From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.bugs Subject: bug#24489: efaq: security risks Date: Fri, 23 Sep 2016 22:45:59 -0400 Organization: =?UTF-8?Q?=D0=A2=D0=B5=D0=BE=D0=B4=D0=BE=D1=80_?= =?UTF-8?Q?=D0=97=D0=BB=D0=B0=D1=82=D0=B0=D0=BD=D0=BE=D0=B2?= @ Cienfuegos Message-ID: <87intmypzs.fsf@lifelogs.com> References: <7ca8f2ur15.fsf@fencepost.gnu.org> <7ca8f2ur15.fsf@fencepost.gnu.org> <87y42kciee.fsf_-_@lifelogs.com> NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: blaine.gmane.org 1474685243 17457 195.159.176.226 (24 Sep 2016 02:47:23 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Sat, 24 Sep 2016 02:47:23 +0000 (UTC) User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1.50 (gnu/linux) Cc: larsi@gnus.org, 24489@debbugs.gnu.org To: Richard Stallman Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sat Sep 24 04:47:19 2016 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bnczh-0003Mr-JQ for geb-bug-gnu-emacs@m.gmane.org; Sat, 24 Sep 2016 04:47:13 +0200 Original-Received: from localhost ([::1]:54945 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bnczf-0001Zi-TC for geb-bug-gnu-emacs@m.gmane.org; Fri, 23 Sep 2016 22:47:11 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:44521) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bnczZ-0001ZH-Bw for bug-gnu-emacs@gnu.org; Fri, 23 Sep 2016 22:47:06 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bnczW-00063j-7t for bug-gnu-emacs@gnu.org; Fri, 23 Sep 2016 22:47:05 -0400 Original-Received: from debbugs.gnu.org ([208.118.235.43]:55828) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bnczV-00063S-TW for bug-gnu-emacs@gnu.org; Fri, 23 Sep 2016 22:47:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1bnczV-0003ZO-KH for bug-gnu-emacs@gnu.org; Fri, 23 Sep 2016 22:47:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Ted Zlatanov Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 24 Sep 2016 02:47:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 24489 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security Original-Received: via spool by 24489-submit@debbugs.gnu.org id=B24489.147468517413671 (code B ref 24489); Sat, 24 Sep 2016 02:47:01 +0000 Original-Received: (at 24489) by debbugs.gnu.org; 24 Sep 2016 02:46:14 +0000 Original-Received: from localhost ([127.0.0.1]:33785 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bncyj-0003YR-T5 for submit@debbugs.gnu.org; Fri, 23 Sep 2016 22:46:14 -0400 Original-Received: from mail-pa0-f46.google.com ([209.85.220.46]:35173) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bncyh-0003Y9-Me for 24489@debbugs.gnu.org; Fri, 23 Sep 2016 22:46:12 -0400 Original-Received: by mail-pa0-f46.google.com with SMTP id oz2so45369244pac.2 for <24489@debbugs.gnu.org>; Fri, 23 Sep 2016 19:46:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lifelogs.com; s=google; h=from:to:cc:subject:organization:references:mail-copies-to :gmane-reply-to-list:date:in-reply-to:message-id:user-agent :mime-version; bh=ShKOLUqJ6J6+yI2x8pUqecrk37U4rlQ0exv/mavKoqo=; b=PSt6bBJ1v9rTBK1hU0rImFqR5Z0ap02qu9lS+Fq/Nm1DXvmCIdDV6F0UR3IYQG2dJJ x44YAsdtN2UDc399Sn4t/S+/dJg4hmn16aOrxiaiJPnRmxpWxQTqI8mfjY5jqpFYLnN1 8wjfxNvV1ABYTyAyK7O2uNkvElWt0za2DTUZA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:organization:references :mail-copies-to:gmane-reply-to-list:date:in-reply-to:message-id :user-agent:mime-version; bh=ShKOLUqJ6J6+yI2x8pUqecrk37U4rlQ0exv/mavKoqo=; b=h2+ID7mDJ7n5bsMMnkIhEKvvrposebaQ5NZYdgsjQKssI+CM+oocvcz+JFGBpMS59l X/RHxFLtqDf3r3eiBHE3AcZz5ACFnCdZyeF+rydfvCYr8NRTEFI5jjUtGa29Gu8Uz4QM NhCLluysJcq6VBdRipDyJdwXhyJmJ/TXh8Zu9vmHDU4Zl6Wtyr4w1wkOjI5nnyyrDwgy Nz6MM3PuMq0YKPKx/Jg3ASnJwK1etBy1/Hxsr9DI9+o/B5rjh1Y4WPSawEpzbnDUcjOl czo7MVMXrojBqxcf60obSlhX4HkrkZ+GiOaBX/w/FZmI46sXGP9AI75/BvUUtpok7ho1 6rww== X-Gm-Message-State: AE9vXwOjKmiUsZHKa5JKdNU1bMJQI2WQDJMG+EUcvZ37QS1diMQvF95PwNN3fMMPfu2sAw== X-Received: by 10.66.197.228 with SMTP id ix4mr17465708pac.47.1474685165854; Fri, 23 Sep 2016 19:46:05 -0700 (PDT) Original-Received: from flea (c-98-229-60-157.hsd1.ma.comcast.net. [98.229.60.157]) by smtp.gmail.com with ESMTPSA id p73sm13731870pfk.60.2016.09.23.19.46.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 23 Sep 2016 19:46:04 -0700 (PDT) X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never Gmane-Reply-To-List: yes In-Reply-To: (Richard Stallman's message of "Fri, 23 Sep 2016 16:38:56 -0400") X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:123619 Archived-At: On Fri, 23 Sep 2016 16:38:56 -0400 Richard Stallman wrote: RS> [[[ To any NSA and FBI agents reading my email: please consider ]]] RS> [[[ whether defending the US Constitution against all enemies, ]]] RS> [[[ foreign or domestic, requires you to follow Snowden's example. ]]] >> Images and other resources can carry constructed data and be used as an >> execution backdoor through browser or library bugs. The following don't >> necessarily apply to Emacs, they are just examples of the variety and >> severity of these attacks, which have risen in popularity as direct code >> injection has become harder: RS> It is no use telling people, "Be afraid of browsing." The original suggestion by Glenn was to say that remote HTML content is a potential security risk. That's a statement of fact and I gave supporting evidence. Those risks apply to Emacs users, but I don't think anyone proposed "be afraid" to be the message we should give. RS> If we can't give any advice more specific than that, it would RS> be a useless annoyance. Certainly. The FAQ can link to external resources, for instance. I think in the FAQ we should at least list the libraries that Emacs uses to render remote content (SVG, XML, PNG, etc.) so the user is aware of those dependencies and will keep them up to date. But the method for that depends on the platform, so... do we explain in the FAQ? Does Emacs itself warn when libraries are out of date? I don't know. Ted