Re: Risky local variable mechanism

[Luc Teirlinck]

Chong Yidong wrote:

   Er, it is always safe to *add* to a list of local variables to ignore.

Not if you do it _through Custom_.  You did not understand what I wrote
in my first message.  After the release, we introduce some new variable so
dangerous that it _has_ to be in `ignored-local-variables'.  We add
that variable to the standard value in the defcustom.  Now anybody who
customized `ignored-local-variables' in the meantime will _not_ get
that dangerous variable added to `ignored-local-variables'.  This is
an updating problem.

The safe way to add to `ignored-local-variable' is using add-to-list,
not using setq.  Your code uses add-to-list *when it is called*, but
after that, it lets Custom do the work and Custom uses set-default,
which is not safe.

The same type of updating problem also occurs for `safe-local-variables'.

As Stefan pointed out, there is also another type of updating problem
with `safe-local-variables', because a safe variable can become unsafe
if it gets changed to be more powerful.  This type can combine with
the other.  If we add a variable to the standard value in one release
and then have to remove it in a later release from some reason, then
anybody who customized the variable _through Custom_ will not get that
variable removed from his customized value.  Somebody who only used
add-to-list to add other variables, will get it properly removed.

Sincerely,

Luc.