Re: ASDF-INSTALL and gpg

Your response is long on abuse, but not long on argument.  Let me restate:

1.  ASDF-INSTALL runs as the user, with full user privileges.
2.  If you have write access to your keyring, then so does ASDF-INSTALL,
unless you run as another user.
3.  Let us consider two possibilities:
   a.  You run as an unprivileged user when running ASDF-INSTALL.  In
this case, a continuation that fetches the public key of the packager
cannot hurt you, since it cannot write to your keyring.
   b.  You run as yourself, with write access to your gpg keyring.  In
this case, a continuation that fetches the public key of the packager
can do nothing ADDITIONAL to hurt you --- a lisp process can call gpg
and damage your keyring with or without this continuation.

Do you disagree with one of these four statements, and if so, in what way?

Please state clearly what harm can be done by having this added key
fetch that is not already offered by ASDF-INSTALL.

Your arguments all have to do with the environment in which ASDF-INSTALL
is run; they do not seem in any way relevant to the function of
ASDF-INSTALL itself.

-- 
Robert P. Goldman
Senior Scientist
Smart Information Flow Technologies (d/b/a SIFT, LLC)

211 N. First St., Suite 300
Minneapolis, MN 55401

Voice:	(612) 384-3454
Email:    [email protected]

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/