GNU bug report logs - #78939
30.1.90; wishlist: separate storage location for safe-local-variable data

Previous Next

Package: emacs;

Reported by: Christopher Howard <christopher <at> librehacker.com>

Date: Tue, 1 Jul 2025 22:41:05 UTC

Severity: wishlist

Found in version 30.1.90

Full log

View this message in rfc822 format

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: Christopher Howard <christopher <at> librehacker.com>
Cc: Eli Zaretskii <eliz <at> gnu.org>, Andrea Corallo <acorallo <at> gnu.org>, Stefan Kangas <stefankangas <at> gmail.com>, 78939 <at> debbugs.gnu.org
Subject: bug#78939: 30.1.90; wishlist: separate storage location for safe-local-variable data
Date: Wed, 02 Jul 2025 14:58:11 -0400

> Just wondering: are there any other Customizable variables that are
> updated by Emacs outside of Customize itself?

Not many, but yes, some.  The only one that jumps to mind right now is
`package-selected-packages`.

> What seems unique about this case is that Emacs gives you a prompt
> when it encounters the file local variable (a frequent occurrence at
> least in my usage) and then updates Customize data depending on which
> key you press.

I don't know if your usage is common (for me, this var is changed fairly
rarely: if it's a file I visit regularly then there's no usually prompt,
and if not then I usually prefer not to save it for future sessions).

> Something else that seems unique is there is potentially a large
> amount of data being added frequently.  This would be like if bbdb used
> Customize to store your contact information.

[ I'd personally feel uneasy if that var had lots and lots of entries,
  since each one is a potential security hole, if I didn't think about it
  carefully enough.  🙂  ]

> I'm not meaning to attack the idea proposed by Stefen, but I am
> wondering about that.

I just mentioned it, because it's something that has been asked a few
times, for various reasons.  There's some existing third party support
for it, e.g.:

    https://github.com/dabrahams/initsplit

IMO, it would make sense to integrate such a feature.


        Stefan
This bug report was last modified 78 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.