Re: Request to backport fix for CVE-2022-45939 to Emacs 28

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > While I understand the resourcing issues, I think this is the wrong
  > decision. We are in the situation where the current released version of
  > Emacs has a known security exploit with a severity classification of
  > high (although this assessment seems to be under review) and the
  > response seems to be "Sorry, we are too busy trying to get the next
  > version released to deal with this".

I agree.  Fixing this one bug seems to be important to our user
community, and we already know the fix.  We should release a fixed
version.

What makes it a ontrivial job to release one?  Is it because there
other fixes have been committed to the Emacs 28 branch since the last
release?  Would including them in a release call for some additioal
work?

If so, I am sure we can find a solution that avoids some of that work.

-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)