4 ms·

Since Emacs is fully programmable, fully connected with virtually no “permissions” system, and there is no structure to scan, validate, or flag third-party exte

Since Emacs is fully programmable, fully connected with virtually no “permissions” system, and there is no structure to scan, validate, or flag third-party extensions/elisp code, I would suggest that it stands as a prime vector for malware!

wolvesechoes 1y ago
I would suggest that it stands as a prime vector for malware! So still better than VS Code that is malware by itself.
owebmaster 1y ago
> I would suggest that it stands as a prime vector for malware! I would suggest you send an email to rms@gnu.org, he might disagree.
- AStonesThrow 1y ago
  I have no idea who may receive or read his email messages. For a long time in the early 90s, he set no password on his accounts at MIT. Anyone could, and did, log in to rms@gnu.ai.mit.edu and it was basically a "public access system". Richard Stallman fundamentally rejects information security principles and practices. He absolutely hates it when systems are secure and impregnable. Richard Stallman is an extremist zealot; he's extraordinarily idealistic, but his ideals themselves are unrealistic for real-world operations. Previously: https://news.ycombinator.com/item?id=42256409 https://news.ycombinator.com/item?id=42256409 https://news.ycombinator.com/item?id=23421738 https://news.ycombinator.com/item?id=23421738 The GNU Project indeed itemizes a few "known security risks" in their own FAQ: https://www.gnu.org/software/emacs/manual/html_node/efaq/Security-risks-with-Emacs.html https://www.gnu.org/software/emacs/manual/html_node/efaq/Sec...
  - DiggyJohnson 1y ago
    Okay that seems needlessly obtuse. I think yall would get along actually based on the tone and content of your replies.
    - AStonesThrow 1y ago
      Did they not precisely validate what I wrote? GNU themselves says caveat emptor when installing 3rd party code. There’s no trusted path and no validation, and they admit it.

wolvesechoes 1y ago

I would suggest that it stands as a prime vector for malware! So still better than VS Code that is malware by itself.

owebmaster 1y ago

> I would suggest that it stands as a prime vector for malware! I would suggest you send an email to rms@gnu.org, he might disagree.

AStonesThrow 1y ago
I have no idea who may receive or read his email messages. For a long time in the early 90s, he set no password on his accounts at MIT. Anyone could, and did, log in to rms@gnu.ai.mit.edu and it was basically a "public access system". Richard Stallman fundamentally rejects information security principles and practices. He absolutely hates it when systems are secure and impregnable. Richard Stallman is an extremist zealot; he's extraordinarily idealistic, but his ideals themselves are unrealistic for real-world operations. Previously: https://news.ycombinator.com/item?id=42256409 https://news.ycombinator.com/item?id=42256409 https://news.ycombinator.com/item?id=23421738 https://news.ycombinator.com/item?id=23421738 The GNU Project indeed itemizes a few "known security risks" in their own FAQ: https://www.gnu.org/software/emacs/manual/html_node/efaq/Security-risks-with-Emacs.html https://www.gnu.org/software/emacs/manual/html_node/efaq/Sec...
- DiggyJohnson 1y ago
  Okay that seems needlessly obtuse. I think yall would get along actually based on the tone and content of your replies.
  - AStonesThrow 1y ago
    Did they not precisely validate what I wrote? GNU themselves says caveat emptor when installing 3rd party code. There’s no trusted path and no validation, and they admit it.