Re: One vs many directories

[Tim Cross <theophilusx@gmail.com>]

Jean Louis <bugs@gnu.support> writes:

> * Dr. Arne Babenhauserheide <arne_bab@web.de> [2020-11-24 21:51]:
>>
>> Jean Louis <bugs@gnu.support> writes:
>> >> The start of the local variables list should be no more than 3000
>> >> > characters from the end of the file
>> >>
>> >>
>> >> Given the length of the email, I guess this is why Emacs saw the variables
>> >> as being within the correct range.
>> >
>> > Yes thank you. I was thinking Emacs will do that only in files where
>> > it recognizes some comments or no comments and that variables need
>> > to be pretty down in the file, on the bottom. Now I learn it is not
>> > so.
>> >
>> > That is security issue.
>>
>> Why is it a security issue? The variables do need to be close to the end
>> — 3000 characters is only about 50 lines.
>
> Emacs users, Org users on our mailing lists are not so private. Their
> names and email addresses are in the public database. Spammer can
> construct phishing type of an email, including something like Org news
> or something and send such email to users. Among let us say 3000
> people there will be percentage of users that will say Y to invoke the
> local variables due to lack of knowing what is it doing to computer.
>
> After that, anything becomes possible, including intrusion into
> computer, capturing all email addresses, passwords, sending spam
> emails from computer and so on.

this is just baseless fear mongering based on nothing but speculation.

Of your suggested 3000 users, only a very small percentage use Emacs as
their mail client. Of those, only an even smaller number will have their
mail client configured to render messages with a mode that supports
local variables and even a smaller number of those would say yes to
executing the code. In fact, anyone who has gone to the extent of
configuring their Emacs email client to open messages with a mime type
of x-org (or even just based on an attachment with *.org in the file
name) is more than likely to be sufficiently technically aware not to
say yes when asked.

Few, if any user, is going to download some random attachment in an
email message, open it in emacs and then say yes to a message warning
them that doing so might be dangerous. Such ill-informed users have been
pretty much weeded out by all the other scam phishing out there by now.
To convince them to go through such steps would require some pretty
convincing content - a simple org news attachment or similar is unlikely
to do it.

Even if you do get them to say yes, they are still a long way from being
able to compromise the computer Emacs is running on. Gaining some level
of access is one thing, actually being able to do something with that
access is another. Trying to compromise a computer, which these days
typically involves privilege escalation, would be extremely difficult to
achieve with elisp. The best you could hope for would be to install a
trojan or back door what would allow the attacker to install other
tools. Could be possible, but is definitely non-trivial.

This ability has been around in Emacs for a very long time - more than
30 years, possibly even longer. There has not been a single recorded
incident of large number of users being compromised as a result of this
feature. I've not even heard of small numbers being compromised as a
result of this feature.

I'm sure you will disagree. My suggestion is that if you believe this is
a security issue, you put together a proof of concept to demonstrate the
vulnerability - this is how such security issues get resolved.
Demonstrate how the security issue can be exploited with actual proof of
concept code rather than mere speculation and that will provide
something concrete which can be dealt with. I suspect you will find it
much harder to achieve once you actually try to make it work.

--
Tim Cross