auth-sources and EWW

auth-sources and EWW

[T.V Raman]

Of late, EWW appears to consult auth-sources whenever you open an
https URL.

Symptom: I encrypt  the files that hold  secrets used by auth-sources,
and I notice that whenever gpg-agent has timed out, opening an https
URL with EWW results in gpg prompting for the password to unlock
auth-sources 

-- 
♉ Id: kg:/m/0285kf1  🦮

-- 
♉ Id: kg:/m/0285kf1  🦮

Re: auth-sources and EWW

[Lars Ingebrigtsen]

"T.V Raman" <raman@google.com> writes:

> Of late, EWW appears to consult auth-sources whenever you open an
> https URL.

I'm unable to reproduce this.

Try

`M-x debug-on-entry RET auth-source-search RET'

and post the resulting backtrace.  That should tell us what's calling
auth-source.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Re: auth-sources and EWW

[Robert Pluim]

>>>>> On Fri, 18 Sep 2020 08:19:30 -0700 (PDT), "T.V Raman" <raman@google.com> said:

    TVR> Of late, EWW appears to consult auth-sources whenever you open an
    TVR> https URL.

    TVR> Symptom: I encrypt  the files that hold  secrets used by auth-sources,
    TVR> and I notice that whenever gpg-agent has timed out, opening an https
    TVR> URL with EWW results in gpg prompting for the password to unlock
    TVR> auth-sources 

There was a brief period where that would have been true because of
'network-stream-use-client-certificates' being t, but that was changed
to nil in November 2019.

Which version of emacs are you using?

Robert

Re: auth-sources and EWW

[T.V Raman]

Ah good catch.

My custom file had somehow grabbed that setting and set it to T, so
the default being nil was being overridden. Robert Pluim writes:
 > >>>>> On Fri, 18 Sep 2020 08:19:30 -0700 (PDT), "T.V Raman" <raman@google.com> said:
 > 
 >     TVR> Of late, EWW appears to consult auth-sources whenever you open an
 >     TVR> https URL.
 > 
 >     TVR> Symptom: I encrypt  the files that hold  secrets used by auth-sources,
 >     TVR> and I notice that whenever gpg-agent has timed out, opening an https
 >     TVR> URL with EWW results in gpg prompting for the password to unlock
 >     TVR> auth-sources 
 > 
 > There was a brief period where that would have been true because of
 > 'network-stream-use-client-certificates' being t, but that was changed
 > to nil in November 2019.
 > 
 > Which version of emacs are you using?
 > 
 > Robert

-- 
♉Id: kg:/m/0285kf1  🦮♉

--
♉Id: kg:/m/0285kf1  🦮♉

Re: auth-sources and EWW

[Robert Pluim]

>>>>> On Fri, 18 Sep 2020 08:41:49 -0700, "T.V Raman" <raman@google.com> said:

    TVR> Ah good catch.
    TVR> My custom file had somehow grabbed that setting and set it to T, so
    TVR> the default being nil was being overridden.

Just atoning for my sins in having set the default to t in the first
place :-)

Robert

Re: auth-sources and EWW

[T.V Raman]

This goes back to one of my biggest complaints re custom; once
something lands in there, it's well-nigh impossible to figure out what
to pull out when something like this bites, thanks again for saving me
a bunch of time with your tip!Robert Pluim writes:
 > >>>>> On Fri, 18 Sep 2020 08:41:49 -0700, "T.V Raman" <raman@google.com> said:
 > 
 >     TVR> Ah good catch.
 >     TVR> My custom file had somehow grabbed that setting and set it to T, so
 >     TVR> the default being nil was being overridden.
 > 
 > Just atoning for my sins in having set the default to t in the first
 > place :-)
 > 
 > Robert

-- 
♉Id: kg:/m/0285kf1  🦮♉

--
♉Id: kg:/m/0285kf1  🦮♉

Re: auth-sources and EWW

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > This goes back to one of my biggest complaints re custom; once
  > something lands in there, it's well-nigh impossible to figure out what
  > to pull out when something like this bites,

What is the difficulty in doing that?

If you know the name of the option, I'd expect it to be easy to find
the code for the custom setting, and delete that if you wish to.  Why
isn't this easy?

-- 
Dr Richard Stallman
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)

Re: auth-sources and EWW

[Tim Cross]

Richard Stallman <rms@gnu.org> writes:

> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
>   > This goes back to one of my biggest complaints re custom; once
>   > something lands in there, it's well-nigh impossible to figure out what
>   > to pull out when something like this bites,
>
> What is the difficulty in doing that?
>
> If you know the name of the option, I'd expect it to be easy to find
> the code for the custom setting, and delete that if you wish to.  Why
> isn't this easy?

The problem is you don't always know the name of the option. There has
been many times I've seen custom variables 'appear' in my custom section
when I've not customized them. Once you know the name of the option and
your willing to ignore the warning about not editing the section by
hand, removing the option is trivial. However, when you don't know the
name or are even aware there is a value set there, it isn't so easy.

