From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: Storing sensitive data indefinitely in variables or buffers: Whether and how to fix? Date: Wed, 31 May 2023 15:56:48 +0300 Message-ID: <83bki0fylr.fsf@gnu.org> References: Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="30508"; mail-complaints-to="usenet@ciao.gmane.io" Cc: emacs-devel@gnu.org To: Jens Schmidt Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Wed May 31 14:57:10 2023 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1q4LO1-0007h9-1r for ged-emacs-devel@m.gmane-mx.org; Wed, 31 May 2023 14:57:09 +0200 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1q4LNK-0004cF-CG; Wed, 31 May 2023 08:56:26 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1q4LN8-0004N3-1F for emacs-devel@gnu.org; Wed, 31 May 2023 08:56:15 -0400 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1q4LN7-0007Fr-CU; Wed, 31 May 2023 08:56:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=References:Subject:In-Reply-To:To:From:Date: mime-version; bh=XfvHPdFLI0JMXUuF3GgWact0LEFX0YREWldH/9eBmAI=; b=rzVp0GPjloJ+ c4qzq9/3wMkCQ4q1XnGdxghfCf7xGuAAL/LafS4tumNz18eAjffDoHo7xVjd/EoqCOwnh5ym9QX5W JDUrDvdgxWciTtM0O97s1eKZC1HJcGeJDV3QdsDUcf0aLCGUz7/h401hvyo/hFRL6GW6Jlx7IX8j+ xBbAF2Kwy8sMcJYpj81Nbpoq/yo5ExKHEpdSlVWNRccALmBx+2bd/wkR7C7QPZN+iPIj8qFYcsMd4 S168ZJ/RCIY3dHTTb7utDKpbjBbY97KvFFtnBIIvqo30oYL14khX8QydFj+z4hUNXAP9g8JwYCBp/ js5qGhjY4SOFzto5Jv5dFg==; Original-Received: from [87.69.77.57] (helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1q4LMy-0001V6-Jf; Wed, 31 May 2023 08:56:09 -0400 In-Reply-To: (message from Jens Schmidt on Tue, 30 May 2023 23:25:32 +0200) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.devel:306442 Archived-At: > Date: Tue, 30 May 2023 23:25:32 +0200 > From: Jens Schmidt > > plstore.el stores clear-text sensitive data in a number of places in a > running emacs without automatically expiring it as, for example, > password-cache does. > > 1. As usually, fixing these decreases convenience. Is that OK? In general, if the inconvenience is significant, it is best to make the feature opt-in. Even if we do make it ON by default, there should be a way of getting back old behavior, and that way should be documented in NEWS. > 2. Is fixing these considered a bug (relevant for emacs-29) even if it > involves a bit more effort, possibly even new functions and > variables? No, this is not a "bugfix" in terms applicable to the emacs-29 branch. These changes should go to master. Thanks.