@tfb @jameshowell given they don't publish those mails, I'll defer judgment for now. I would not be surprised if the mail does in fact address the concern, just not the way the reporters wanted.

@tfb @jameshowell I agree. If I open the file with 'less', there's no remote code execution; if I myself run 'git ls-files', then that's my problem. But if I have no idea what git even is, and just open a readme in emacs, I don't expect that to run any code. #emacs