GNU bug report logs - #24489
efaq: security risks

Previous Next

Full log

View this message in rfc822 format

From: Ted Zlatanov <tzz <at> lifelogs.com>
To: Richard Stallman <rms <at> gnu.org>
Cc: larsi <at> gnus.org, 24489 <at> debbugs.gnu.org
Subject: bug#24489: efaq: security risks
Date: Fri, 23 Sep 2016 22:45:59 -0400

On Fri, 23 Sep 2016 16:38:56 -0400 Richard Stallman <rms <at> gnu.org> wrote: 

RS> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
RS> [[[ whether defending the US Constitution against all enemies,     ]]]
RS> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]

>> Images and other resources can carry constructed data and be used as an
>> execution backdoor through browser or library bugs. The following don't
>> necessarily apply to Emacs, they are just examples of the variety and
>> severity of these attacks, which have risen in popularity as direct code
>> injection has become harder:

RS> It is no use telling people, "Be afraid of browsing."

The original suggestion by Glenn was to say that remote HTML content is
a potential security risk. That's a statement of fact and I gave
supporting evidence. Those risks apply to Emacs users, but I don't think
anyone proposed "be afraid" to be the message we should give.

RS> If we can't give any advice more specific than that, it would
RS> be a useless annoyance.

Certainly. The FAQ can link to external resources, for instance. I think
in the FAQ we should at least list the libraries that Emacs uses to
render remote content (SVG, XML, PNG, etc.) so the user is aware of
those dependencies and will keep them up to date.

But the method for that depends on the platform, so... do we explain in
the FAQ? Does Emacs itself warn when libraries are out of date? I don't
know.

Ted

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.