From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Lennart Borgman Newsgroups: gmane.emacs.devel Subject: Re: Autoload from a web page? Date: Tue, 29 Dec 2009 02:39:04 +0100 Message-ID: References: <873a2upnt5.fsf@uwakimon.sk.tsukuba.ac.jp> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Trace: ger.gmane.org 1262050809 16742 80.91.229.12 (29 Dec 2009 01:40:09 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 29 Dec 2009 01:40:09 +0000 (UTC) Cc: rms@gnu.org, emacs-devel@gnu.org To: "Stephen J. Turnbull" Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Dec 29 02:40:01 2009 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1NPR3w-00059I-7t for ged-emacs-devel@m.gmane.org; Tue, 29 Dec 2009 02:39:52 +0100 Original-Received: from localhost ([127.0.0.1]:45984 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NPR3w-0002M6-IF for ged-emacs-devel@m.gmane.org; Mon, 28 Dec 2009 20:39:52 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NPR3b-0002Dv-Q1 for emacs-devel@gnu.org; Mon, 28 Dec 2009 20:39:31 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NPR3W-0002AE-Q8 for emacs-devel@gnu.org; Mon, 28 Dec 2009 20:39:30 -0500 Original-Received: from [199.232.76.173] (port=34030 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NPR3W-0002A8-JM for emacs-devel@gnu.org; Mon, 28 Dec 2009 20:39:26 -0500 Original-Received: from mail-gx0-f215.google.com ([209.85.217.215]:37166) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NPR3V-0000A2-5Y; Mon, 28 Dec 2009 20:39:25 -0500 Original-Received: by gxk7 with SMTP id 7so175240gxk.12 for ; Mon, 28 Dec 2009 17:39:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=dTXiLoE9QInSHdxb2eeeCxxd/PNYVnm2egKShiY5aZE=; b=mU3KoWM8ViRraX5aTS8WjPHVLMg37dHMXCMVizrchYu74327JQGQX6ch+2aQMduBHC td38zkfQzXboz8hqY5p4eiYzuGzswrbfTfG3ieKBzAgb9C4GV0ZFXSKIjgdpvAmSn2M6 eyaY8PMpGQLwkMlrbK5cJoS8czpTRfmVZVL+g= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=Zja3ZvfymoCXGwj5vqFFjkorLbliSxzZiaYV7anfpKo1gtkuHBuOuDN4sJBYQY7dkO ab7oYwz7GMo4hFbLYtwdXAbLtyg97ljkaJ8ir+COgVy9M73+74O966agsO89JYkBE/c6 n7P2zQGpns3hXhcmpp9Au88zpJ0d85wOhIrlE= Original-Received: by 10.101.11.2 with SMTP id o2mr24758189ani.52.1262050764112; Mon, 28 Dec 2009 17:39:24 -0800 (PST) In-Reply-To: <873a2upnt5.fsf@uwakimon.sk.tsukuba.ac.jp> X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 2) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:118900 Archived-At: On Tue, Dec 29, 2009 at 2:32 AM, Stephen J. Turnbull w= rote: > Lennart Borgman writes: > > =C2=A0> In a situation like that it is possible to set up for autoloading > =C2=A0> things by downloading them from the web without compromising secu= rity > =C2=A0> (or at least not more than when you download a file yourself) sin= ce > =C2=A0> you know which files will be downloaded. > > Why would the user know which files would be downloaded, and from > where? =C2=A0The whole point is to do it automatically, without troubling > the user. =C2=A0If the user is going to go to the trouble of *carefully* > verifying sources and so on, little is saved. =C2=A0On the other hand, it > would be easy enough to register a domain like "savannah.gnu.org.to", > and a lot of folks might miss that, if they even looked at all. > > Think of this like rules against talking on your cellphone while > driving. =C2=A0Cellphone use is not an absolute guarantee you'll kill > somebody, and abstinence from cellphone use is no guarantee you > won't. =C2=A0Some people do use cellphones responsibly while driving, and > so on. =C2=A0But for the typical driver it does vastly increase the risks= . > > And so does any automated downloading and execution scheme. While the comparision is funny it is not quite fair ;-) To answer your questions: * The user should not have to know much, only the starting location for the download. * It is thereafter the already downloaded files that have information about what to download. * This will hopefully ensure that only trusted files are downloaded. * The information about what to download is basically in autoload and requi= re * ... because during collection of autoloads the relative file paths are also recorded. * ... and this information have been downloaded first. * The downloaded files will be in a mirrored tree structure to where they came from. * The price carries of course a defadviced require that does this magic. * It would be possible to download many of the Emacs core files this way, actually * ... but of course it is more meant for external packages. Unfortunately the whole thing fails at the moment because of bugs in url-copy-file... - some timeout or something. I have never cared to report this bugs before because they are very complicated... ;-)