OpenOffice.org security concerns [LWN.net]

OpenOffice.org security concerns

Posted Aug 17, 2006 10:09 UTC (Thu) by tzafrir (subscriber, #11501)
In reply to: OpenOffice.org security concerns by nix
Parent article: OpenOffice.org security concerns

emacs will not automatically evaluate any from any document.

I admit I don't know emacs, but I know of a similar feature in vim: it is limited to a rather harmless set of commands that could not allow you to run arbitrary code.

(Log in to post comments)

OpenOffice.org security concerns

Posted Aug 18, 2006 11:46 UTC (Fri) by nix (subscriber, #2304) [Link]

So you don't know Emacs but you're willing to pontificate on what it can and cannot do?

Have a look at this; search for enable-local-eval.

This is a feature of ancient vintage in both Emacs and XEmacs.

OpenOffice.org security concerns

Posted Jun 14, 2007 3:31 UTC (Thu) by jordanb (guest, #45668) [Link]

Emacs macros were a poor decision made at a time when security was more of a geek's curiosity than a million dollar matter like it is today. And the fix for them is inadequate I think. Quite honestly, I think they should not be included at all. If you want something evaluated you should do it yourself, either with a (load-file) somewhere or by executing it interactively (C-x C-e, etc).

Microsoft Office's macro decision was still made before the Internet so they have some excuse, but their "fix" was even worse than that of emacs. They didn't reduce the ability of the macros to do damage at all, they just put up that stupid warning, and because that warning gets triggered even when the macros are clearly harmless (they don't access anything outside the local file), MS Office users grow immune to them and just instinctively click through.

Given the experience that Microsoft has had, OO.org's inclusion of macros with the exact same deficiencies is downright negligent.

I agree with the OP, macros should be restricted to a clearly-defined sandbox if they're used at all. The Emacs "solution" is especially bad in the case of a office suite because showing a macro to a secretary and asking her to decide if it's dangerous or not is like asking her if there's a dirty word in a randomly selected passage written in ancient greek.