But not providing hashes and using a two stage downloader and not using ssl and using auto updates and not using code signing means that your app will now be the weakest link in terms of security for all but the worst configured computers.
While it's almost certain no one is targeting you or your users now, that could change when people see such a weakness or could leave people open to local attackers that you'll never have a chance to notice.
It's early and we honestly didn't think down those lines. Ultimately, the deployment mechanism will look different than this, but this was the path of least resistance. At the very least though we can do a few of these things to remove some of the danger - we'll get on it.
Yeah, I am not that exercised about the security risk but it made a really bad first impression. I primarily use Windows, I wouldn't mind so much if I were Unix-based. Also, installing it in my Documents folder under Windows is weird.
On the plus side, I like the prototype itself and will be interested to see where it goes.
To reply to the post you deleted about downvotes...
I didn't downvote you, because I appreciate you bringing up a relevant technical concern.
But sometimes people bring food over to my house and I just eat it. At the alpha stage of development, I think it's reasonable that your option is to not download.
If anyone is going to update their software manually, surely it's going to be HN/code editor users (I know I do). And anyway, it's a preview release that people won't be using as their main editor anyway. Install, play around, uninstall.
The script that you download and execute goes back out to the internet to download the real executable, so it makes it (somewhat) difficult to review beforehand or to make sure you're running the official version
But not providing hashes and using a two stage downloader and not using ssl and using auto updates and not using code signing means that your app will now be the weakest link in terms of security for all but the worst configured computers.
While it's almost certain no one is targeting you or your users now, that could change when people see such a weakness or could leave people open to local attackers that you'll never have a chance to notice.