[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

From: Leo Famulari
Subject: [bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.
Date: Wed, 7 Feb 2018 21:32:53 -0500
User-agent: Mutt/1.9.2 (2017-12-15)

On Thu, Feb 08, 2018 at 09:04:35AM +0800, Alex Vong wrote:
> I agree with what Leo thought. Since it is up to emacs package authors
> to make sure untrusted input are never sent to webkitgtk, and it is hard
> to garantee that every package does the right thing.

I'd like to clarify myself a bit.

I believe that with some time and effort, someone could find exploitable
bugs in every complex piece of software in Guix.

We shouldn't let this hold us back from enjoying the features of the

However, in cases where the bugs were publicized long ago (webkitgtk
2.4.0 is almost 4 years old; 2.4.11 almost 2 years old) and the bugs are
easily accessible to attackers (webkitgtk renders content from web
pages) we should be more careful.

GnuCash is now the only thing in our tree using this old webkitgtk, and
the GnuCash developers are actively working to make GnuCash use a more
recent version. Other distros have even removed GnuCash or are preparing
to remove it due to this issue, but I think we can wait for a bit

BTW, there is a bug to discuss related issues at

Attachment: signature.asc
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]