* bug#18600: 24.3.94; EWW fails to check https certificates
@ 2014-10-02 5:48 Mark H Weaver
2014-10-03 23:01 ` Glenn Morris
2014-11-23 17:10 ` Lars Magne Ingebrigtsen
0 siblings, 2 replies; 9+ messages in thread
From: Mark H Weaver @ 2014-10-02 5:48 UTC (permalink / raw)
To: 18600
I used EWW to visit an https website that uses a self-signed and
long-expired https certificate. It failed to notify me of any problem.
In GNU Emacs 24.3.94.1 (i686-pc-linux-gnu, GTK+ Version 3.10.1)
of 2014-10-02 on localhost
Windowing system distributor `The X.Org Foundation', version 11.0.11202000
Configured using:
`configure
CONFIG_SHELL=/gnu/store/wgvrj5q40prd4d1fb0j81n6gxdpqwz79-bash-4.3.27/bin/bash
SHELL=/gnu/store/wgvrj5q40prd4d1fb0j81n6gxdpqwz79-bash-4.3.27/bin/bash
--prefix=/gnu/store/6x3z5nwya75jgfs76qkpj25va9iwsqd4-emacs-24.3.94
--enable-fast-install
--with-crt-dir=/gnu/store/1zxdnj48g45pwram0s8nprvkkwxzp62b-glibc-2.20/lib'
Important settings:
value of $LC_ALL: en_US.UTF-8
locale-coding-system: utf-8-unix
Major mode: Summary
Minor modes in effect:
shell-dirtrack-mode: t
diff-auto-refine-mode: t
tooltip-mode: t
electric-indent-mode: t
mouse-wheel-mode: t
menu-bar-mode: t
file-name-shadow-mode: t
global-font-lock-mode: t
font-lock-mode: t
blink-cursor-mode: t
auto-composition-mode: t
auto-encryption-mode: t
auto-compression-mode: t
buffer-read-only: t
line-number-mode: t
Recent input:
[removed; irrelevant]
Recent messages:
[removed; irrelevant]
Load-path shadows:
None found.
Features:
(shadow term ehelp emacsbug sendmail sort gnus-cite mail-extr gnus-async
gnus-bcklg qp gnus-ml disp-table nndraft nnmh nnfolder netrc gnus-agent
gnus-srvr gnus-score score-mode nnvirtual gnus-msg gnus-art mm-uu
mml2015 epg-config mm-view mml-smime smime dig nntp gnus-cache gnus-sum
nnoo gnus-group gnus-undo nnmail mail-source gnus-start gnus-spec
gnus-int gnus-range gnus-win misearch multi-isearch gnutls shr-color
color timezone parse-time help-mode mule-util url-queue network-stream
starttls url-http tls url-gw url-cache url-auth eww mm-url gnus gnus-ems
nnheader wid-edit url url-proxy url-privacy url-expand url-methods
url-history url-cookie url-domsuf url-util url-parse auth-source eieio
byte-opt bytecomp byte-compile cconv eieio-core gnus-util password-cache
url-vars mailcap shr browse-url shell pcomplete comint ansi-color
paredit edmacro kmacro cl-loaddefs cl-lib server w3m-wget w3m-load
magit-bisect magit-key-mode magit diff-mode log-edit easy-mmode message
format-spec rfc822 mml easymenu mml-sec mm-decode mm-bodies mm-encode
mail-parse rfc2231 rfc2047 rfc2045 ietf-drums mm-util help-fns
mail-prsvr mailabbrev mail-utils gmm-utils mailheader ring pcvs-util
add-log geiser-install geiser scheme time-date tooltip electric uniquify
ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd tool-bar dnd
fontset image regexp-opt fringe tabulated-list newcomment lisp-mode
prog-mode register page menu-bar rfn-eshadow timer select scroll-bar
mouse jit-lock font-lock syntax facemenu font-core frame cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
minibuffer nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote make-network-process
dbusbind gfilenotify dynamic-setting system-font-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)
Memory information:
((conses 8 389222 31229)
(symbols 24 32379 0)
(miscs 20 195 588)
(strings 16 51077 6316)
(string-bytes 1 1780492)
(vectors 8 25575)
(vector-slots 4 590009 18268)
(floats 8 413 443)
(intervals 28 3719 319)
(buffers 512 28)
(heap 1024 44807 14554))
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-02 5:48 bug#18600: 24.3.94; EWW fails to check https certificates Mark H Weaver
@ 2014-10-03 23:01 ` Glenn Morris
2014-10-03 23:44 ` Glenn Morris
2014-10-04 21:34 ` Ted Zlatanov
2014-11-23 17:10 ` Lars Magne Ingebrigtsen
1 sibling, 2 replies; 9+ messages in thread
From: Glenn Morris @ 2014-10-03 23:01 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 18600
Mark H Weaver wrote:
> I used EWW to visit an https website that uses a self-signed and
> long-expired https certificate. It failed to notify me of any problem.
