question from security team - how would you answer?

Hi Emacs friends, If you worked at an enterprise and the security team asked you *"why cant you just use visual studio like everyone else?"* how would you reply? For instance, my response might be *"emacs is a more efficient text editor for language XYZ that I've been using for a long time"* and their response might be *"Fred in accounting programs in XYZ and they use <text editor that doesn't scare them>....".* I'm purposely leaving out a few details, but basically any logical explanation I have they have a response for. Curious what you think, and thanks in advance.

Most programmers are blown away if you show them wdired or eshell; but for programming, the playing field is now quite evened out with language servers etc. And TBH, no editor is really secure unless it runs in a sandboxed environment, it’s sort of the nature of an editor. I realize that there’s no answer here, but maybe something to take away

“tacos”

It might be worthwhile to find out why they are asking: do they have specific concerns about emacs, or are they simply trying to get everyone to use a standard list of approved applications? It seems more efficient to answer their actual objections than to try to guess what those might be. I’ve had a similar experience when our company was acquired and a new security team took over, and wondered why I thought I needed to use vim instead of notepad++. Turned out that they were starting to push everyone toward Microsoft tools and programming languages; for me it was much easier (and better in the long run) to find a new job instead.

Well... I would probably quit! Seriously!!

For me that's proof that this security team are complete n00bs. Any real professional with some significant experience is aware how powerful emacs is(even if he does not use it he has high regard for people that do). You can thus either treat them like little kids(look there, a squirrel!) or if they have to say something then you should either like politics (be good in diplomacy, manipulation, rhetorics) or hope that they will not make too much damage. I wouldn't like to work with these people. That's like kindergarten, but real kids are much more funny and sweet!

Emacs' plugin system is not secure. I don't know whether visual studio code's is either, tbh, but its popularity at least gives them more of a chance of being informed when a plugin has security issues.

"I prefer emacs and have been using it for a decade. If I were to use another editor it would have the same effect on my productivity that using emacs would have on everyone else's. I would very much prefer for my productivity to remain high."

Don't try to justify it by mentioning features or whatnot, it's a losing game. Say that at the end of the day you're more productive with it, and since you'll be using this all day every day, it's worth the switch. Ask them if they have specific concerns you can address because it's been around for decades and in use at every major company. My guess is they have to fill out a form and they don't feel like it. Unless you work at a bank, in which case you might be SOL. I'd also go through your manager.

They wanted you to use Notepad++? That is... rough.

Let's be very frank here: Emacs is a security team nightmare. It's a unsecure script execution engine after all.

"I'm significantly more productive in emacs." There are right handed scissors and left-handed scissors. I'm not going to debate which is better. I'm only saying that I have been using left handed scissors for 10 years and if I need to switch, there will be a productivity loss.

“Why do you think I should care about what the f*** Fred does?”

I prefer emacs because of it's workflow together with evil mode, I like being able to do everything with a keyboard and to do everything so fast, plus it's really customizable which is one of the main reasons I'm using linux as well.

I sure hope you're joking, because they compared it to VS, which...is an unsecure script execution engine. Moreover it's one that's based on a language ecosystem (JS) that has, what? monthly? security incidents...

VS is licensed, which means that an enterprise can contract support and liability to the vendor. Emacs is not. I am not saying that VS is more secure. I am saying that it presents challenges to risk management that VS does not (unless the OP is working in a shop that has enterprise Linux support where Emacs is part of the enterprise-supported image). Part of security management is security. Part of it is management. Auditors look at both. Security teams need to be concerned about both. From an enterprise perspective, Emacs fails at the manageability side of the equation. VS excels at it.

They also wanted us to move from wiki to sharepoint, and start developing with C#. That wasn’t a desirable career path for me!

Yes…. But in some cases these are kids we have to deal with. Got similar issues and I asked for a VM where I was able to do what was best in terms of productivity for me and the company. It worked till a new “kid” more bureaucrat than the previous one or more politically astute came… and the approach was deemed non-standard thus doomed. I simply left and that has been the best professional decision for me in years. Is it worth working for a company which does not allow you to use the tools you are more productive with ? My answer and experience is clear.

