Re: ELPA security

[Ted Zlatanov]

On Mon, 07 Jan 2013 11:17:36 +0530 Jambunathan K <address@hidden> wrote: 

JK> I have never even thought of verifying my Emacs, ever.  If Emacs,
JK> happened to carry a virus or if the rumour-mills go abuzzing about virus
JK> infiltration or if AV packages go bonkers, I may become extra paranoid.

JK> Also, when I am downloading stuff from a distributor I implicitly trust
JK> shouldn't I be doing good.  Can I not rely on the distributor to do the
JK> due diligence?

How do you know that distributor.com is who they say they are?

What if there's a break-in at the distributor.com site and malicious
code is brought online?

These are not theoretical situations.  They have happened many times.

Ted