From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.ciao.gmane.io!not-for-mail From: Richard Stallman Newsgroups: gmane.emacs.devel Subject: Re: PL support Date: Sun, 10 May 2020 22:35:11 -0400 Message-ID: References: <9mmFgzvrBwjt_n_VJyaJdXINraNi5HsGpwq-0MLeKiJA7kG2BQA4uywrzjyz7lpRS0OZDpjEi8lspOKYUA7P_QsODsDew_8nbH960G55fmY=@protonmail.com> <87d07xamrg.fsf@ericabrahamsen.net> <878silajdl.fsf@ericabrahamsen.net> <87tv18pyh4.fsf@russet.org.uk> <83zhaih0oz.fsf@gnu.org> <83pnbegsvm.fsf@gnu.org> <83imh5hby1.fsf@gnu.org> <2e4e8ce9-d857-f3e3-31cf-a40dee67bd25@yandex.ru> <83y2q1dsvh.fsf@gnu.org> <2468efa6-7dbd-8634-44cc-586bb6985f49@yandex.ru> <83pnbddrfd.fsf@gnu.org> <83k11ldpxs.fsf@gnu.org> <83imh5dnun.fsf@gnu.org> <2c09354e7994f0e61271ab0078256a9dc4202171.camel@k-7.ch> Reply-To: rms@gnu.org Content-Type: text/plain; charset=Utf-8 Injection-Info: ciao.gmane.io; posting-host="ciao.gmane.io:159.69.161.202"; logging-data="92274"; mail-complaints-to="usenet@ciao.gmane.io" Cc: seb@k-7.ch, emacs-devel@gnu.org To: Yuan Fu Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Mon May 11 04:35:57 2020 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jXyIP-000Nsp-EE for ged-emacs-devel@m.gmane-mx.org; Mon, 11 May 2020 04:35:57 +0200 Original-Received: from localhost ([::1]:46880 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jXyIO-0005fV-CS for ged-emacs-devel@m.gmane-mx.org; Sun, 10 May 2020 22:35:56 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:37030) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jXyHm-000535-Tg for emacs-devel@gnu.org; Sun, 10 May 2020 22:35:18 -0400 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]:54427) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jXyHm-0001hS-CC; Sun, 10 May 2020 22:35:18 -0400 Original-Received: from rms by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1jXyHf-0001Ix-RB; Sun, 10 May 2020 22:35:12 -0400 In-Reply-To: (message from Yuan Fu on Sat, 9 May 2020 16:25:20 -0400) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.io gmane.emacs.devel:249735 Archived-At: [[[ To any NSA and FBI agents reading my email: please consider ]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] Some contributors are eagerly planning a sort of automatic facility to "install external tools." I'm disappointed to have to say that this raises problems at various levels. I doubt there is an acceptable way to do it. At the practical level, different distros have different methods of installing packages. Installing a package usually requires being root. And that's just the first-order run-down of the issue. This is a can of worms. At the moral level, we have to make sure that Emacs is not being used to install external packages we have not vetted based on our moral and political criteria. We must not let "convenience" lead us into actions that implicitly work against what we stand for. We would be like a campaign for workers' rights that raises funds by selling on Amazon. It strikes me that this is also a system security issue. I would have to talk with the security advisors I trust about that question and see what they think. This issue may apply to programs other than Emacs. If it does, I think the GNU Project needs to draw up a general policy about the idea of one package's automatically installing another. The right way to draw this up is in discussions with the GNU Advisory Committee, then with GNU developers on gnu-prog-discuss. This process must not be rushed. Depending on the outcome of that, it might be wise to have a subsequent discussion about what policy free distros should have about packages that try to install other packages. Specifically, whether they should allow such packages. -- Dr Richard Stallman Chief GNUisance of the GNU Project (https://gnu.org) Founder, Free Software Foundation (https://fsf.org) Internet Hall-of-Famer (https://internethalloffame.org)