From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: "Stephen J. Turnbull" Newsgroups: gmane.emacs.devel Subject: Re: Autoload from a web page? Date: Tue, 29 Dec 2009 10:32:38 +0900 Message-ID: <873a2upnt5.fsf@uwakimon.sk.tsukuba.ac.jp> References: NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1262049744 14731 80.91.229.12 (29 Dec 2009 01:22:24 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 29 Dec 2009 01:22:24 +0000 (UTC) Cc: rms@gnu.org, emacs-devel@gnu.org To: Lennart Borgman Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Dec 29 02:22:17 2009 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1NPQmt-0000lA-Sb for ged-emacs-devel@m.gmane.org; Tue, 29 Dec 2009 02:22:16 +0100 Original-Received: from localhost ([127.0.0.1]:42124 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NPQmu-0004f3-6t for ged-emacs-devel@m.gmane.org; Mon, 28 Dec 2009 20:22:16 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NPQmq-0004eS-0i for emacs-devel@gnu.org; Mon, 28 Dec 2009 20:22:12 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NPQmk-0004dt-G1 for emacs-devel@gnu.org; Mon, 28 Dec 2009 20:22:10 -0500 Original-Received: from [199.232.76.173] (port=36572 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NPQmk-0004dh-9z for emacs-devel@gnu.org; Mon, 28 Dec 2009 20:22:06 -0500 Original-Received: from mtps01.sk.tsukuba.ac.jp ([130.158.97.223]:39957) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NPQmi-000628-4w; Mon, 28 Dec 2009 20:22:04 -0500 Original-Received: from uwakimon.sk.tsukuba.ac.jp (uwakimon.sk.tsukuba.ac.jp [130.158.99.156]) by mtps01.sk.tsukuba.ac.jp (Postfix) with ESMTP id 3654E1535AF; Tue, 29 Dec 2009 10:22:02 +0900 (JST) Original-Received: by uwakimon.sk.tsukuba.ac.jp (Postfix, from userid 1000) id 7ABAF1A33D7; Tue, 29 Dec 2009 10:32:38 +0900 (JST) In-Reply-To: X-Mailer: VM 8.0.12-devo-585 under 21.5 (beta29) "garbanzo" 1444e28f1a3d XEmacs Lucid (x86_64-unknown-linux) X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6, seldom 2.4 (older, 4) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:118897 Archived-At: Lennart Borgman writes: > In a situation like that it is possible to set up for autoloading > things by downloading them from the web without compromising security > (or at least not more than when you download a file yourself) since > you know which files will be downloaded. Why would the user know which files would be downloaded, and from where? The whole point is to do it automatically, without troubling the user. If the user is going to go to the trouble of *carefully* verifying sources and so on, little is saved. On the other hand, it would be easy enough to register a domain like "savannah.gnu.org.to", and a lot of folks might miss that, if they even looked at all. Think of this like rules against talking on your cellphone while driving. Cellphone use is not an absolute guarantee you'll kill somebody, and abstinence from cellphone use is no guarantee you won't. Some people do use cellphones responsibly while driving, and so on. But for the typical driver it does vastly increase the risks. And so does any automated downloading and execution scheme.