Re: How to make Emacs more secure?

Stéphane Marks <[email protected]> wrote:

> […]

> Aside from a baseline "audit," this feature coming in Emacs 31 will help
> for package upgrades.  AFAIK, the same does not exist in VSCode and if
> that's an approved tool, then Emacs, used correctly, should exceed VSCode's
> default security posture.

> *** Packages can be reviewed before installation or upgrade.
> The user option 'package-review-policy' can configure which packages
> the user should be allowed to review before any processing takes place.
> The package review can include reading the downloaded source code,
> presenting a diff between the downloaded code and a previous
> installation or displaying a ChangeLog.

Ah!  Very nice.  I find it always very icky that
list-packages & Co. just offer an "Install" button, but no
way to inspect the code before enabling it (or just reading
it to check whether it is useful for an intended purpose).

Tim