Re: What is GNU ELPA?

[Eli Zaretskii]

On May 17, 2020 5:48:53 AM GMT+03:00, Richard Stallman <address@hidden> wrote:
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
> 
>   > And efaq.texi:
> 
>  >    There are other, non-GNU, Emacs Lisp package servers, including:
>   > @uref{https://melpa.org, MELPA}; and
>   > @uref{https://marmalade-repo.org, Marmalade}.  To use additional
> > package servers, customize the @code{package-archives} variable.  Be
>  > aware that installing a package can run arbitrary code, so only add
>   > sources that you trust.
> 
> We should not be recommending those to the public.  Would someone
> please delete that text?

This text is obsolete.  The current text says:

"There are other, non-GNU, Emacs Lisp package servers, including:
MELPA and Marmalade.  To use additional package servers, customize
the 'package-archives' variable.  Be aware that installing a package can run
arbitrary code, so only add sources that you trust.  Also, packages
hosted on non-GNU package servers may encourage or require you
to install and use non-free software; for example, MELPA is known
to host some packages that do this."

This explicitly warns about the MELPA problem, and so a reference to it there 
is no more a recommendation to use it than a reference to Microsoft or 
MS-Windowd is a promotion of those two.

It makes very little sense to me to remove any and all references to the 
M-word, because doing so doesn't inform our users about these dangers, and thus 
implicitly exposes them to those dangers.