2018-02-27 Emacs Packages

My Emacs setup is on GitHub but I might have to finally get rid of my special package handling code and move to something else instead.

How about using straight together with use-package?

One of these days!

Tags:

Comments

I’m having the same questions. The functional approach of straight is very appealing. Would this approach be able to increase the security ? With security, I mean the fact that the melpa is vulnerable to attacks, much more than a debian/any-other-distro repo or github for example.

– JeanMichel 2018-02-28 12:07 UTC


[of course you keep my email adress for you ;-) ]

– JeanMichel 2018-02-28 12:08 UTC


To be honest, I have never thought much about the security of MELPA and friends. I suspect it is terrible, but then again, perhaps it is not if HTTPS is enabled and certificates are checked and all that, perhaps it is good enough? Debian doesn’t have HTTPS for its repos but has signature checking. We don’t have signatures but HTTPS? Fair? 🤷 I have no idea.

– Alex Schroeder 2018-02-28 13:54 UTC


Well, I started to worry about security in emacs after this discussion : https://www.reddit.com/r/emacs/comments/63e8hu/are_emacs_package_repositories_a_security_risk/?st=jejp9fmz&sh=a7ade519

Since then, there have been other discussions, which I have not followed accurately. I’m not a specialist, but for those who use emace for everything like notes, mail etc, the possibility of an infected package should be a concern, and i’d love if there would be an approach to solve this.

But ... that is not your point in this post ! ;-)

– JeanMichel 2018-03-09 08:55 UTC


https://glyph.twistedmatrix.com/2015/11/editor-malware.html

I found this a while ago, which says you have to do extra work to get Emacs to actually verify https.

– jpkotta 2018-03-09 17:03 UTC


Thank you both! Very interesting.

– Alex Schroeder 2018-03-11 21:17 UTC


straight.el uses hashes and a lockfile

https://github.com/raxod502/straight.el#lockfile-management

– straight user 2018-04-12 23:27 UTC


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.