Re: ELPA security

[Stephen J. Turnbull]

Jambunathan K writes:

 > May be the idea is too ahead for it's time.  I wonder whether another
 > "serious" distributor like GNU ELPA sprouts forth.

Seems unlikely to me.  Why have more than one?  I suppose that Red Hat
might redistribute GNU ELPA, but I would imagine they would rely on
the GNU ELPA signatures.  Ditto Debian and Ubuntu.

 > Is XEmacs a contender here, I don't know.

No.  There is provision for signing our packages in our package
infrastructure, but currently they aren't signed, and the
functionality is probably pretty bitrotted.  It was way too much
hassle for most users the last time we tried.  Even Steve Baur, a
pretty paranoid dude, never advocated mandatory signature checking.

I imagine the state of the art has improved for PKI, and the situation
deteriorated in terms of the risks of cracking, so we may want to
reconsider.

Steve