all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Ted Zlatanov <tzz@lifelogs.com>
To: emacs-devel@gnu.org
Subject: Re: security of the emacs package system, elpa, melpa and marmalade
Date: Mon, 30 Sep 2013 13:18:10 -0400	[thread overview]
Message-ID: <87vc1ixm7h.fsf@flea.lifelogs.com> (raw)
In-Reply-To: 52499473.50707@binary-island.eu

On Mon, 30 Sep 2013 17:10:43 +0200 Matthias Dahl <matthias.dahl@binary-island.eu> wrote: 

MD> Hello...
>> I would propose using the signature files above to provide that wall,
>> so auto-signing should not be done.  Instead a maintainer team should
>> review changes that need to go up on the GNU ELPA.

MD> Ted, that would be really nice to have but as it was brought up earlier
MD> in this thread, this is not gonna happen. And I can honestly understand
MD> why it can't happen. The amount of manpower required to really do this
MD> properly, is not something that could be easily shouldered by a team of
MD> trusted volunteers in a timely manner.

A much more complex version of this process works for Debian.  I think
the amount of changes is not bad for a daily review, especially if we
move to a branch+pull request+merge model for the GNU ELPA.  Github's
infrastructure and UI for this is quite good.  Oh, and of course the
same branch+pull request+merge model could apply to the Emacs core as
well; that IMO would be really nice.

I think it's much less likely that Emacs will be rewritten to provide a
sandbox for packages, and a community review process is more valuable in
the long term in any case.

Ted




  reply	other threads:[~2013-09-30 17:18 UTC|newest]

Thread overview: 44+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-09-23  7:30 security of the emacs package system, elpa, melpa and marmalade Matthias Dahl
2013-09-23 14:17 ` Stefan Monnier
2013-09-25  8:11   ` Matthias Dahl
2013-09-25 17:00     ` Stefan Monnier
2013-09-25 18:31       ` Matthias Dahl
2013-09-25 22:42         ` Bastien
2013-09-26  9:02           ` Matthias Dahl
2013-09-27 14:02             ` Bastien
2013-09-27 14:17               ` Matthias Dahl
2013-09-27 14:19                 ` Bastien
2013-09-27 18:29                   ` Matthias Dahl
2013-09-26  1:09         ` Stefan Monnier
2013-09-26  9:02           ` Matthias Dahl
2013-09-26  9:21             ` Óscar Fuentes
2013-09-26 14:41             ` Stefan Monnier
2013-09-27 14:17               ` Matthias Dahl
2013-09-27 15:47                 ` Stefan Monnier
2013-09-28 14:15                   ` Richard Stallman
2013-09-30 15:12                     ` Matthias Dahl
2013-09-30 21:11                       ` Richard Stallman
2013-09-30 15:31                   ` Matthias Dahl
2013-09-26  1:12         ` Stephen J. Turnbull
2013-09-26  9:02           ` Matthias Dahl
2013-09-27  7:10             ` Stephen J. Turnbull
2013-09-27 14:18               ` Matthias Dahl
2013-09-27 17:31                 ` Stephen J. Turnbull
2013-09-30 15:25                   ` Matthias Dahl
2013-10-01  2:19                     ` Stephen J. Turnbull
2013-09-27 20:12                 ` chad
2013-09-26  9:31           ` Andreas Röhler
2013-09-26 16:25           ` Richard Stallman
2013-09-27 14:18             ` Matthias Dahl
2013-09-27 15:04               ` Óscar Fuentes
2014-09-13 17:57                 ` Thomas Koch
2013-09-29 10:12             ` Ted Zlatanov
2013-09-29  9:53   ` Ted Zlatanov
2013-09-29 17:49     ` Daiki Ueno
2013-09-29 18:18       ` Ted Zlatanov
2013-09-30 13:25         ` Ted Zlatanov
2013-09-30 14:50           ` Stephen J. Turnbull
2013-09-30 15:10     ` Matthias Dahl
2013-09-30 17:18       ` Ted Zlatanov [this message]
2013-10-01 14:03         ` Matthias Dahl
2013-10-02  2:45           ` Stephen J. Turnbull

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87vc1ixm7h.fsf@flea.lifelogs.com \
    --to=tzz@lifelogs.com \
    --cc=emacs-devel@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.