Re: ELPA security

[Jambunathan K]

If GNU packages come with no warranty of any sort, I am wondering why
all this fuzz.

If I am downloading a package from a trustworthy site - "certified" by a
legal entity - I should be doing good, right.

I have never even thought of verifying my Emacs, ever.  If Emacs,
happened to carry a virus or if the rumour-mills go abuzzing about virus
infiltration or if AV packages go bonkers, I may become extra paranoid.

Also, when I am downloading stuff from a distributor I implicitly trust
shouldn't I be doing good.  Can I not rely on the distributor to do the
due diligence?

Again, I am going to be fired from multiple quarters for posting this.
That's fine.  I am willing to face the cannon and hopefully others will
be informed or warned.

ps: I have nothing against elaborate security measures and VVIP gate
passes.  Question is does my house really need it?
--