Re: Fixing security vulnerabilities before new releases

Sean Whitton <[email protected]> writes:

> Eshel Yaron [29/Jul  2:25pm +02] wrote:
>> Releasing a new version invites more users to install and use it,
>> and encouraging users to run vulnerable software is at best a disservice.
>> True, it wouldn't make things worse for users who are already running a
>> vulnerable version, but I don't think that's the right bar to aim for.
>> Instead, we should make sure we make things better for them, by providing
>> a version that mitigates this issue ASAP.  AFAICT, releasing a vulnerable
>> Emacs 31.1 would delay that mitigation unnecessarily.
>
> I think your argument applies only to people who are prompted to try
> Emacs for the first time when we release Emacs 31.  These are a small
> minority.

For the record: this vulnerability is *very* serious and deserves an
urgent release with a mitigation.

A new release without a fix will damage the reputation of Emacs as a
serious project. Not to mention the extra danger of a release containing
a *known* and easily exploitable vulnerability.

There is a very strong dissonance wrt security at play here. It is true
that Emacs' community is characterized by a well deserved high level of
trust but that trust is no longer guarantee of security on todays world.
We already had an incident with a bad actor sneaking malware on the
package ecosystem and it is for sure that more will happen if given the
opportunity.

Thank you Eshel for your work on making Emacs more secure.