As an example, I use elfeed to read blogs. I use org-elfeed to manage
the list of blogs I read. Recently I edited this file to remove some
blogs and add others. Some time later, I happened to view my custom file
and was surprised to see a list of elfeed related blog urls in there. I
don't know why they were in there and they haven't appeared there on
other times when I've edited my org-elfeed file. I do recall that during
that session, I did customise a completely unrelated variable and
suspect this may have been what triggered these other values being
added, but that is just a guess. I deleted the elfeed custom settings,
but if I had not, I do wonder what would have happened the next time I
tried to manage my elfeed urls via the org-elfeed file.

-- 
Tim Cross

Re: auth-sources and EWW

[T.V Raman]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=gb18030, Size: 924 bytes --]

Richard Stallman <rms@gnu.org> writes:

That's the problem, witness this cae:

The name of the option is far removed from the place where the symptom
manifests itself, you'd never make the connection unless you were very
close to the code.
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
>   > This goes back to one of my biggest complaints re custom; once
>   > something lands in there, it's well-nigh impossible to figure out what
>   > to pull out when something like this bites,
>
> What is the difficulty in doing that?
>
> If you know the name of the option, I'd expect it to be easy to find
> the code for the custom setting, and delete that if you wish to.  Why
> isn't this easy?

-- 
7©4 Id: kg:/m/0285kf1  •0Ü8

Re: auth-sources and EWW

[Robert Pluim]

>>>>> On Sat, 19 Sep 2020 07:20:24 -0700, "T.V Raman" <raman@google.com> said:

    TVR> That's the problem, witness this cae:

    TVR> The name of the option is far removed from the place where the symptom
    TVR> manifests itself, you'd never make the connection unless you were very
    TVR> close to the code.

??? "When I use the network, this undesirable thing happens. Do I have any
customizations with the word 'network' in them?" -> 'network-stream-use-client-certificates'

I donʼt think the evidence supports your argument in this case.

Robert

Re: auth-sources and EWW

[T.V Raman]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=gb18030, Size: 807 bytes --]

Robert Pluim <rpluim@gmail.com> writes:

Perhaps I'm completely cluelss as you assert --- but that said, Lars,
who wrote EWW also did not make the connection :-)
>>>>>> On Sat, 19 Sep 2020 07:20:24 -0700, "T.V Raman" <raman@google.com> said:
>
>     TVR> That's the problem, witness this cae:
>
>     TVR> The name of the option is far removed from the place where the symptom
>     TVR> manifests itself, you'd never make the connection unless you were very
>     TVR> close to the code.
>
> ??? "When I use the network, this undesirable thing happens. Do I have any
> customizations with the word 'network' in them?" -> 'network-stream-use-client-certificates'
>
> I don0¶3t think the evidence supports your argument in this case.
>
> Robert
>

-- 
7©4 Id: kg:/m/0285kf1  •0Ü8

Re: auth-sources and EWW

[Robert Pluim]

>>>>> On Mon, 21 Sep 2020 07:44:29 -0700, "T.V Raman" <raman@google.com> said:

    T> Robert Pluim <rpluim@gmail.com> writes:
    T> Perhaps I'm completely cluelss as you assert --- but that said, Lars,
    T> who wrote EWW also did not make the connection :-)

I asserted no such thing. Luckily Iʼm a forgiving person :-)

Re: auth-sources and EWW

[Tim Cross]

[-- Attachment #1: Type: text/plain, Size: 1342 bytes --]

On Mon, 21 Sep 2020 at 18:19, Robert Pluim <rpluim@gmail.com> wrote:

> >>>>> On Sat, 19 Sep 2020 07:20:24 -0700, "T.V Raman" <raman@google.com>
> said:
>
>     TVR> That's the problem, witness this cae:
>
>     TVR> The name of the option is far removed from the place where the
> symptom
>     TVR> manifests itself, you'd never make the connection unless you were
> very
>     TVR> close to the code.
>
> ??? "When I use the network, this undesirable thing happens. Do I have any
> customizations with the word 'network' in them?" ->
> 'network-stream-use-client-certificates'
>
> I donʼt think the evidence supports your argument in this case.
>
> I disagree. It wasn't as if Raman was getting a network error. He observed
that auth-sources was being consulted whenever he visited an https URL. If
I had noticed that behaviour, I would have looked for EWW settings and
possibly auth-source ones and may have eventually got to the point of
checking network options, but that would not have been the first place.

However, perhaps the key point to note here is that this was the user
experience of an Emacs user who has extensive Elisp knowledge and has been
using Emacs for around 30 years. What is the user experience for a new user
or a far less experienced user?


-- 
regards,

Tim

--
Tim Cross

[-- Attachment #2: Type: text/html, Size: 1995 bytes --]