I dunno. I can see why this functionality might be useful, but I kinda think distros should disable it by default/make it whitelist-only.

I think the implications are really unexpected for “new” users (where “new” could be pretty generously defined, I mean, I know a couple people who use vim IRL, I think they would not expect this… it is the sort of thing you know about if you are somebody who goes online to talk about text editors I think). And these are also the sort of users who are used to seeing shebangs and other line noise at the top of files, not understanding it, and ignoring it.

I think we’re only being protected by the fact that spreading a virus though command-line text editors is… going to result in not a ton of hits.

I'm confused. Per the doc, it is disabled by default? Specifically, the first time it is encountered on a file, it will ask the user if they want to allow it. And they flat out don't ever do things like "eval" during these values.