Subject: Re: bug#33847: 27.0.50; emacsclient does not find server socket

From: Paul Eggert <[email-masked]>
Date: Sat, 29 Dec 2018 22:44:59 -0800

Ulrich Mueller wrote:
> So you're saying that on systems that don't have XDG_RUNTIME_DIR,
> placing the socket under TMPDIR is fine? Because I don't understand
> that argument. If TMPDIR has security problem, then it shouldn't be
> used anywhere. If it hasn't, then why can't we keep the current
> (Emacs 26) solution?

Because we're not absolutists. On older systems that do not have adequate 
provisions for security, Emacs does the best it can: that's better than not 
doing anything, and people who run older, less-secure systems are likely to not 
care all that much about security anyway so this is OK. On newer systems that 
are more secure, though, Emacs can be more secure.

This is not anything new. In the bad old days when /tmp wasn't sticky, Emacs was 
less secure with temporary files, just like everyone else was. That didn't mean 
that Emacs should never have used temporary files.