Setting gnutls-verify-error non-nil may help (I don't know what it does
with self-signed certificates).
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-03 23:01 ` Glenn Morris
@ 2014-10-03 23:44 ` Glenn Morris
2014-10-04 21:34 ` Ted Zlatanov
1 sibling, 0 replies; 9+ messages in thread
From: Glenn Morris @ 2014-10-03 23:44 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 18600
PS see previous discussion in http://debbugs.gnu.org/16978 .
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-03 23:01 ` Glenn Morris
2014-10-03 23:44 ` Glenn Morris
@ 2014-10-04 21:34 ` Ted Zlatanov
2014-10-04 23:24 ` Mark H Weaver
2014-10-05 2:16 ` Glenn Morris
1 sibling, 2 replies; 9+ messages in thread
From: Ted Zlatanov @ 2014-10-04 21:34 UTC (permalink / raw)
To: Glenn Morris; +Cc: 18600, Mark H Weaver
On Fri, 03 Oct 2014 19:01:42 -0400 Glenn Morris <rgm@gnu.org> wrote:
GM> Mark H Weaver wrote:
>> I used EWW to visit an https website that uses a self-signed and
>> long-expired https certificate. It failed to notify me of any problem.
GM> Setting gnutls-verify-error non-nil may help (I don't know what it does
GM> with self-signed certificates).
Emacs will reject such certificates then. I tested that as part of
http://debbugs.gnu.org/16978 and would appreciate Mark's verification.
After 24.4 (now 25.1) is released it will be t by default. Mark, can we
close this bug since http://debbugs.gnu.org/16978 already has all the info?
Thanks
Ted
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-04 21:34 ` Ted Zlatanov
@ 2014-10-04 23:24 ` Mark H Weaver
2014-10-05 2:00 ` Stefan Monnier
2014-10-05 2:16 ` Glenn Morris
1 sibling, 1 reply; 9+ messages in thread
From: Mark H Weaver @ 2014-10-04 23:24 UTC (permalink / raw)
To: Glenn Morris; +Cc: 18600
Ted Zlatanov <tzz@lifelogs.com> writes:
> On Fri, 03 Oct 2014 19:01:42 -0400 Glenn Morris <rgm@gnu.org> wrote:
>
> GM> Mark H Weaver wrote:
>>> I used EWW to visit an https website that uses a self-signed and
>>> long-expired https certificate. It failed to notify me of any problem.
>
> GM> Setting gnutls-verify-error non-nil may help (I don't know what it does
> GM> with self-signed certificates).
>
> Emacs will reject such certificates then. I tested that as part of
> http://debbugs.gnu.org/16978 and would appreciate Mark's verification.
Yes, that works, thanks.
> After 24.4 (now 25.1) is released it will be t by default. Mark, can we
> close this bug since http://debbugs.gnu.org/16978 already has all the info?
I almost closed the bug myself, but on second thought I think this case
of eww https warrants special consideration, independent of the more
general question of how 'open-gnutls-stream' should behave by default.
There are a few reasons for this:
1. In the case of imaps, smtps, xmpp, etc, the most common use case is
to connect to a single server only for each of these protocols, and
very often that's one's own server with self-signed certs.
2. In the case of https, the typical use cases are very different, as
are the expectations. When browsing the web, one typically talks to
a very large number of https servers. More often than not, these
servers have certificates signed by a well-known CA. (Ideally it
should be possible to disable checking based on URL).
