From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#45198: 28.0.50; Sandbox mode Date: Sun, 18 Apr 2021 09:24:35 +0300 Message-ID: <83blacun30.fsf@gnu.org> References: <5818DFAA-3A9C-4335-BAAF-1227A02C290A@acm.org> <83o8ecvnok.fsf@gnu.org> <83lf9gvktv.fsf@gnu.org> <83im4kvi4e.fsf@gnu.org> Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="20247"; mail-complaints-to="usenet@ciao.gmane.io" Cc: alan@idiocy.org, mattiase@acm.org, 45198@debbugs.gnu.org, stefan@marxist.se, p.stephani2@gmail.com, joaotavora@gmail.com To: Stefan Monnier Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sun Apr 18 08:26:30 2021 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lY0t3-0005A2-Ks for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 18 Apr 2021 08:26:29 +0200 Original-Received: from localhost ([::1]:58564 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lY0t2-0004QL-O9 for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 18 Apr 2021 02:26:28 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:47142) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lY0sc-0004Pz-EK for bug-gnu-emacs@gnu.org; Sun, 18 Apr 2021 02:26:02 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:33584) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lY0sc-0000Ce-77 for bug-gnu-emacs@gnu.org; Sun, 18 Apr 2021 02:26:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1lY0sc-0004GM-44 for bug-gnu-emacs@gnu.org; Sun, 18 Apr 2021 02:26:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 18 Apr 2021 06:26:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 45198 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 45198-submit@debbugs.gnu.org id=B45198.161872711316319 (code B ref 45198); Sun, 18 Apr 2021 06:26:02 +0000 Original-Received: (at 45198) by debbugs.gnu.org; 18 Apr 2021 06:25:13 +0000 Original-Received: from localhost ([127.0.0.1]:45130 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lY0rk-0004F2-M2 for submit@debbugs.gnu.org; Sun, 18 Apr 2021 02:25:12 -0400 Original-Received: from eggs.gnu.org ([209.51.188.92]:34446) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lY0rf-0004E1-Dx for 45198@debbugs.gnu.org; Sun, 18 Apr 2021 02:25:06 -0400 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]:47223) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lY0rX-00084g-Tu; Sun, 18 Apr 2021 02:24:56 -0400 Original-Received: from 84.94.185.95.cable.012.net.il ([84.94.185.95]:3319 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1lY0rX-0003vz-B5; Sun, 18 Apr 2021 02:24:55 -0400 In-Reply-To: (message from Stefan Monnier on Sat, 17 Apr 2021 16:26:25 -0400) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:204299 Archived-At: > From: Stefan Monnier > Cc: mattiase@acm.org, joaotavora@gmail.com, p.stephani2@gmail.com, > stefan@marxist.se, 45198@debbugs.gnu.org, alan@idiocy.org > Date: Sat, 17 Apr 2021 16:26:25 -0400 > > > If you are implying that one does something conscious and deliberate > > before byte-compiling a file, > > Have you ever byte-compiled a random ELisp file sent to you from some > unknown email address without looking at it first? No, but I also don't use Flymake and never install packages via package.el. IOW, my own workflows are not very relevant to the issues at hand, and neither are yours. What matters is what others do. > The whole point of the sandboxing exercise is so as to be able to have > flymake-mode in the hook without exposing yourself to > these vulnerabilities. So we are going to introduce all this non-trivial machinery into Emacs just to solve the Flymake use case? Is that reasonable from the project management POV, in your eyes?