From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Andy Moreton Newsgroups: gmane.emacs.devel Subject: Re: DSO-style FFI Date: Sat, 19 Oct 2013 18:33:27 +0100 Message-ID: <82y55p17yw.fsf@gmail.com> References: <877gdqrc9u.fsf@flea.lifelogs.com> <87mwmmp05f.fsf@flea.lifelogs.com> <87fvsdpato.fsf@flea.lifelogs.com> <8738oc20xk.fsf@flea.lifelogs.com> <87d2ngzlyl.fsf_-_@flea.lifelogs.com> <87siwcxda7.fsf@flea.lifelogs.com> <87zjqjfz36.fsf@fleche.redhat.com> <87wqlitse5.fsf@maru2.md5i.com> <87eh7iogcv.fsf@flea.lifelogs.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1382204041 11303 80.91.229.3 (19 Oct 2013 17:34:01 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 19 Oct 2013 17:34:01 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sat Oct 19 19:34:06 2013 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1VXaPa-00052f-QA for ged-emacs-devel@m.gmane.org; Sat, 19 Oct 2013 19:34:02 +0200 Original-Received: from localhost ([::1]:33968 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VXaPa-0008RW-EL for ged-emacs-devel@m.gmane.org; Sat, 19 Oct 2013 13:34:02 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:53452) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VXaPR-0008RH-AH for emacs-devel@gnu.org; Sat, 19 Oct 2013 13:33:59 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VXaPL-0005zU-FW for emacs-devel@gnu.org; Sat, 19 Oct 2013 13:33:53 -0400 Original-Received: from plane.gmane.org ([80.91.229.3]:45218) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VXaPL-0005ya-8T for emacs-devel@gnu.org; Sat, 19 Oct 2013 13:33:47 -0400 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1VXaPK-0004sY-97 for emacs-devel@gnu.org; Sat, 19 Oct 2013 19:33:46 +0200 Original-Received: from 82-69-64-228.dsl.in-addr.zen.co.uk ([82.69.64.228]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 19 Oct 2013 19:33:46 +0200 Original-Received: from andrewjmoreton by 82-69-64-228.dsl.in-addr.zen.co.uk with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 19 Oct 2013 19:33:46 +0200 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 25 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: 82-69-64-228.dsl.in-addr.zen.co.uk User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3.50 (windows-nt) Cancel-Lock: sha1:RHbQwojHqPS+gO9XVLJEZnD6vhY= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.229.3 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:164369 Archived-At: On Fri 18 Oct 2013, Ted Zlatanov wrote: > On Sat, 12 Oct 2013 14:55:26 -0400 Stefan Monnier wrote: > >>> The problems I see are A) that it would be trivial to use such an >>> interface to crash or subvert emacs from elisp, > > SM> This is a fundamental property of anything that lets gives access to > SM> "any" library. DSO or FFI is in the same boat. IOW, if we really > SM> consider it as too dangerous, then we can't provide anything related to > SM> an FFI or dynamic loading of code. > > This is where package signing becomes important. We can require two > signatures from two separate reviewers for high-risk packages. Package signing is not really relevant here: knowing who signed a package does not magically prevent emacs from crashing. If you want to prevent crashes, then you need to isolate the third party code by running it in a separate process. AndyM