Subject: Re: bug#67323: 30.0.50; [PATCH] Set a new desktop file to mode 0600

From: Stefan Kangas <[email-masked]>
Date: Tue, 11 Feb 2025 20:07:40 -0800

Manuel Giraud <[email-masked]> writes:

> Eli Zaretskii <[email-masked]> writes:
>
> [...]
>
>> Bottom line: I think we should install this as optional behavior, by
>> default off, if at all.  If many people turn it on in their
>> customizations, we can later revisit the default value.
>
> So with all these conditions (a custom, off by default), I then think
> that we should not install this.  My idea was to have better privacy by
> *default*.  If one user have to tweak a custom somewhere to do this, I
> think he'd better set the Unix rights on its desktop file by "hand" as
> I'm doing now.  And there is still umask also.

Agreed.  Doing it optionally defeats the point.

The fact that desktop files can be created in other directories than
$HOME makes it even more important to have secure defaults.

I don't mind having a defcustom, on the other hand.  I can't imagine
when it would ever be useful, myself, but why not.