The original bug report for this issue contains the following text [0]: Although there is apparently some sandboxing in the use of webkit in emacs (I r

The original bug report for this issue contains the following text [0]: Although there is apparently some sandboxing in the use of webkit in emacs (I read that it uses a seperate process, although not anywhere authoritative), this still seems to be equivalent to shipping a JavaScript enabled browser without any security support. Debian packages in stable need security team support. It seems more like a procedural argument about support (i.e., "We don't want the security team to bother with another web browser embedded in Emacs") rather than technical ("It's impossible to have sandboxed Webkit in Emacs"). From a security perspective, this addon seems like the worst of both worlds: it's WebKit, so it's commonly attacked and prodded at, and it's relatively unsupported, so 0days are likely to stick around and fester. As much as I love the idea of this, I would probably run it as a separate user, or maybe in a chroot or restricted namespace. Unfortunately, it would be pretty inconvenient to use a text editor that can't read my files! [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=843462 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=843462