From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Vasilij Schneidermann Newsgroups: gmane.emacs.devel Subject: Enforcing TLS for GNU ELPA Date: Tue, 20 Oct 2020 00:10:20 +0200 Message-ID: <20201019221020.GD1842@odonien.localdomain> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="6WlEvdN9Dv0WHSBl" Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="38025"; mail-complaints-to="usenet@ciao.gmane.io" To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Tue Oct 20 00:11:07 2020 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kUdMw-0009nB-R4 for ged-emacs-devel@m.gmane-mx.org; Tue, 20 Oct 2020 00:11:06 +0200 Original-Received: from localhost ([::1]:45942 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kUdMv-0004kQ-QQ for ged-emacs-devel@m.gmane-mx.org; Mon, 19 Oct 2020 18:11:05 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:55374) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kUdMO-0004Eu-JB for emacs-devel@gnu.org; Mon, 19 Oct 2020 18:10:32 -0400 Original-Received: from mout-p-101.mailbox.org ([2001:67c:2050::465:101]:35568) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_CHACHA20_POLY1305:256) (Exim 4.90_1) (envelope-from ) id 1kUdML-00088M-81 for emacs-devel@gnu.org; Mon, 19 Oct 2020 18:10:31 -0400 Original-Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:105:465:1:1:0]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-101.mailbox.org (Postfix) with ESMTPS id 4CFWCh2PxKzKmXH for ; Tue, 20 Oct 2020 00:10:24 +0200 (CEST) X-Virus-Scanned: amavisd-new at heinlein-support.de Original-Received: from smtp1.mailbox.org ([80.241.60.240]) by spamfilter03.heinlein-hosting.de (spamfilter03.heinlein-hosting.de [80.241.56.117]) (amavisd-new, port 10030) with ESMTP id c-NOyYrfxIMl for ; Tue, 20 Oct 2020 00:10:21 +0200 (CEST) Mail-Followup-To: emacs-devel@gnu.org Content-Disposition: inline X-Rspamd-Score: -6.13 / 15.00 / 15.00 X-Rspamd-Queue-Id: 6109D17E6 X-Rspamd-UID: 5ea909 Received-SPF: pass client-ip=2001:67c:2050::465:101; envelope-from=mail@vasilij.de; helo=mout-p-101.mailbox.org X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.io gmane.emacs.devel:258151 Archived-At: --6WlEvdN9Dv0WHSBl Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Some time ago I've contributed a change to a certain package repository's webserver setup that responds to http:// requests with a 301 redirect to the https:// version. Should the same be done for GNU ELPA? Why/why not? Some data points for the "why not" faction I've discovered after that change: - There's still Windows users who do not have an installation with the gnutls libraries, despite the strong suggestion to download it for the full experience. - Emacs versions below 26.1 are affected by a HTTPS proxy bug [1] that makes life in corporate environments hard. - The initializer of `package-archives` already generates the appropriate URL, so this will affect people who have redefined that variable and break their setup for no reason. --6WlEvdN9Dv0WHSBl Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEE0dAcySl3bqM8O17WFmfJg6zCifoFAl+ODsIACgkQFmfJg6zC ifpNCwgAm3s8tMIQ5lN+K8Dva2WcpKHy38VLilQfLmZeaP2Y46hFtgKVc/7arAMm pZJQogfL9t+RF1yTX/rURFNZJDkyHw3KSjC5ws/QsiZrX3XWibcAaV1wYRuqOp/0 vm2+/gJdQPCFQM41AamXVRPk6rnrUzNLIvwf7tEkgmoS7FcUW9lieUJGzcnbq+8Y Ptl/669NfpVXjubdyxIwGZ5EkjIU/f+q5Mp4OPdDtX0B4rWPJ8x0OZJFAmJ/zU5r OTLEAYrA/LmHPkr14O3hSIamWdlzuGhH5qHWKzMFk5AFfiXWB57TW8kdDSts0+ru Ah/MvnMKVrNOlIc/ZwywCJWVf6i9rg== =j8hp -----END PGP SIGNATURE----- --6WlEvdN9Dv0WHSBl--