Re: How to make Emacs more secure?

On Sun, May 17, 2026 at 03:01:41PM +0200, [email protected] wrote:
> On 2026-05-03, at 10:37, Stéphane Marks <[email protected]> wrote:
> 
> > Aside from a baseline "audit," this feature coming in Emacs 31 will help for package upgrades.  AFAIK, the same does not exist
> > in VSCode and if that's an approved tool, then Emacs, used correctly, should exceed VSCode's default security posture.
> 
> As I said in the previous message, not necessarily.  `emacs --eval` can
> do /everything/ the user can do.  I am not sure if a typical editor/IDE
> like VSCode can do the same - it's possible these tools have some sort
> of sandboxes Emacs doesn't have.

I don't think so, not by default. VSCode downloads whatever it needs via
npm, the user gets to pick and choose their extensions, which live "out
there".

> Also, a rogue package is not necessarily the biggest security risk.
> A rogue skill and a coding agent writing some malicious Elisp might be
> a bigger issue.

With npm, where's the difference, though?

Cheers
-- 
t

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRp53liolZD6iXhAoIFyCz1etHaRgUCagnAYgAKCRAFyCz1etHa
RtHVAJ9uiJu6rpkgAxFSgw4pi7vmOMSVWQCeMPPM+prlSfYNGlFaaNWFN58ccUs=
=7V5H
-----END PGP SIGNATURE-----