🚀 go-pugleaf

In article <33614@bbn.COM>, dsill@RELAY-NSWC (Dave Sill) writes:
>Current discussion on wizards brought up the subject of GNU Emacs'
>local variables.  Are you aware that arbitrary Lisp code can be
>embedded in a file in such a manner that it is automatically executed
>when the file is read in?  Not only that, but there's a variable,
>inhibit-local-variables, that, if non-nil, requires confirmation
>before executing the commands BUT IT'S DEFAULT IS NIL?
>
>I can understand how such a capability could be quite handy, but
>there's no excuse for it to be enabled by default.  The posting
>describing the problem on wizards even included an example that ran
>kill-emacs.  It boggles the mind to think what could be done with
>this.  It wouldn't take much of a lisper to write a viral mail message
>or news posting.
>
>In fact, you may be reading such a message right now.
>
>Ha ha.
>
>=========

In article <8812202329.AA10348@OLIVER.MIT.EDU>, eichin@ATHENA ("Mark W. Eichin") writes:
>>> From: John Robinson <jr@bbn.com>
>>> Here's an interactive greeting card.  Eval the following and then M-X
>>> surprise.  May offend some non-Christians...
>
>Amusing... I haven't run it yet, of course, though I have glanced over
>it. Commemorating the second (third?) anniversary of CHRISTMA.EXEC,
>are we?
>
>[I do NOT mean to malign John Robinson, or imply that he would even
>THINK about propagating viral elisp code. However, the historical
>similarity was too amusing to be passed up...]
>
>				Mark Eichin
>			<eichin@athena.mit.edu>
>		SIPB Member & Project Athena ``Watchmaker'' 
>		 [And part-time Internet Virologist :-]

The point here, for those who may have missed it, it that when anyone
sends you something and says "here, run this on your computer", bells
and warning lights should go off in your head.  CHRISTMA.EXEC refers
to one such prank a few years back where a supposed Christmas greeting
would do all sorts of damage to your account (if I remember correctly,
this was the BTINET "virus" (actually worm) that is fairly widely
docuemnted; Mark or soemone correct this if I have lied).

The point about auto-execute code in a file that emacs reads is
well-taken, and I agree that the default setting of the variable ought
to be t.  If you don't understand what this all means, you DEFINITELY
should set it in your .emacs:

  (setq inhibit-local-variables t)

And when you get the warning:

  Set local variables as specified at end of <file>?

reply no.  Once you understand the mechanism and see its advantages,
you may want to be a little more willing to use it, though I am not
sure you'd ever want to change inhibit-local-variables.

One very important point that ought to be brought out in this forum is
that distributing source is a powerful tool in deciding whether a
program conceals a trojan horse.  Sure, the code can be pretty opaque
in source form, but it gives you the opportunity to look it over
before you submit it to your compiler.  I think this is a rather
powerful argument for a part of the GNU manifesto - that all programs
should be distributed with full source.  The extra cautious should
always recompile from scratch (and read over the code).

Another point (now that I have your attention) is that an awful lot of
what has been glued onto "computer virus attacks by hackers" stories
in the news is actually malicious destruction of company data by
disgruntled or deranged insiders, (ex-)employees etc.  In fact, a not
insignificant amount of this sort of attack has been perpetrated by
so-called "security experts".  Don't rely on the experts!  Learn to
read source and insist on it.

Yikes, that got a little heavy.

Happy New Year everyone.  Now I feel better.
--
/jr
jr@bbn.com or bbn!jr