Re: security of the emacs package system, elpa, melpa and marmalade

[Thomas Koch]

On Friday, September 27, 2013 05:04:55 PM Óscar Fuentes wrote:
> I don't think that comparing Emacs to a web browses used by tens of
> millions is fair. The later is a major attack target/vector for any
> crook, while Emacs is mostly uninteresting. No matter all the effort the
> Mozilla guys put on security, it is their web browser the real security
> threat on your system, not Emacs.

If I'd have criminal interest and the possibility to distribute malicious lisp 
code to a few hundert emacs users I'd:

- collect all private ssh and gpg keys found in the victims homedir and access 
data to their email accounts
- replace my attack lisp code with legitimate code after it has done its work
- sell the collected data to interested parties

I know that there are a lot of emacs users that are system administrators of 
interesting targets.

Regards, Thomas Koch