From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking. Date: Wed, 08 Oct 2014 16:17:10 +0300 Message-ID: <83bnpmk8fd.fsf@gnu.org> References: <1412716565-7786-1-git-send-email-toke@toke.dk> <87a957o87z.fsf@alrua-karlstad.karlstad.toke.dk> <87bnpm2249.fsf@toke.dk> <83eguik9ip.fsf@gnu.org> <83d2a2k91n.fsf@gnu.org> Reply-To: Eli Zaretskii NNTP-Posting-Host: plane.gmane.org X-Trace: ger.gmane.org 1412774250 1575 80.91.229.3 (8 Oct 2014 13:17:30 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 8 Oct 2014 13:17:30 +0000 (UTC) Cc: tzz@lifelogs.com, toke@toke.dk, emacs-devel@gnu.org To: Lars Magne Ingebrigtsen Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Oct 08 15:17:22 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Xbr7K-0007NY-BZ for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 15:17:22 +0200 Original-Received: from localhost ([::1]:36179 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xbr7J-0005BI-Uo for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 09:17:21 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:53709) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xbr73-0005B1-5W for emacs-devel@gnu.org; Wed, 08 Oct 2014 09:17:10 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Xbr6x-000230-3a for emacs-devel@gnu.org; Wed, 08 Oct 2014 09:17:05 -0400 Original-Received: from mtaout20.012.net.il ([80.179.55.166]:35573) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xbr6w-00022a-Rk for emacs-devel@gnu.org; Wed, 08 Oct 2014 09:16:59 -0400 Original-Received: from conversion-daemon.a-mtaout20.012.net.il by a-mtaout20.012.net.il (HyperSendmail v2007.08) id <0ND400L00NHAFR00@a-mtaout20.012.net.il> for emacs-devel@gnu.org; Wed, 08 Oct 2014 16:16:57 +0300 (IDT) Original-Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il (HyperSendmail v2007.08) with ESMTPA id <0ND400LK8NK8AP60@a-mtaout20.012.net.il>; Wed, 08 Oct 2014 16:16:57 +0300 (IDT) In-reply-to: X-012-Sender: halo1@inter.net.il X-detected-operating-system: by eggs.gnu.org: Solaris 10 X-Received-From: 80.179.55.166 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:175125 Archived-At: > From: Lars Magne Ingebrigtsen > Cc: toke@toke.dk, tzz@lifelogs.com, emacs-devel@gnu.org > Date: Wed, 08 Oct 2014 15:06:52 +0200 > > Eli Zaretskii writes: > > > How can it return a valid descriptor without all the validations it > > does before that, which (AFAIU) you want to delegate to Lisp now? > > It would validate the certificate, but never drop the connection even if > the certificate is invalid. It would be up to `open-network-stream' to > close the connection if the user decides to not accept the invalid (or > self-signed) certificate. So you want to return a descriptor for a connection that failed certificate validation, and let the application handle that? That could work, but I don't know what security-wary people here will tell about keeping such connections.