3. Emacs 24.4 will be the first release that includes eww, so there are
no preexisting users of eww that would be annoyed by suddenly having
their existing functionality stop working.
With these in mind, I have two recommendations:
* I believe that eww https should check certificates by default in 24.4,
even though other tls connections are tolerant by default.
* At minimum, it should be possible to enable certificate checking for
eww https connections while still allowing self-signed certificates
for other uses of 'open-gnutls-stream' such as imaps and smtps. This
is fairly common case.
IMO, anyway. If you disagree, I'll defer to your judgment, but my
feeling is that the current behavior would not be well received.
Thanks,
Mark
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-04 23:24 ` Mark H Weaver
@ 2014-10-05 2:00 ` Stefan Monnier
2014-10-05 17:17 ` Mark H Weaver
0 siblings, 1 reply; 9+ messages in thread
From: Stefan Monnier @ 2014-10-05 2:00 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 18600
> With these in mind, I have two recommendations:
> * I believe that eww https should check certificates by default in 24.4,
> even though other tls connections are tolerant by default.
> * At minimum, it should be possible to enable certificate checking for
> eww https connections while still allowing self-signed certificates
> for other uses of 'open-gnutls-stream' such as imaps and smtps. This
> is fairly common case.
I think it's too late to do that for Emacs-24.4. But we should apply
such a change to `emacs-24' after the 24.4 release, so that it will be
included in the next release regardless if the next release is 25.1 or
a 24.5 bugfix.
Stefan
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-04 21:34 ` Ted Zlatanov
2014-10-04 23:24 ` Mark H Weaver
@ 2014-10-05 2:16 ` Glenn Morris
1 sibling, 0 replies; 9+ messages in thread
From: Glenn Morris @ 2014-10-05 2:16 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 18600
Ted Zlatanov wrote:
> close this bug since http://debbugs.gnu.org/16978 already has all the info?
They are merged.
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-05 2:00 ` Stefan Monnier
@ 2014-10-05 17:17 ` Mark H Weaver
0 siblings, 0 replies; 9+ messages in thread
From: Mark H Weaver @ 2014-10-05 17:17 UTC (permalink / raw)
To: Stefan Monnier; +Cc: 18600
Stefan Monnier <monnier@iro.umontreal.ca> writes:
>> With these in mind, I have two recommendations:
>> * I believe that eww https should check certificates by default in 24.4,
>> even though other tls connections are tolerant by default.
>> * At minimum, it should be possible to enable certificate checking for
>> eww https connections while still allowing self-signed certificates
>> for other uses of 'open-gnutls-stream' such as imaps and smtps. This
>> is fairly common case.
>
> I think it's too late to do that for Emacs-24.4. But we should apply
> such a change to `emacs-24' after the 24.4 release, so that it will be
> included in the next release regardless if the next release is 25.1 or
> a 24.5 bugfix.
I continue to think this will be ill-received, and could result in more
bad PR for the GNU Project, but having said that, I'll let it go now.
Thanks,
Mark
^ permalink raw reply [flat|nested] 9+ messages in thread
* bug#18600: 24.3.94; EWW fails to check https certificates
2014-10-02 5:48 bug#18600: 24.3.94; EWW fails to check https certificates Mark H Weaver
2014-10-03 23:01 ` Glenn Morris
@ 2014-11-23 17:10 ` Lars Magne Ingebrigtsen
1 sibling, 0 replies; 9+ messages in thread
From: Lars Magne Ingebrigtsen @ 2014-11-23 17:10 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 18600
This has now been fixed on the trunk with the Network Security Manager
stuff.
--
(domestic pets only, the antidote for overdose, milk.)
bloggy blog: http://lars.ingebrigtsen.no
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2014-11-23 17:10 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-02 5:48 bug#18600: 24.3.94; EWW fails to check https certificates Mark H Weaver
2014-10-03 23:01 ` Glenn Morris
2014-10-03 23:44 ` Glenn Morris
2014-10-04 21:34 ` Ted Zlatanov
2014-10-04 23:24 ` Mark H Weaver
2014-10-05 2:00 ` Stefan Monnier
2014-10-05 17:17 ` Mark H Weaver
2014-10-05 2:16 ` Glenn Morris
2014-11-23 17:10 ` Lars Magne Ingebrigtsen
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).