Tell them you need to use M-x doctor! But in all seriousness, I agree with the other answers, besides the possible security concern ( which I have to say I’m not completely sold on since many editors have this issue), I would also add that development of the applications should be tool agnostic. Forcing people to use a set of tools reduces productivity since not everyone is going to be accustomed to those tools. My company tried to get me to move to jetbrains ides but I just couldn’t function in the environment. So I moved back immediately to eMacs.

> It might be worthwhile to find out why they are asking Op here. So, when I ask this question the response is all along the lines of "standards" but truth be told the security teams job would be easier if we used no programming editors. We would be more secure if they unplugged the systems. etc. It's not their remit to build value-add software, it's their remit to make sure we don't get hacked/malware/etc. I understand I could switch jobs, but I'd like to try to make the case that they should up their game. We have a cultural trust issue. I want to fix it.

Of course i agree with you! I was doing horrible and disgusting things in my life for money, like c++ under MFC. So i have really high respect for opiate addicts that sell their body on some dirty street. I'm different now and would never ever work anywhere where i would be forced to use such technologies and even a security department that does not respect emacs sounds like terrible company for me that i'd rather not have in my life. I went so far that I'm not sure whether i will ever again work for somebody in order to reduce these kind of problems and create a world with only good persons and good software. Software from Google is also on my list to get fired. But it's about progress not perfection.

> Is it worth working for a company which does not allow you to use the tools you are more productive with ? Op here; I agree; it is not worth it. I will leave if I can't get my security partners to up their game. However, I wanted to take one last stab and making the company a better/more trusting place. I'm realizing maybe the bigger question isn't an emacs one.

I agree. I'm thinking one last attempt to plead my case to the CSO.

I will borrow the scissor analogy, thanks for your reply.

I agree, Fred is a jerk that makes gross code and then hands it to me without unit tests. I just need income to buy diapers and video games so I can't say exactly this.

*the diapers aren't for me but the video games are.

From that point of view it's no different than having the python interpreter or nodejs installed. If OP is a developer, it seems like a wash. Also there's some room for different levels of security, eg you could allow emacs but disallow ELPA.

I think it is better for Emacs users to *pin* their packages. Installing a random revision of a package can be problematic, even if the likelihood of getting malicious Emacs Lisp code from a public repository is extremely low (because that would ruin the reputation of the author/maintainer). Modern package managers such as straight.el, borg, etc. all support pinning packages. For Nix, I am working on [twist](https://github.com/emacs-twist/) project for a finer-grained control of package sources. Even with this, one may fail to convince the management, and in that case, he/she must stop using Emacs or quit the company.

I'm not concerned realistically about the security bit. I'll have it wrapped tightly in a container, firewall, whatever. I can work with it if they O.K. it. And yes, the conversations i've had around here... i make good use of `doctor`. :)

I would be very happy if I could get my organization to be forward looking enough to let me give nix/guix a try... we are security paranoid and it's crippling.

So, I am working for you. Would you rather me be at 100% or 50% (if not even less) efficiency. You can tell them, I will survive without Emacs, but don't expect me to do my work quickly. If you care at all for how fast I work (realistically this should be one of their primary concerns), you should allow me to choose the tool I want.

Let me know how it works. I got emacs at work because I'm in charge of the SW environment, so I don't need to ask anybody else... otherwise I don't know how that battle could have gone.

My stock response to this nonsense has always been "I use the tools that best enable me to contribute to the revenue stream." The security folks are usually too dim to understand the reasoning but management is not: "security" is usually a cost center whereas "development" is a profit center. (I don't seriously believe any of this but have found it helpful to speak empty management platitudes on occasion.) Good luck.

I worked at a liberating company. I know mature companies tend to be more strict in security, and they may pay better. I think it is a trade-off. Actually I once worked for a project where installation of Emacs was not allowed at all. I used Eclipse, as all the other people at the project were doing, and I left the project in half year. I recognize myself as a coder who is good at finding bugs which an average person would give up on solving, and Emacs is crucial for it. If there were no demand for the skill, I might do without Emacs, which would make me less happy, but is still an option.

