Re: How to make Emacs more secure?

Tim Landscheidt <[email protected]> writes:

> Stéphane Marks <[email protected]> wrote:
>
>> […]
>
>> Aside from a baseline "audit," this feature coming in Emacs 31 will help
>> for package upgrades.  AFAIK, the same does not exist in VSCode and if
>> that's an approved tool, then Emacs, used correctly, should exceed VSCode's
>> default security posture.
>
>> *** Packages can be reviewed before installation or upgrade.
>> The user option 'package-review-policy' can configure which packages
>> the user should be allowed to review before any processing takes place.
>> The package review can include reading the downloaded source code,
>> presenting a diff between the downloaded code and a previous
>> installation or displaying a ChangeLog.
>
> Ah!  Very nice.  I find it always very icky that
> list-packages & Co. just offer an "Install" button, but no
> way to inspect the code before enabling it (or just reading
> it to check whether it is useful for an intended purpose).

We have had `package-vc-checkout' for a while now, which check out the
source code behind a package in a directory of your choice.

> Tim