Re: How to make Emacs more secure?

On 2026-05-03, at 08:32, Stéphane Marks <[email protected]> wrote:

> Ask them how they secure npm and the javascript zoo including VSCode or whatever their poisons are.  Do they have
> supply-chain warranties from their vendors? e.g., if they contract with JetBrains, who is responsible for auditing downloaded
> content and how do they do that?  etc etc.  Your tools don't have to be held to a higher standard than the lowest one they're
> willing to accept if only because they don't know those tools.

No need to be aggressive.  Emacs /is/ potentially insecure exactly
because its strengths, that is, instead of a plugin API, it exposes
(almost) /everything/ via Elisp.  My question is serious, and it's not
because my company has some idiotic rules, but because I don't want to
introduce unnecessary risks.

In fact, I'm strongly leaning towards running terminal Emacs within a VM
with very restricted access to things like keys, passwords etc.

Best,

-- 
Marcin Borkowski
https://mbork.pl