From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: "Perry E. Metzger" Newsgroups: gmane.emacs.devel Subject: Re: A couple of questions and concerns about Emacs network security Date: Mon, 9 Jul 2018 20:06:40 -0400 Message-ID: <20180709200640.08cb8f34@jabberwock.cb.piermont.com> References: <83o9g2uhju.fsf@gnu.org> <20180705115826.73c1d95e@jabberwock.cb.piermont.com> <83a7r4n5ht.fsf@gnu.org> <87lgaoaf2f.fsf@gmail.com> <877em7o09z.fsf@gmail.com> <87r2kcmu7q.fsf@gmail.com> <83fu0sgwke.fsf@gnu.org> NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Trace: blaine.gmane.org 1531181221 18637 195.159.176.226 (10 Jul 2018 00:07:01 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Tue, 10 Jul 2018 00:07:01 +0000 (UTC) Cc: Eli Zaretskii , Paul Eggert , Lars Ingebrigtsen , rms@gnu.org, Emacs-Devel devel To: Jimmy Yuen Ho Wong Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Jul 10 02:06:57 2018 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fcgBE-0004jp-4b for ged-emacs-devel@m.gmane.org; Tue, 10 Jul 2018 02:06:56 +0200 Original-Received: from localhost ([::1]:45001 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fcgDI-000713-7e for ged-emacs-devel@m.gmane.org; Mon, 09 Jul 2018 20:09:04 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:37240) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fcgB5-0005UY-MT for emacs-devel@gnu.org; Mon, 09 Jul 2018 20:06:48 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fcgB3-0004C4-GS for emacs-devel@gnu.org; Mon, 09 Jul 2018 20:06:47 -0400 Original-Received: from hacklheber.piermont.com ([2001:470:30:84:e276:63ff:fe62:3400]:48242) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fcgAz-00049U-Bb; Mon, 09 Jul 2018 20:06:41 -0400 Original-Received: from snark.cb.piermont.com (localhost [127.0.0.1]) by hacklheber.piermont.com (Postfix) with ESMTP id 044C11FB; Mon, 9 Jul 2018 20:06:41 -0400 (EDT) Original-Received: from jabberwock.cb.piermont.com (jabberwock.cb.piermont.com [10.160.2.107]) by snark.cb.piermont.com (Postfix) with ESMTP id DFF8F2DEF07; Mon, 9 Jul 2018 20:06:40 -0400 (EDT) In-Reply-To: X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:470:30:84:e276:63ff:fe62:3400 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:227193 Archived-At: On Mon, 9 Jul 2018 18:24:03 +0100 Jimmy Yuen Ho Wong wrote: > On Mon, Jul 9, 2018 at 6:15 PM Eli Zaretskii wrote: > > > > > From: Lars Ingebrigtsen > > > Cc: Emacs-Devel devel , "Perry E. > > > Metzger" , Eli Zaretskii , > > > Paul Eggert , rms@gnu.org Date: Mon, 09 > > > Jul 2018 15:43:43 +0200 > > > > > > Jimmy Yuen Ho Wong writes: > > > > > > > I thought about this, but there's no standard that bans TLS > > > > 1.1, nor TLS client implementations that disabled it by > > > > default. Besides, all the problems TLS 1.1 has is already > > > > checked by the other checks. This reason I'm checking for TLS > > > > 1.0 is somewhat arbitrary, as all the problems it has is > > > > already checked by other checks too. So maybe even checking > > > > for 1.0 is already too strict, but PCI DSS does ban it, > > > > so... > > > > > > For those who don't understand security acronym soup, the > > > latter means "Payment Card Industry Data Security Standard". > > > > > > And I don't think that's the level we should be considering for > > > Emacs, even at the "high" level, because it's pretty... > > > excessive. Last time I checked. > > > > So maybe for 'paranoid'? > > Nooooooo...... enough with this 'paranoid business already :( > > As I've replied to Robert and a few others already, the checks I > have done is already multi-layered. Under normal circumtances, > warning for TLS 1.0 should already takes care of checking of CBC > mode ciphers/encrypt-then-MAC (if the server was configured > correctly when TLS 1.0 was in vogue), but I check both regardless. > The checks are already plenty paranoid without being crying-wolf > under a vast majority normal usage. I strongly agree. PCI compliance is an industry base/minimum. It's not paranoid. It's not even what I'd prefer -- it isn't nearly good enough on TLS standards, but it's fine. Perry -- Perry E. Metzger perry@piermont.com