Re: Autoload from a web page?

[Ted Zlatanov]

On Tue, 29 Dec 2009 15:05:28 -0200 Stefan Monnier <address@hidden> wrote: 

>> Would it be possible to setup a function to download an elisp file
>> from a web page when called and then evaluate that file and call
>> itself again (with the old parameters), now with the new definition
>> from the web page?

SM> (url-handler-mode 1)
SM> (autoload 'foo-function "http://toto.bar/baz/foo.el";)

There are so many security risks with this, and better ways to manage
packages have already been devised!  Ubuntu, for instance, signs the
packages and there's a whole key infrastructure set up in the distro.

Downloading and evaluating a file is the easy part, technically.
Listing Lisp files on a web page requires no security.  Managing
software, though, is hard.  For instance:

- your worst enemy is trying to break/infect/DDOS your distribution,
  what are your defenses?  What if your webserver dies?  What if your
  domain name expires or gets hijacked?

- how do you issue an emergency patch and notify your users?

- how do you back out of a change?  How do you version releases?

- how do you deal with circular dependencies?

- how do you minimize bandwidth, disk, and CPU costs?

- who will manage the repository when you can't?

- who will support the users when they have the inevitable problems?

Ted