Re: How to make Emacs more secure?

Philip Kaludercic <[email protected]> wrote:

>>> […]

>>> Aside from a baseline "audit," this feature coming in Emacs 31 will help
>>> for package upgrades.  AFAIK, the same does not exist in VSCode and if
>>> that's an approved tool, then Emacs, used correctly, should exceed VSCode's
>>> default security posture.

>>> *** Packages can be reviewed before installation or upgrade.
>>> The user option 'package-review-policy' can configure which packages
>>> the user should be allowed to review before any processing takes place.
>>> The package review can include reading the downloaded source code,
>>> presenting a diff between the downloaded code and a previous
>>> installation or displaying a ChangeLog.

>> Ah!  Very nice.  I find it always very icky that
>> list-packages & Co. just offer an "Install" button, but no
>> way to inspect the code before enabling it (or just reading
>> it to check whether it is useful for an intended purpose).

> We have had `package-vc-checkout' for a while now, which check out the
> source code behind a package in a directory of your choice.

While useful (and something I was unaware of until now :-)),
this is not quite the same as "these are the exact files
that will be installed when you press 'Install'".

Tim