From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: A couple of questions and concerns about Emacs network security Date: Fri, 06 Jul 2018 12:01:20 +0300 Message-ID: <83zhz4lov3.fsf@gnu.org> References: <83po0iuhs7.fsf@gnu.org> <83lgb4tg92.fsf@gnu.org> <83efgusvdw.fsf@gnu.org> NNTP-Posting-Host: blaine.gmane.org X-Trace: blaine.gmane.org 1530867605 23294 195.159.176.226 (6 Jul 2018 09:00:05 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Fri, 6 Jul 2018 09:00:05 +0000 (UTC) Cc: eggert@cs.ucla.edu, emacs-devel@gnu.org, wyuenho@gmail.com, npostavs@gmail.com To: larsi@gnus.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Fri Jul 06 11:00:00 2018 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fbMat-0005vN-9K for ged-emacs-devel@m.gmane.org; Fri, 06 Jul 2018 10:59:59 +0200 Original-Received: from localhost ([::1]:56456 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fbMd0-0005fj-D3 for ged-emacs-devel@m.gmane.org; Fri, 06 Jul 2018 05:02:10 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:34371) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fbMcF-0005fZ-Ut for emacs-devel@gnu.org; Fri, 06 Jul 2018 05:01:24 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fbMcB-0006fm-Ai for emacs-devel@gnu.org; Fri, 06 Jul 2018 05:01:24 -0400 Original-Received: from fencepost.gnu.org ([2001:4830:134:3::e]:44812) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fbMcB-0006ed-7R; Fri, 06 Jul 2018 05:01:19 -0400 Original-Received: from [176.228.60.248] (port=2663 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1fbMcA-0004Q0-Nj; Fri, 06 Jul 2018 05:01:19 -0400 In-reply-to: <83efgusvdw.fsf@gnu.org> (message from Eli Zaretskii on Mon, 25 Jun 2018 19:06:51 +0300) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:226990 Archived-At: Ping! > Date: Mon, 25 Jun 2018 19:06:51 +0300 > From: Eli Zaretskii > Cc: wyuenho@gmail.com, eggert@cs.ucla.edu, npostavs@gmail.com, > emacs-devel@gnu.org > > Allow me a few comments, with an eye towards getting at least some of > this to the emacs-26 branch: > > . First, the NEWS entry should tell users how to get the previous > (less secure) behavior if they want. I think this also calls for a > better documentation of the elements that can appear in > network-security-protocol-checks. > > . The change to gnutls-peer-status is not reflected in its doc string > and is not called out in NEWS. > > . Do I understand correctly that most of the changes, including those > in gnutls.c, are so that intermediary certificates could be > verified? If so, would it make sense to omit that for emacs-26, > and only beef up the medium level of security in NSM with the rest > of the checks? > >