Re: emacs-29 3c1693d08b0: Fix Elisp code injection vulnerability in emacsclient-mail.desktop

[Ulrich Mueller]

>>>>> On Wed, 08 Mar 2023, Po Lu wrote:

> IMHO we should stop kow-towing to the information security people who
> make a huge fuss over every single bug, especially bugs like this one
> which only show up when you specifically try to trigger them.

> Proprietary JavaScript routinely does things far more nasty and
> malicious than a hyperlink that can be read before being clicked.

> Or perhaps Emacs 29 can forgo this change entirely.  Why would anyone
> click a URL containing suspicious looking Lisp code, and who would
> actually try to do nasty things with such URLs?

> If you have to go out of your way to trigger a bug in a branch that is
> supposed to be stable, then fixing it can wait.

Wow. :)

At least you seem to agree that the current behaviour is a bug.