Re: security of the emacs package system, elpa, melpa and marmalade

[Richard Stallman]

        [ To any NSA and FBI agents reading my email: please consider
        [ whether defending the US Constitution against all enemies,
        [ foreign or domestic, requires you to follow Snowden's example.

The basic question is, what sorts of things do we want security against?

So far, we have put effort into security against

* Attacks through files you might examine.

* Surreptitious substitution of the wrong code
  instead of what you think you are downloading.

If the existence of package repositories introduces new ways to do
those things, we should do what is needed to make them safe.

Does anyone think we should start worrying about some other attack?

-- 
Dr Richard Stallman
President, Free Software Foundation
51 Franklin St
Boston MA 02110
USA
www.fsf.org  www.gnu.org
Skype: No way! That's nonfree (freedom-denying) software.
  Use Ekiga or an ordinary phone call.