From: Glenn Morris <rgm@gnu.org>
To: 24489@debbugs.gnu.org
Subject: bug#24489: efaq: security risks
Date: Tue, 20 Sep 2016 18:48:06 -0400 [thread overview]
Message-ID: <7ca8f2ur15.fsf@fencepost.gnu.org> (raw)
Package: emacs
Severity: minor
Tags: security
Version: 25.1
The (very crufty) Emacs FAQ contains a section:
"Are there any security risks in Emacs?"
The stuff about movemail and synthetic X events is archaic.
There is no mention of the more current problems:
1) installing a package runs arbitrary code
Better make sure you trust whoever gave you that package (gpg signing)
and how you got it (https), etc.
2) using an Emacs mail client to view HTML mail is a security risk if remote
content is fetched (I think it isn't by default, but this might not
apply to every client)
3) viewing remote HTML content (eg with eww or xwidgets) is likewise a
potential security risk.
next reply other threads:[~2016-09-20 22:48 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-20 22:48 Glenn Morris [this message]
2016-09-20 22:53 ` bug#24489: efaq: security risks Lars Ingebrigtsen
2016-09-21 21:26 ` Richard Stallman
2016-09-22 10:56 ` Ted Zlatanov
2016-09-23 20:38 ` Richard Stallman
2016-09-24 2:45 ` Ted Zlatanov
2016-09-25 17:15 ` Richard Stallman
2020-08-12 1:38 ` Stefan Kangas
2022-01-29 16:51 ` Lars Ingebrigtsen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7ca8f2ur15.fsf@fencepost.gnu.org \
--to=rgm@gnu.org \
--cc=24489@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.