5 ms·
> The client, accessing remote repos, is wildly insecure, by design Who's the best kid in the block regarding third-party extensions security? There's really
by monsieurbanana 2y ago
> The client, accessing remote repos, is wildly insecure, by design
Who's the best kid in the block regarding third-party extensions security?
There's really not much standing in front of a supply-chain attack for my editor of choice, emacs. Most people use a community extensions aggregator that also directly fetches from git repositories. The only slim advantage we have is that I'm sure a much higher % of emacs users would actually look into the source code of the extensions they pull.
- alexhutcheson 2y agoIf you want to be cautious, I have somewhat higher confidence in the versions of Emacs packages published on the Debian repositories[1] than the ones on ELPA/MELPA. The downside is that not every package is packaged for Debian, and the versions are a bit stale. https://packages.debian.org/search?keywords=ELPA+&searchon=names&suite=stable§ion=all https://packages.debian.org/search?keywords=ELPA+&searchon=n...
- monsieurbanana 2y agoThat's a bit of an understatement, about 1% of all emacs packages are in there :)
- amluto 2y agovscode tunnel is already a massive step up from vscode remote SSH here.