> For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys.
First, if you don't trust a bit of software, why are you installing it?
But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files?
If my text editor wasn't able to open and edit those files, I'd consider it extremely broken!
Even if you trust the developer (I don't), there is a chance that there is a bug or vulnerability in the software. Also you need to install different plugins from random anonymous guys from Github, and it is difficult to trust an anonymous person.
Is VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me.
Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about.
I've not used it, because I'm happy with (neo)vim for my dev needs, but I thought that's what it did?
If VS Code isn't used to edit text, what is it for?
Edit: (neo)vim and emacs both have 3rd party extension ecosystems, with extensions written in languages that can access the internet, so I'm not sure how that affects your test?
First, if you don't trust a bit of software, why are you installing it?
But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files?
If my text editor wasn't able to open and edit those files, I'd consider it extremely broken!