From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: Win32 GnuTLS DLL installer? Date: Fri, 22 Sep 2017 10:29:02 +0300 Message-ID: <83r2uzchtt.fsf@gnu.org> References: <87lgl9e4ji.fsf@lifelogs.com> <5e2a6b84f4051ba2d4d427200045c947.squirrel@cloud103.planethippo.com> <8760ccdt3g.fsf@lifelogs.com> <83mv5ods3n.fsf@gnu.org> <87zi9ocbae.fsf@lifelogs.com> <83fubgdm4y.fsf@gnu.org> <87vakcc5xn.fsf@lifelogs.com> <83a81odk0q.fsf@gnu.org> <87poakc4th.fsf@lifelogs.com> <838th7ewdg.fsf@gnu.org> <8760cbzr9n.fsf@russet.org.uk> Reply-To: Eli Zaretskii NNTP-Posting-Host: blaine.gmane.org X-Trace: blaine.gmane.org 1506065359 10257 195.159.176.226 (22 Sep 2017 07:29:19 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Fri, 22 Sep 2017 07:29:19 +0000 (UTC) Cc: tzz@lifelogs.com, emacs-devel@gnu.org To: phillip.lord@russet.org.uk (Phillip Lord) Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Fri Sep 22 09:29:15 2017 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dvIOe-0002Hw-To for ged-emacs-devel@m.gmane.org; Fri, 22 Sep 2017 09:29:13 +0200 Original-Received: from localhost ([::1]:57070 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dvIOl-0000VR-Th for ged-emacs-devel@m.gmane.org; Fri, 22 Sep 2017 03:29:19 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:60795) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dvIOd-0000UK-8C for emacs-devel@gnu.org; Fri, 22 Sep 2017 03:29:12 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dvIOa-0005q5-1Z for emacs-devel@gnu.org; Fri, 22 Sep 2017 03:29:11 -0400 Original-Received: from fencepost.gnu.org ([2001:4830:134:3::e]:50012) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dvIOZ-0005q0-Tr; Fri, 22 Sep 2017 03:29:07 -0400 Original-Received: from 84.94.185.246.cable.012.net.il ([84.94.185.246]:3483 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1dvIOZ-0005vd-6o; Fri, 22 Sep 2017 03:29:07 -0400 In-reply-to: <8760cbzr9n.fsf@russet.org.uk> (phillip.lord@russet.org.uk) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:218679 Archived-At: > From: phillip.lord@russet.org.uk (Phillip Lord) > Cc: Ted Zlatanov , emacs-devel@gnu.org > Date: Thu, 21 Sep 2017 22:16:36 +0100 > > > It may be the simplest, but are they good enough for a dedicated, > > security-related package? I'm not sure. E.g., do the MSYS2 people, > > who produce the DLLs which Phillip repackages, habitually run the test > > suite of those DLLs, and investigate every failure? > > Given that these are the DLLs than any user of Emacs is likely to update > their libgnutls from anyway, then this doesn't strike me as a major > problem. I mean, it's as good a solution as any. I'm quite ignorant about security issues, but one thing I did learn is that "as good solution as any" is usually not good enough for security-critical issues. I can tell that all the DLL binaries on the ezwinports site always pass their test suite, and all the test failures are looked into and fixed if the failures are real. That is why I generally update GnuTLS and other libraries relatively infrequently: it's a serious job that takes time and energy. If we are willing to disregard the QA in these libraries for the Windows users, then I submit that we should not consider seriously any security aspects of the Windows binaries. We are in effect leaving it to the users to discover the problems and report them.