> Any real professional with some significant experience is aware how powerful emacs is This is not my experience at all. Almost everyone I've worked with who hasn't used Emacs has weird ideas about what it's like and assume it's some very primitive simplistic editor like nano. They seem to assume that anyone using it is some sort of luddite who hasn't realized how helpful IDE features are, as they assume Emacs doesn't have them. This has even gone for vim users, who I've had smugly go on about some "powerful" feature of plugin they're using. Then I got them to show me it and was able to tell them I'd been doing that in Emacs since the early 90s. Go back 10 years and I literally had a vim user proudly show me how he could fuzzy match opening files in a project like I'd be impressed. I think the poster child for how utterly people don't understand is the [finally got my Emacs setup just how I like it](https://twitter.com/todbot/status/1264712641966010370/photo/1) memes, from people who don't seem to realize that most Emacs users use *fewer* keys than average, not more.

Which program has the longer list of CVE exploits, [emacs](https://www.cvedetails.com/vulnerability-list.php?vendor_id=72&product_id=741&page=1&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=21&sha=001be71c19fab6171046f0b812da8d1378e05f02) or [Visual Studio](https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=676&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=48&sha=d3dbd30d091998d183a2d797ad72c61173192238)? Emacs has 2 exploits with CVE score > 9, VS has 14. Emacs has zero exploits that were remote execution vulns, VS has 3. If opsec is the goal, you should be using emacs.

I don't know man, but maybe you should change your environment or make some drastic changes in life. I worked usually in places where 10% had phds in different fields and there were also many mathematicians on board. I know also of technologies that were impossible at that time according to NASA. The people i had contact with in IT used rather be a mixture of guiclickers and more hardcore guys. I also think that now tools like Linux, bash and other classic open source and Unix tools are much more present in mainstream tech now then let's say 10-20 years ago. Microsoft is even Linux foundation platinum partner and owns GitHub, so stuff really changed. I'm rather used to comments like "oh, your doing such low level pointer stuff like C? Wow! You do everything with the command line and have a window manager that you command with the keyboard? Wow!". At least where i live Linux(and now also macos) are very popular among it professionals on their private computers. Emacs is one of the flagship project of the gnu foundation and people with some experience had the occasion to experience other gnu tools in action. The last time i worked for somebody there was only one person that chose to use Windows instead of Linux. And he had also a lot of management duties, so it seemed that he needed Microsoft office and similar to run well and for real work he had docker and a terminal from which he logged into some Linux server. So i rather observed a transformation with time to the better here. Also since productivity in sideways development doubles every two years means that people are using better and better tools on average. So by logic tools like emacs or vim should become also more and more popular, since either they are good tools or that aren't. The lisp curse does not happen everywhere, but only here and there, either but chance or when some singularity is achieved and you use something like alien technology from the fourth millennium.

The other interesting thing here is that I feel like I could tackle a fix for most of the Emacs CVE exploits, i.e. ``` lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file. ``` Meanwhile, the VS exploits seem completely impenetrable to me, i.e. ``` The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability." ```

People looking for vulnerabilities won't be targeting Emacs though. It isn't widely used in the kind of settings (eg corporate) that give them the best returns.

I just can't understand why some people are so willing to sacrifice their employees' experience for reducing these phantom threats. There's a price to be paid for freedom, which includes insecurity. If there are more moving parts, more things can go wrong. But the ability to make choices one likes far outweighs these costs. Like, what's even the point of doing something if you are reduced to a piece of machinery without any capacity to exercise your will? It's not like anything humans create can have any goal that does not include humans. Maybe there's some negative selection that makes a minority of people who want this control for the sake of control more likely to get into the position of power.

If no one looks at the pinned code/package i see no real value in it.

>VS is licensed, which means that an enterprise can contract support and liability to the vendor. Emacs is not. Hmm, I don't know the EULA of VS, but I would be surprised if there is any liability of MS in case there should be a security hole in there. Most license agreements will exclude that. It is a common assumption that there is some kind of liability with a software vendor, but in reality there rarely is.

Ideally, *you* should review the source of every package you use, and you should review the diffs when you upgrade a package. Even if you do not, it is probably safer to use the same revision of the same package between multiple machines. If you use different revisions of the same package and don't know what version you are using, things will be more random.

The scissor analogy is great. I am stealing that. So ... you need to find a new analogy now, sorry.

Surely, if you do develepment you'll have a virtualisation engine. Just stick your Linux distribution on there and set up your working environment as you like it. My managed Win10 desktop in the office is just a bloated bootloader for my Linux system.

