Re: master c86995d07e9: Enable code block evaluation when generating .org manuals

[Po Lu <luangruo@yahoo.com>]

<tomas@tuxteam.de> writes:

> This is, strictly speaking, right, of course. Expectation-wise it does
> lower the bar for an attacker somewhat, since now the malicious code
> just has to be snuck into documentation.

This can only be true if documentation changes are scrutinized so little
that code, and by extension malicious code simply passes unnoticed.
Otherwise, it would be best to credit the Org Mode developers with the
same due dilligence as ours, or the resulting attitude will appear
condescending at best.

> So I think Robert is right that it's worth a discussion (whatever the
> outcome might be: perhaps treat the doc as code and give it as much
> scrutiny?
>
> Anyway, the libxz episode shows that it seems to be easier to sneak
> malicious code "elsewhere" (in that case it was the test suite, but
> you get te idea).

You mean to imply that Org Mode is more susceptible to organized
sabotage than other players whose code we import, such as Gnulib, or,
heaven forbid, we ourselves?  That way lies madness.