Aaron Schrab <aaron@xxxxxxxxxx> writes: > At 18:26 -0600 08 Dec 2020, Felipe Contreras <felipe.contreras@xxxxxxxxx> wrote: >>By default it's ignored, you need the following in your ~/.vimrc >> >> set exrc > > Running `:help 'exrc'` in vim includes the text: > > Setting this option is a potential security leak. E.g., consider > unpacking a package or fetching files from github, a .vimrc in there > might be a trojan horse. BETTER NOT SET THIS OPTION! > Instead, define an autocommand in your .vimrc to set options for a > matching directory. > > So I don't think it's a good idea to encourage people to do that by > using a name that invites it. Also I think that the file would be more > discoverable for people to incorporate into their own configuration if > not named as a hidden file. Thanks. I do not use vim and did not know how commonly recommended the "set exrc" would be, but what you said makes total sense. In that case, I'd suggest shipping this file without the dot-prefix with a clear instruction how to make use of its contents in a secure manner in a comment at the top of the file. If having vimrc (no dot) at the top-level of the tree is untidy, we can add a place in contrib/ that houses configurations to help various editors and IDEs (e.g. contrib/editors/), too.
