Re: Autoload from a web page?

[Stephen J. Turnbull]

Lennart Borgman writes:

 > In a situation like that it is possible to set up for autoloading
 > things by downloading them from the web without compromising security
 > (or at least not more than when you download a file yourself) since
 > you know which files will be downloaded.

Why would the user know which files would be downloaded, and from
where?  The whole point is to do it automatically, without troubling
the user.  If the user is going to go to the trouble of *carefully*
verifying sources and so on, little is saved.  On the other hand, it
would be easy enough to register a domain like "savannah.gnu.org.to",
and a lot of folks might miss that, if they even looked at all.

Think of this like rules against talking on your cellphone while
driving.  Cellphone use is not an absolute guarantee you'll kill
somebody, and abstinence from cellphone use is no guarantee you
won't.  Some people do use cellphones responsibly while driving, and
so on.  But for the typical driver it does vastly increase the risks.

And so does any automated downloading and execution scheme.