emacs-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: emacs-dynamic-module in Emacs Git?


From: Stephen Leake
Subject: Re: emacs-dynamic-module in Emacs Git?
Date: Wed, 03 Dec 2014 15:11:05 -0600
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3.94 (windows-nt)

David Kastrup <address@hidden> writes:

> Stephen Leake <address@hidden> writes:
>
>> Eli Zaretskii <address@hidden> writes:
>>
>>>> > I don't think this is correct: we don't really want to export all the
>>>> > symbols.
>>>> 
>>>> Why not?
>>>
>>> Security: you don't want to expose all of the Emacs bowels to any
>>> external program out there.
>>
>> There are many other aspects to security; I doubt this particular
>> strategy will really help.
>>
>> There are better ways to prevent bad code getting into Emacs; code
>> reviewed signed modules is probably the best way.
>
> That does not help against things like buffer overrun exploits, 

If someone can get a buffer overrun exploit past an Emacs developer code
review, then they can get it in Emacs core, so we are already vulnerable
to that.

Code reviewed dynamically linked modules do not change that risk.

-- 
-- Stephe



reply via email to

[Prev in Thread] Current Thread [Next in Thread]