From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Stefan Monnier Newsgroups: gmane.emacs.devel Subject: Re: DSO-style FFI Date: Sat, 19 Oct 2013 11:08:28 -0400 Message-ID: References: <877gdqrc9u.fsf@flea.lifelogs.com> <87mwmmp05f.fsf@flea.lifelogs.com> <87fvsdpato.fsf@flea.lifelogs.com> <8738oc20xk.fsf@flea.lifelogs.com> <87d2ngzlyl.fsf_-_@flea.lifelogs.com> <87siwcxda7.fsf@flea.lifelogs.com> <87zjqjfz36.fsf@fleche.redhat.com> <87wqlitse5.fsf@maru2.md5i.com> <87eh7iogcv.fsf@flea.lifelogs.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1382195323 15356 80.91.229.3 (19 Oct 2013 15:08:43 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 19 Oct 2013 15:08:43 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sat Oct 19 17:08:46 2013 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1VXY90-000622-C1 for ged-emacs-devel@m.gmane.org; Sat, 19 Oct 2013 17:08:46 +0200 Original-Received: from localhost ([::1]:33537 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VXY8z-0000FW-TA for ged-emacs-devel@m.gmane.org; Sat, 19 Oct 2013 11:08:45 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:34502) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VXY8q-0000EB-UP for emacs-devel@gnu.org; Sat, 19 Oct 2013 11:08:44 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VXY8j-00074e-Kq for emacs-devel@gnu.org; Sat, 19 Oct 2013 11:08:36 -0400 Original-Received: from ironport2-out.teksavvy.com ([206.248.154.182]:39513) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VXY8j-00074U-Ge for emacs-devel@gnu.org; Sat, 19 Oct 2013 11:08:29 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av4EABK/CFFLd/LJ/2dsb2JhbABEvw4Xc4IfAQVWAzALNBIUGA2ISMEtjWGDKQOkeoFegxM X-IPAS-Result: Av4EABK/CFFLd/LJ/2dsb2JhbABEvw4Xc4IfAQVWAzALNBIUGA2ISMEtjWGDKQOkeoFegxM X-IronPort-AV: E=Sophos;i="4.84,565,1355115600"; d="scan'208";a="35877571" Original-Received: from 75-119-242-201.dsl.teksavvy.com (HELO pastel.home) ([75.119.242.201]) by ironport2-out.teksavvy.com with ESMTP/TLS/ADH-AES256-SHA; 19 Oct 2013 11:08:28 -0400 Original-Received: by pastel.home (Postfix, from userid 20848) id 87A88616AC; Sat, 19 Oct 2013 11:08:28 -0400 (EDT) In-Reply-To: <87eh7iogcv.fsf@flea.lifelogs.com> (Ted Zlatanov's message of "Fri, 18 Oct 2013 09:31:28 -0400") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3.50 (gnu/linux) X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 206.248.154.182 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:164365 Archived-At: SM> This is a fundamental property of anything that lets gives access to SM> "any" library. DSO or FFI is in the same boat. IOW, if we really SM> consider it as too dangerous, then we can't provide anything related to SM> an FFI or dynamic loading of code. > This is where package signing becomes important. More or less. I mean, yes, it's annoying when Emacs crashes, but in terms of security, being able to run arbitrary C code is not really worse than being able to run arbitrary Elisp code, and in terms of reliability, Elisp code can also render your Emacs unusable (without crashing it). SM> Presumably we can prevent it by checking (before loading the library) SM> that the library is compatible with the GPL (following the scheme SM> designed originally for gcc). > This can be declared by the author in the packaging. Do we need to spend > time on an elaborate scheme that can be trivially subverted? Or are > there other concerns I'm not getting? As someone else explained, the issue is not whether subverting it is hard, but rather whether subverting it must be done in a blatant-enough way that it makes a difference, from a legal point of view (e.g. it turns into fraud, rather than mere copyright violation). Stefan