From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.devel Subject: Re: Autoload from a web page? Date: Wed, 30 Dec 2009 10:30:40 -0600 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87tyv8jufj.fsf@lifelogs.com> References: NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1262190685 5941 80.91.229.12 (30 Dec 2009 16:31:25 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 30 Dec 2009 16:31:25 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Dec 30 17:31:18 2009 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1NQ1S9-0004z9-Bt for ged-emacs-devel@m.gmane.org; Wed, 30 Dec 2009 17:31:17 +0100 Original-Received: from localhost ([127.0.0.1]:42838 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NQ1S9-0007wk-Ns for ged-emacs-devel@m.gmane.org; Wed, 30 Dec 2009 11:31:17 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NQ1S3-0007wV-G0 for emacs-devel@gnu.org; Wed, 30 Dec 2009 11:31:11 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NQ1Rz-0007vA-0G for emacs-devel@gnu.org; Wed, 30 Dec 2009 11:31:11 -0500 Original-Received: from [199.232.76.173] (port=56448 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NQ1Ry-0007v7-RN for emacs-devel@gnu.org; Wed, 30 Dec 2009 11:31:06 -0500 Original-Received: from lo.gmane.org ([80.91.229.12]:53526) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1NQ1Ry-0005ZZ-D5 for emacs-devel@gnu.org; Wed, 30 Dec 2009 11:31:06 -0500 Original-Received: from list by lo.gmane.org with local (Exim 4.50) id 1NQ1Rv-0004rl-IZ for emacs-devel@gnu.org; Wed, 30 Dec 2009 17:31:03 +0100 Original-Received: from 38.98.147.130 ([38.98.147.130]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 30 Dec 2009 17:31:03 +0100 Original-Received: from tzz by 38.98.147.130 with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 30 Dec 2009 17:31:03 +0100 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 35 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: 38.98.147.130 X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" User-Agent: Gnus/5.110011 (No Gnus v0.11) Emacs/23.1.90 (gnu/linux) Cancel-Lock: sha1:1dEhhpjgMBuiM91HW65+j5OCJwI= X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 3) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:119055 Archived-At: On Tue, 29 Dec 2009 15:05:28 -0200 Stefan Monnier wrote: >> Would it be possible to setup a function to download an elisp file >> from a web page when called and then evaluate that file and call >> itself again (with the old parameters), now with the new definition >> from the web page? SM> (url-handler-mode 1) SM> (autoload 'foo-function "http://toto.bar/baz/foo.el") There are so many security risks with this, and better ways to manage packages have already been devised! Ubuntu, for instance, signs the packages and there's a whole key infrastructure set up in the distro. Downloading and evaluating a file is the easy part, technically. Listing Lisp files on a web page requires no security. Managing software, though, is hard. For instance: - your worst enemy is trying to break/infect/DDOS your distribution, what are your defenses? What if your webserver dies? What if your domain name expires or gets hijacked? - how do you issue an emergency patch and notify your users? - how do you back out of a change? How do you version releases? - how do you deal with circular dependencies? - how do you minimize bandwidth, disk, and CPU costs? - who will manage the repository when you can't? - who will support the users when they have the inevitable problems? Ted