18

I am trying to install dired+ from MELPA but it seems that it no longer is listed. I also checked here: https://melpa.org/

Is this normal?

Improve this question
2
  • I'd like to piggy-back two follow-up questions primarily for @Drew, but for others also : 1) Is there a mechanism to be apprised of ?(important )updates to your emacswiki packages? 2) Do you have and could you share a ?(partial )list of the 'locked' emacswiki packages?
    – user1404316
    Commented Feb 9, 2018 at 15:07
  • @user1404316 I suggest you open a new question for that.
    – Basil
    Commented Feb 27, 2018 at 15:05

3 Answers 3

Reset to default
12

It is true that MELPA no longer pulls libraries from EmacsWiki.

Please obtain Dired+ and other libraries by me from EmacsWiki: dired+.el.

All of my pages on EmacsWiki are locked (they require a site administrator to unlock them). There has never been an actual security problem reported, AFAIK.

Yes, it is true that a locked web page does not present the same level of security as a digital signature (such as is used for GIT). On the other hand, the fact that some code is digitally signed and pulled from a GIT repository is no guarantee at all that the code is not malicious or accidentally harmful.

(Here's a thought: If someone did want to propagate poison code, do you think they would prefer to do so from EmacsWiki, which has few downloads, or from a site like MELPA, which has many times more? From a site where you need to fiddle a bit to download and "install" a library, or from a site where you can do that willy-nilly and quickly, without thought or effort?)

If you obtain one of my libraries elsewhere than from EmacsWiki, including from https://github.com/emacsmirror/, then you will get an old version that doesn't benefit from maintenance (bug fixes, enhancements). The version of dired+.el that is on that mirror dates from November 2017. The version on EmacsWiki dates from January 2018. And I'm not even sure that that mirror will continue to be updated at all from now on.

[Library highlight.el is now available also from a new GitHub mirror, here. The maintainer of that mirror will keep it up-to-date, to reflect the latest version from the wiki.]

Improve this answer
13
  • 2
    Care to explain the downvote?
    – Drew
    Commented Feb 2, 2018 at 20:57
  • If it wasn't you, then perhaps we were both struck by the same phantom downvoter. :) I've tweaked the wording in my answer to make it more objective, as I know next to nothing about EmacsWiki and its security policy.
    – Basil
    Commented Feb 2, 2018 at 21:22
  • (IOW, I never intended to make a claim on its security from personal authority.)
    – Basil
    Commented Feb 2, 2018 at 21:28
  • FWIW In the case of EmacsWiki packages other than yours (Drew's) there was an actual security issue, since the pages were (and still are) globally editable. For instance it seems that if I wanted to, I could edit ac-dabbrev or goto-chg without any problems, even though I'm not an author or contributor to these libraries. Since packages are automatically pulled by MELPA, malicious changes would have been easily propagated to any users who upgraded their packages.
    – aplaice
    Commented Feb 2, 2018 at 23:54
  • 1
    @aplaice: Yes, agreed. But MELPA maintainers were aware of that difference. Note too that there are plenty of places, including emacs.SE! and useful blogs, where people copy code that they then use in their init files and such. Many such places are about as much a security risk as are the non-locked Emacs Wiki pages. I'd be willing to bet that some of those who are behind keeping wiki code out of MELPA post such clippable code that others then copy+paste. ;-)
    – Drew
    Commented Feb 3, 2018 at 0:11
8

Is this normal?

Yes, MELPA recently updated its policy and no longer includes packages hosted on EmacsWiki, quoting security reasons: https://github.com/melpa/melpa/pull/5008. See also Drew's answer.

For now you will have to install it either from its upstream EmacsWiki source at https://www.emacswiki.org/emacs/dired%2b.el or from its (potentially outdated) Emacsmirror clone at https://github.com/emacsmirror/dired-plus.

Improve this answer
1

You can install it using el-get. What worked for me, step by step:

  1. Tried installing el-get from melpa, then ran into all kinds of weirdnesses, e.g. 1982.

  2. So I opted for the basic setup by adding to my ~/.emacs:

    (add-to-list 'load-path "~/.emacs.d/el-get/el-get")
(unless (require 'el-get nil 'noerror)
  (with-current-buffer
      (url-retrieve-synchronously
      "https://raw.githubusercontent.com/dimitri/el-get/master/el-get-install.el")
    (goto-char (point-max))
    (eval-print-last-sexp)))
(add-to-list 'el-get-recipe-path "~/.emacs.d/el-get-user/recipes")
(el-get 'sync)

  3. Restarted Emacs.

  4. M-x el-get-emacswiki-build-local-recipes

  5. M-x el-get-install dired+

  6. Added to my ~/.emacs:

    (require 'dired+)

To update the package: M-x el-get-update dired+

Improve this answer
1
  • As of December 2022 this is still valid. el-get is still quite remarkable.
    – gsl
    Commented Dec 13, 2022 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.