From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: David Kastrup Newsgroups: gmane.emacs.devel Subject: Re: Image mode Date: Tue, 06 Feb 2007 11:29:34 +0100 Message-ID: <86d54nmve9.fsf@lola.quinscape.zz> References: <87k5yxeg19.fsf@jurta.org> <87d54ob8c5.fsf@stupidchicken.com> <87iregmafd.fsf@stupidchicken.com> <86irefojcc.fsf@lola.quinscape.zz> <86tzxzn0bx.fsf@lola.quinscape.zz> <86ps8nmy95.fsf@lola.quinscape.zz> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: sea.gmane.org 1170757811 5420 80.91.229.12 (6 Feb 2007 10:30:11 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Tue, 6 Feb 2007 10:30:11 +0000 (UTC) Cc: Chong Yidong , emacs-devel@gnu.org To: "Juanma Barranquero" Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Feb 06 11:30:12 2007 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1HENaV-0007Gu-1I for ged-emacs-devel@m.gmane.org; Tue, 06 Feb 2007 11:30:11 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1HENaR-0000jB-3h for ged-emacs-devel@m.gmane.org; Tue, 06 Feb 2007 05:30:07 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1HENaG-0000iw-To for emacs-devel@gnu.org; Tue, 06 Feb 2007 05:29:56 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1HENaE-0000ik-H7 for emacs-devel@gnu.org; Tue, 06 Feb 2007 05:29:55 -0500 Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1HENaE-0000ih-CC for emacs-devel@gnu.org; Tue, 06 Feb 2007 05:29:54 -0500 Original-Received: from pc3.berlin.powerweb.de ([62.67.228.11]) by monty-python.gnu.org with esmtp (Exim 4.52) id 1HENaD-0005MP-RN for emacs-devel@gnu.org; Tue, 06 Feb 2007 05:29:54 -0500 Original-Received: from quinscape.de (pd95b0fdb.dip0.t-ipconnect.de [217.91.15.219]) by pc3.berlin.powerweb.de (8.9.3p3/8.9.3) with ESMTP id LAA07176 for ; Tue, 6 Feb 2007 11:29:46 +0100 X-Delivered-To: Original-Received: (qmail 21888 invoked from network); 6 Feb 2007 10:29:47 -0000 Original-Received: from unknown (HELO lola.quinscape.zz) ([10.0.3.43]) (envelope-sender ) by ns.quinscape.de (qmail-ldap-1.03) with SMTP for ; 6 Feb 2007 10:29:47 -0000 Original-Received: by lola.quinscape.zz (Postfix, from userid 1001) id 230A0C2BB7; Tue, 6 Feb 2007 11:29:35 +0100 (CET) In-Reply-To: (Juanma Barranquero's message of "Tue\, 6 Feb 2007 10\:43\:39 +0100") User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.0.50 (gnu/linux) X-detected-kernel: Linux 2.4-2.6 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:66003 Archived-At: "Juanma Barranquero" writes: > On 2/6/07, David Kastrup wrote: > >> If there ever was a "policy" instead of just an implementation, > > It was a policy by implementation :) > >> If the user _knows_ that Xlib is a current attack vector, she has >> the option of using "emacs -nw". In a similar vein, if she knows >> about a jpeg library vulnerability, she might refrain from opening >> "xxx.jpg" in Emacs. > > For this discussion it doesn't make much sense IMO to talk about the > vulnerabilities the user knows about. Well, _we_ don't know about any vulnerabilities either at the moment, so it would seem that it does not make much sense to talk about anything in this discussion. Not that it does not feel like that... >> As long as file type and extension are compatible, I see no reason >> for user feedback before treating the file as an image. > > I'm not in favor of the warning, but I agree with Richard in that I > don't see any reason to treat files with valid image extensions (in > agreement or disagreement with its contents) different that images > with no recognizable extension. The way for a virus to enter a > system is profiting from the familiarity. Either you trust your > images' source, or you don't. Sorry, but that is nonsense. We have added a lot of stuff warning about file variables and unsafe variables and so on, exactly to free the user from having to worry about the trustworthiness of files before opening them. And are you telling me that all the junk mails that want me to click on something have a sender I know? The user has an idea about what Emacs will do with a file, and will judge based on that whether he wants it to open in Emacs in this manner. If Emacs does something different than the expected thing, there goes one component of security: user wariness. -- David Kastrup