4 ms·

Debian (and probably others) ship emacs with xwidget-webkit support specifically disabled for "security" reasons. https://bugs.debian.org/cgi-bin/bugreport.cgi

Debian (and probably others) ship emacs with xwidget-webkit support specifically disabled for "security" reasons. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914568 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914568 The argument there sounds like "libwebkit2gtk was never built to be resilient against non-trusted content" and "has no sandboxing". I don't have enough expertise to accurately judge both claims, but the last message in that above bug tread does not like a change is being considered.

kscarlet 6y ago
Author of the fork here. Yes I'm awared of this issue, and I've submitted a patch to emacs-devel that enables sandboxing, hopeful it get merged soon.
teruakohatu 6y ago
The webpage for the library says it is suitable as the engine for web browsers and is used in a couple of browers. I think emacs is being used with an older version (>2) of the library that does not have full isolation. https://webkitgtk.org https://webkitgtk.org https://packages.debian.org/buster/epiphany-browser https://packages.debian.org/buster/epiphany-browser
vngzs 6y ago
The original bug report for this issue contains the following text [0]: Although there is apparently some sandboxing in the use of webkit in emacs (I read that it uses a seperate process, although not anywhere authoritative), this still seems to be equivalent to shipping a JavaScript enabled browser without any security support. Debian packages in stable need security team support. It seems more like a procedural argument about support (i.e., "We don't want the security team to bother with another web browser embedded in Emacs") rather than technical ("It's impossible to have sandboxed Webkit in Emacs"). From a security perspective, this addon seems like the worst of both worlds: it's WebKit, so it's commonly attacked and prodded at, and it's relatively unsupported, so 0days are likely to stick around and fester. As much as I love the idea of this, I would probably run it as a separate user, or maybe in a chroot or restricted namespace. Unfortunately, it would be pretty inconvenient to use a text editor that can't read my files! [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=843462 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=843462
tyrust 6y ago
>"security" Is there a reason for the scare quotes? In the Reddit thread, the author of xwwp says that the concerns are legitimate: https://np.reddit.com/r/emacs/comments/ifieb8/towards_a_serious_modern_browser_in_emacs/g2paqof/ https://np.reddit.com/r/emacs/comments/ifieb8/towards_a_seri...

kscarlet 6y ago

Author of the fork here. Yes I'm awared of this issue, and I've submitted a patch to emacs-devel that enables sandboxing, hopeful it get merged soon.

teruakohatu 6y ago

The webpage for the library says it is suitable as the engine for web browsers and is used in a couple of browers. I think emacs is being used with an older version (>2) of the library that does not have full isolation. https://webkitgtk.org https://webkitgtk.org https://packages.debian.org/buster/epiphany-browser https://packages.debian.org/buster/epiphany-browser

vngzs 6y ago

The original bug report for this issue contains the following text [0]: Although there is apparently some sandboxing in the use of webkit in emacs (I read that it uses a seperate process, although not anywhere authoritative), this still seems to be equivalent to shipping a JavaScript enabled browser without any security support. Debian packages in stable need security team support. It seems more like a procedural argument about support (i.e., "We don't want the security team to bother with another web browser embedded in Emacs") rather than technical ("It's impossible to have sandboxed Webkit in Emacs"). From a security perspective, this addon seems like the worst of both worlds: it's WebKit, so it's commonly attacked and prodded at, and it's relatively unsupported, so 0days are likely to stick around and fester. As much as I love the idea of this, I would probably run it as a separate user, or maybe in a chroot or restricted namespace. Unfortunately, it would be pretty inconvenient to use a text editor that can't read my files! [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=843462 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=843462

tyrust 6y ago

>"security" Is there a reason for the scare quotes? In the Reddit thread, the author of xwwp says that the concerns are legitimate: https://np.reddit.com/r/emacs/comments/ifieb8/towards_a_serious_modern_browser_in_emacs/g2paqof/ https://np.reddit.com/r/emacs/comments/ifieb8/towards_a_seri...