From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Stefan Monnier Newsgroups: gmane.emacs.devel Subject: Re: security of the emacs package system, elpa, melpa and marmalade Date: Thu, 26 Sep 2013 10:41:17 -0400 Message-ID: References: <523FEE1B.9020408@binary-island.eu> <52429ABD.6090603@binary-island.eu> <52432BE9.1070402@binary-island.eu> <5243F836.9020301@binary-island.eu> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1380206502 14747 80.91.229.3 (26 Sep 2013 14:41:42 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 26 Sep 2013 14:41:42 +0000 (UTC) Cc: emacs-devel@gnu.org To: Matthias Dahl Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Thu Sep 26 16:41:44 2013 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1VPClC-0003OY-PV for ged-emacs-devel@m.gmane.org; Thu, 26 Sep 2013 16:41:42 +0200 Original-Received: from localhost ([::1]:58302 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VPClC-0001pw-AU for ged-emacs-devel@m.gmane.org; Thu, 26 Sep 2013 10:41:42 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:57346) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VPCl1-0001gx-7T for emacs-devel@gnu.org; Thu, 26 Sep 2013 10:41:38 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VPCkr-0007zD-8c for emacs-devel@gnu.org; Thu, 26 Sep 2013 10:41:31 -0400 Original-Received: from chene.dit.umontreal.ca ([132.204.246.20]:38138) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VPCkr-0007z3-3U for emacs-devel@gnu.org; Thu, 26 Sep 2013 10:41:21 -0400 Original-Received: from faina.iro.umontreal.ca (lechon.iro.umontreal.ca [132.204.27.242]) by chene.dit.umontreal.ca (8.14.1/8.14.1) with ESMTP id r8QEfHoM023429; Thu, 26 Sep 2013 10:41:17 -0400 Original-Received: by faina.iro.umontreal.ca (Postfix, from userid 20848) id B1F1BB415F; Thu, 26 Sep 2013 10:41:17 -0400 (EDT) In-Reply-To: <5243F836.9020301@binary-island.eu> (Matthias Dahl's message of "Thu, 26 Sep 2013 11:02:46 +0200") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3.50 (gnu/linux) X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0 X-NAI-Spam-Rules: 1 Rules triggered RV4713=0 X-NAI-Spam-Version: 2.3.0.9362 : core <4713> : inlines <106> : streams <1045220> : uri <1548152> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 132.204.246.20 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:163660 Archived-At: >> So I think the only way to attack the problem is to perform experiments >> to get a feel for what might work and what problems show up. > Ah, justice. I knew this would come back to me and bite me. ;) I know > that since I am the one who started this discussion, it is expected of > me (or considered good manors) that I volunteer to do so. And I'd in all > honesty gladly jump on in... but my familiarity with the code base is > very far from sufficient for this. This is something for someone with a > very strong grasp of Elisp and Emacs, imho. :( I suggest you lead the charge while asking for help at the same time. Concretely, you could do something along the following lines: - decide some set of rules that a package should follow. Make those *very* simple (i.e. simplistic) for now. E.g. "can only access current-buffer". - try to figure out a way to implement it (without regards for efficiency, for a start). - see how it works with existing packages. - try to write something nasty to see if your rules are actually useful. - iterate the process. > each and every plugin he installs. One can assume that the Emacs code > base does not contain any malicious code and is thus "secure" at least > in this regard. Naturally there are holes - known and unknown. The key, The set of people with commit access to Emacs is the same as the set of people with commit access to GNU ELPA (includes more than a hundred people, some of whom are not expert programmers). And both repositories send diff-emails for every commit installed in it. So the main difference is that many more people clone/checkout the Emacs repository than the GNU ELPA repository. Stefan