It is trivial to find a company to provide support for Enterprise VS install, which includes ensuring all security patches are installed. It is not trivial to find that for Emacs. If the enterprise suffers a loss due to a security patch not having been installed in a timely fashion, the service provider would have liability due to their failure to perform the contracted service of installing the patches. I don't mean that there's a liability attached for the inherent security of the product. However, shifting risk through service contracting is an important part of risk mitigation for large enterprises.

I fully agree with this. I imagine, however, that the most controversial part won't be emacs itself, but the 50+ packages that you use.

No probs. I'm happy for you to have it. I can pretty much have any emacs i want at work.

I would quote 1 Corinthians 13:11: "When I was a child, I spoke as a child, I understood as a child, I thought as a child; but when I became a man, I put away childish things and started to use emacs. " \-- From the New Gnu Translation

You need to answer in terms of \_value\_, thats all anyone uunderstands. IT is trying ot create value by limiting how much surface area they have to care about - if everyone in the org could get by with 3 applications total, their install effort is easy, their support surface is small .. profit! But you say .. why do DBAs need MySQL Workbench or some specialized DB browsder tool? Why do data warehouse folks use fat ETLs and analysis tools? Why use a screw when a hammer and nail will fasten things? Because you'r a specialist, and you want the right tools; You coudl use other tools, but your workflow will be improved anywhere from 10-50% (say, make a wild supportable estimate); also note its an open source tool with a long long history (maybe check if there have been security audits in the past on it.) Further, you coudl note that Emacs can leverage some of the vscode adjacent tools like LSP. And furth4er in fact, that Emacs can not only make more money for the org by making you more efficient, in case save money; randomly, I use the ztree-diff mode a tonne for comparing prod systems to preprod or deb, or to inside dockers from out, etc, to look for files that are different in one environem,tn or git branch to another, etc. Why bother using some random Windows costware rubbish, when open source Emacs will do the trick.. It can be a hard sell, and at least vscode has some Emacs-like modes if you get screwed :P

It is trivial to find a company that provides that service for Emacs as well. At least once you leave the MS bubble. Apart from that the CVEs for Emacs were a lot less critical than those for VS last time I checked. I was involved in IT security in the nuclear sector and that kind of "risk mitigation" is often extremely ineffective.... edit: at least as long as we are talking about the real IT security risk and not a legal risk, which seems to be the only kind of risk many care about. fun fact this night: openSSL has finally decided to disable unsafeLegacyNegotiation (RFC5746, CVE from 2009). Our IT is paying for a service that still uses the unsafe SSL negotiation (which allows man-in-the-middle attacks). So I guess whoever decided to buy in that insecure service can protect their pencil-pusher backside, but they are certainly not protecting our IT systems. BTW: in any critical infrastructure environment (nuclear, military, national security) this kind of oversight would not protect you from liability, as far as I know.

I would write them: According to [my tool choice workflow](https://karl-voit.at/2021/01/18/tool-choices/), GNU Emacs is the tool that supports my current work in the most efficient way in order to generate shareholder value for my employer. I'm happy to demonstrate the manifold advantages over Visual Studio if you would like to learn about it. (Alternatively: look at following video(s) for ...) OR (depending on your personal age/background, this won't work): In the recent 25 years in this business, I've witnessed peers using <list of hyped editors of the last decades that are not relevant any more today> while I was constantly able to optimize my workflows and personalized environment in GNU Emacs to a level Visual Studio will probably never reach until it is replaced by the new editor of choice according to followers of fashion of this kind. *Ceterum autem censeo* [*don't contribute anything relevant in web forums like Reddit only*](https://karl-voit.at/2020/10/23/avoid-web-forums)

### Keep my editor's name out of your fucking mouth the security team: "*It is about visual studio...*" ### Keep my editor's name out of your fucking mouth! the security team: "*okay..*" If you reply along the line "emacs is a better tool..", the reality is that the higher-ups can have excuses ditching you, just bc they are high-ups. It is just a company, not your parents. There are times when "fuck" is the only answer.

if `npm` or any other package manager can be use in your day to day, and they don't have any issue with that, then, point out the hypocrisy of caring about those 50+ packages

>I don't know whether visual studio code's is either is not. Not even more secure than `npm` or `pip`

Thank you for the clarification

Any practical benefits you had from switching from straight to your project? Some sort of comparison in the readme might be nice.

