Re: Autoload from a web page?

[joakim@verona.se]

Lennart Borgman <lennart.borgman@gmail.com> writes:

> On Mon, Dec 28, 2009 at 7:48 PM, Richard Stallman <rms@gnu.org> wrote:
>>    But the risk is about doing this in an uncontrolled way. A lot of sw
>>    is updated in a similar way today (in a way that tries to control the
>>    risks).
>>
>> Just because it is common does not make it acceptable.
>>
>> We do not want software to be autoloaded from anywhere outside
>> the user's machine.  The user should always have control over
>> installing it in the machine.
>>
>> (See http://www.gnu.org/philosophy/javascript-trap.html> for a similar issue.)
>
>
> That is a totally different context than the one I am  targetting.
>
>
> My scenario is this:
>
> - You have group of related elisp files in a common place on the web.
> - You download one of them, but it turns out that it does `require' or
> autoload that supposes you have downloaded the other files too.

Is this situation not handled well enough by Tom Tromeys package.el and
ELPA? Especially if we move ahead with the plan to have ELPA:s backend
be something like Savannah.


>
> In a situation like that it is possible to set up for autoloading
> things by downloading them from the web without compromising security
> (or at least not more than when you download a file yourself) since
> you know which files will be downloaded.
>
>
> Note: Of course this first assumes that you download one or two files
> with the necessary information.
>
>
-- 
Joakim Verona