2018-02-27 Emacs Packages

My Emacs setup is on GitHub but I might have to finally get rid of my special package handling code and move to something else instead.

How about using straight together with use-package?

One of these days!



I’m having the same questions. The functional approach of straight is very appealing. Would this approach be able to increase the security ? With security, I mean the fact that the melpa is vulnerable to attacks, much more than a debian/any-other-distro repo or github for example.

– JeanMichel 2018-02-28 12:07 UTC

[of course you keep my email adress for you ;-) ]

– JeanMichel 2018-02-28 12:08 UTC

To be honest, I have never thought much about the security of MELPA and friends. I suspect it is terrible, but then again, perhaps it is not if HTTPS is enabled and certificates are checked and all that, perhaps it is good enough? Debian doesn’t have HTTPS for its repos but has signature checking. We don’t have signatures but HTTPS? Fair? 🤷 I have no idea.

– Alex Schroeder 2018-02-28 13:54 UTC

Well, I started to worry about security in emacs after this discussion : https://www.reddit.com/r/emacs/comments/63e8hu/are_emacs_package_repositories_a_security_risk/?st=jejp9fmz&sh=a7ade519

Since then, there have been other discussions, which I have not followed accurately. I’m not a specialist, but for those who use emace for everything like notes, mail etc, the possibility of an infected package should be a concern, and i’d love if there would be an approach to solve this.

But ... that is not your point in this post ! ;-)

– JeanMichel 2018-03-09 08:55 UTC


I found this a while ago, which says you have to do extra work to get Emacs to actually verify https.

– jpkotta 2018-03-09 17:03 UTC

Thank you both! Very interesting.

– Alex Schroeder 2018-03-11 21:17 UTC

straight.el uses hashes and a lockfile


– straight user 2018-04-12 23:27 UTC

Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Just say HELLO