Hacker News Reader

Comment by nickdrozd | Hacker News Reader

> Lesson #1: Provide significant out-of-the-box utility

There has been a push to move certain modes out of the core Emacs distribution and into package repos, I guess because it makes it makes them easier to maintain. Emacs comes with a Python mode, for example, and that conceivably could go to ELPA. But not everyone has access to package repos, and switching from a kitchen-sink model to a framework-for-external-repos model would make Emacs far less useful for such users.

View on HN

I never understood that argument. What prevents emacs-devs from maintaining an emacs-core with all modes outsourced to ELPA, and still deliver a emacs-classic-distribution which loads packages from elpa on compiling? You can easily mark versions of the elpa-packges matching the emacs-classic-version, while developing it independant from it.

Only a tiny minority of users can't access package repos. They can download the packages at home and mail themselves in a zip file.

It's trivial to create a zip file containing the necessary files, plus a config elisp file which has the personal customizations.

> Only a tiny minority of users can't access package repos.

That sounds like a verifiable claim. Do you have any proof?

Only my personal experience. I never encountered a situation in my professional life where I couldn't access the net.

How is it verifiable? Is there some statistics of this?

You must never have worked on airgapped systems then. Or had to justify non-standard software to gatekeepers.

Surely workers in airgapped systems are (objectively) a minority, if not a tiny minority ('tiny' is subjective..)

The problem with that Point of view is discoverability. It's the same issue I have with tweaking Vim to slowly provide some better ergonomics for my projecting, and has honestly been a consistent hurdle even when I was first learning computer suites like Word Processors and other office stuff.

I've never done well at navigating the initial humps of learning plugin/package ecosystems. Especially when I can't phrase what it is I'm looking for correctly, and I've grown reluctant to spend excessive amounts of time trying to dedup toolsets because it leads to pristine garage syndrome.

You have a system gleaming clean and ready to do things, but you're so exhausted getting things just so, you don't do anything with it.

It has nothing to do with the fact I like to blow away and remake systems on a regular basis, I swear. :P

What are the main examples you have in mind of users who can use emacs but can’t install packages?

I can offer one data point.

The company I'm an on-site (well, usually) contractor for, whose network I use at work, proxies web traffic over HTTP. It's encrypted at the proxy for HTTPS, but everything outbound from the internal network is effectively plain text.

Emacs doesn't allow packages to be installed over HTTP, so in order to use the package repositories, I have to use my phone as a hotspot.

If you have sufficient disk space (~5GB), you can also keep an elpa-mirror on your machine.

https://github.com/d12frosted/elpa-mirror

Didn’t know about this possibility. It’s a good idea to archive it locally and update regularly (just in case something happens with internet ;). Is the same possible for melpa?

> Emacs doesn't allow packages to be installed over HTTP

Are you sure about that? I think that you can specify http as usual in the URL:

  (add-to-list 'package-archives '("melpa" . "http://melpa.org/packages/") t)

See the instructions here which go to an annoyingly extreme level of ugliness to set the protocol in a paranoid fashion: https://melpa.org/#/getting-started

Probably someone on the remote machine with restricted or no internet connection and admin privileges. It happens e.g. on company or academic clusters.

It is much easier to ask admin to install emacs and use defaults than to ask to install emacs and packages (and resolve problems that may happen on the way).

I use Emacs at work, where unapproved external packages are prohibited. If Python mode were pushed out to a repo, I would basically be forced to use another editor.

Another example might be using Emacs on a device without network access.

If we relax "can't" to include "won't", then there are casual users who might want to try Emacs but can't be bothered to set up package archives, etc. Such a user will start it up, say "What, no Python mode?", and switch to something else.

Is there a powerful resistance to approving elisp packages that aren't default? Could you lay the groundwork with whoever maintains the list of approved packages by asking about approving certain versions of emacs packages that you use, and make your current setup much richer at the same time (e.g. by adding lsp-mode, ms-lsp, flycheck and whatever else you may be doing without now).

What is really an "external package" in emacs?

There should be nothing stopping someone just copying and pasting an entire elisp source text from a website into scratch, evaluate the buffer on the spot, and have the exact same functionality as installing the package would.

I'm not saying that retrieving an external package isn't easier, but due to emacs' nature there isn't really sort of delineation based on how the elisp got into the emacs.

It's more complicated than that: Emacs packages should be thought of the same as any other language's packages. They might comprise multiple files, and it's possible that their performance will be noticeably compromised if they are not byte-compiled. Installing Emacs packages should be done with the package manager.

Having never worked at a company like that I'm curious how it works. Is it

- No http/https connections

- No write access to home directory

- Internal prohibition against downloading/using something which is a "software package"

Internal prohibition. Using Emacs at all requires approval. The "product owner" is not an Emacs user, so building a custom distribution to include, say, Magit, is out of the question. I am stuck using commandline Git :(

this sounds a bit crazy.

It is unfortunately common.

Any organization with high-value data has a responsibility to try not to be the next Equifax.

Programmers, sysadmins, and DB admins are excellent targets for attackers.

So, it's not actually so crazy to require that all tools be vetted by internal security teams, especially third-party extensions for Turing machines like Emacs.

I love Emacs but its architecture is a nightmare for Blue Team, and the easiest stance is definitely "no installing packages", or just "thou shalt use this IDE and no other".

I get that, but the right approach to securing high value data is to secure the data, not try and control every aspect of the environment it lives within; that's often more security theater. Note I'm not suggesting that the right approach is "wild west", rather that any vetting process that doesn't allow for well established and widely used tools to be adopted is probably too rigid.

I didn't say the "right" stance was to ban extensions, just the "easiest".

Since humans default to lazy, I thought that clearly explained why the phenomenon happens.

Perhaps I should have been clearer that I don't think it's the ideal approach, even if I understand where it comes from.

In my experience of US corporate culture it's also unfortunately common for employees at all levels to kowtow unnecessarily to "legal" without considering whether what "legal" are saying is sensible or not.

> so building a custom distribution to include, say, Magit,

I mean, you don't need to really "build" anything, you just need to install the package:

  (add-to-list 'package-archives '("melpa" . "http://melpa.org/packages/") t)
  (package-initialize)

  M-x package-refresh-contents
  M-x package-install magit

What would happen if you did that?

I kinda hope they don't go down that path: the over-the-top, kitchen-sink-ness absurdity is what I love about Emacs. I've only been using it for a few years, so I'm still stumbling down crazy rabbit-holes (more like, giant caverns) of functionality and tools that I never knew were there - and can't believe that they'd bundle in by default.

Sure I'll probably never need most of the stuff - but it make me happy to know it's there... and is great fun to explore: especially if you're on an 18 hour flight with no wifi!

Reply on news.ycombinator.com