|
From: | Paul Eggert |
Subject: | bug#33847: 27.0.50; emacsclient does not find server socket |
Date: | Sat, 29 Dec 2018 22:44:59 -0800 |
User-agent: | Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1 |
Ulrich Mueller wrote:
So you're saying that on systems that don't have XDG_RUNTIME_DIR, placing the socket under TMPDIR is fine? Because I don't understand that argument. If TMPDIR has security problem, then it shouldn't be used anywhere. If it hasn't, then why can't we keep the current (Emacs 26) solution?
Because we're not absolutists. On older systems that do not have adequate provisions for security, Emacs does the best it can: that's better than not doing anything, and people who run older, less-secure systems are likely to not care all that much about security anyway so this is OK. On newer systems that are more secure, though, Emacs can be more secure.
This is not anything new. In the bad old days when /tmp wasn't sticky, Emacs was less secure with temporary files, just like everyone else was. That didn't mean that Emacs should never have used temporary files.
[Prev in Thread] | Current Thread | [Next in Thread] |