[symtos]

> Quicklisp is de-facto the only widely used library manager in Common Lisp world, and so it’s written in Common Lisp and doesn’t have any tests. It’s a wonder for me how it’s not breaking!

Quicklisp also downloads and executes code over plain HTTP with no integrity checks whatsoever.

[sigjuice]

Yes, that is the default. But you could connect through an https proxy or check PGP signatures (see http://blog.quicklisp.org/2017/09/something-to-try-out-quick...).