Thanks for your interest. Actually, it is not recommendable right now. It is really hard to use without knowledge of Nix, and it lacks documentation. Twist is about avoiding systems programming in Emacs Lisp and doing heavy-lifting in Nix. If you don't find a value in this, there probably won't be practical benefits. I don't consider straight.el *purely functional*, because it has states inside an Emacs session. One benefit of twist would be that its artifacts are stored in a centralized Nix store. If you have multiple profiles with the same revision set of packages, you only have to build them once.

I don't get really why a security team would care about software that is mostly offline tool? And if it's not the programm you develop that scare them because you can develop a dangerous network programm with every editor, I don't get how that's in their sphere. The security team should as much as possible just accept what people use and do in the company and what they do should be decided by the team leader or the boss in close discussion with the team of course, only in exceptions where this 2 requirement collide strongly they should tell you what you use. But I don't cope out to your main question, because you are more skilled in using emacs and are more productive, and because you maybe more easily can modify emacs to your needs than any other editor.

Yes I could see a weaker argument to not use emacs, just I don't get why that is related to a security team, but from other directions you could argue yes the productivity goes down short term if you force people to use it, but long term in the right condition it could go up. While it's much harder to make that argument when you tell people to stop using emacs.

I would imagine that the proprietary rate of visual study plugins are higher, so how would you trust black boxes from strangers? Opensource = higher chance for security it's harder to ship and if you use melpa and they would build in directly many lines of code to include a backdoor they would not accept it. Or first would ask you to explain what this code is supposed to do, and if you don't have a good reasonable answer accept (I wand to install rootkits on their pcs) it will not get accepted. Generally speaking Opensource has higher security, because with black boxes you have to blindly trust, and with unknown territority I will always assume the worst to be save... because I think that is a good practise to be more safe. Why would I give strangers the benefit of the doubt and put the burden of proof of insecurity on my side?

I'd reply that I *can* switch tools, but since I prefer Emacs I'd rather stick with it. And then try to understand what specifically makes it too insecure from their perspective. Honestly I'd probably just begrudgingly switch to VS and try to think of it as a chance to get proficient with that software. Flexibility isn't the worst thing in the world.

I mean ultimately while they may not see it this way, they're absolutely *not* doing their job if they are preventing other people from working. They are part of the business just like the developers and salespeople &c. As such they need to balance their own goals against other requirements. Ie. they need to make things as secure *as possible* given the reality that people need to do stuff. Obviously you can't say this directly to them, but I believe it is the correct frame of reference and may help you to find allies, perhaps in your management chain.

>edit: at least as long as we are talking about the real IT security risk and not a legal risk, which seems to be the only kind of risk many care about. From an audit perspective legal risk and IT risk are given equal weight. Now, we can discuss if that should be the case or not, and you and I may even agree on a point of view. But enterprises live in the world as it is, not as IT professionals would like it to be. As for firms that provide enterprise management for Emacs on the desktop . . . they really aren't pervasive. Nor do they have the reporting or dashboarding capabilities that leadership is looking for. Again, we can discuss if that should matter or not. But the reality is that VS installs can easily be monitored on pretty much ever standard enterprise ITSM dashboard for compliance. Emacs can't. That is a real consideration for large corporations regardless of if we think it should be or not.

I guess we agree on many points there :-) On thing that always bugs me though is IT managers (i.e. people who focus more in the legal side of this issue than on the technical one) compare proprietary MS based solutions with their perception of Linux/OSS as a hobbyists OS (much helped by many Linux focussed subs here on reddit, tbf). They have never worked with, or are even aware of professional Linux based IT solutions. Have you ever worked with, e.g., RHEL? They do cost license and support fees, but typically a lot less than MS licenses. Why do IT professionals have the mindset that it is OK to pay for MS, but if it's Linux it must be for free?

I don't think they do have that mindset. I'm an IT business consultant, not a technical consultant, and I tend to work in financial, health care, and energy spaces -- pretty conservative industries. I see loads of Linux and BSD installs. I actually noted that the issue is that Emacs isn't part of an enterprise install (at least that I'm aware of). You can install emacs on top of RHEL. But it isn't part of RHEL, it isn't covered by the RHEL support agreements, etc.

As a new user (learning webdev via the odin project) I'm enjoying learning all about emacs. My biggest worry is learning and loving emacs then getting a job where I'm not allowed to use it :( Curious how emacs is crucial for your process of bug hunting.