I love the editor experience overall and especially for Go projects, but can't switch fully yet.
You may need to add interpreters first then there's a modules page in project settings you can select path and tool
Odd, what extensions are you using? I use only go.dev extension and intellisense has been working great for golang dev for years.