box_source() makes me uncomfortable

[ijlyttle]

box_source() seems like a way to facilitate a security breach, given the possibility that the remote file may not be secured.

Thinking SQL injection, but using files.

If it were only me, I would consider a fast-track to deprecation (not to be considered before 0.3.6 release).

Are there users?

Thoughts?

[nathancday]

I think of it as a shortcut for the use case of sourcing shared code. Sure you can source bad things, but I don't think sourcing itself is bad.

I'm not opposed to leaving this up to see if any users find it. Maybe we put a questioning tag on it in 3.6?

[ijlyttle]

For me, the danger is that the code that seems too easy for the "sourced" code to change without the person running box_source() knowing about it.

That said, I am all for the "questioning" tag.