From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.devel Subject: Re: Network security manager Date: Mon, 17 Nov 2014 13:06:04 -0500 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <871tp1k8hf.fsf@lifelogs.com> References: <87wq6uj5gt.fsf@lifelogs.com> <87k32tkh1x.fsf@lifelogs.com> <87fvdhkgtf.fsf@lifelogs.com> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1416247583 21086 80.91.229.3 (17 Nov 2014 18:06:23 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 17 Nov 2014 18:06:23 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Mon Nov 17 19:06:17 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1XqQgq-0008OT-JL for ged-emacs-devel@m.gmane.org; Mon, 17 Nov 2014 19:06:16 +0100 Original-Received: from localhost ([::1]:49555 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XqQgq-0007i3-55 for ged-emacs-devel@m.gmane.org; Mon, 17 Nov 2014 13:06:16 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:57778) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XqQgY-0007gQ-7z for emacs-devel@gnu.org; Mon, 17 Nov 2014 13:06:03 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XqQgT-0002D0-3b for emacs-devel@gnu.org; Mon, 17 Nov 2014 13:05:58 -0500 Original-Received: from plane.gmane.org ([80.91.229.3]:52124) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XqQgS-0002Cw-MX for emacs-devel@gnu.org; Mon, 17 Nov 2014 13:05:52 -0500 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1XqQgR-0008B4-8B for emacs-devel@gnu.org; Mon, 17 Nov 2014 19:05:51 +0100 Original-Received: from c-98-229-61-72.hsd1.ma.comcast.net ([98.229.61.72]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 17 Nov 2014 19:05:51 +0100 Original-Received: from tzz by c-98-229-61-72.hsd1.ma.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 17 Nov 2014 19:05:51 +0100 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 39 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: c-98-229-61-72.hsd1.ma.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never User-Agent: Gnus/5.130012 (Ma Gnus v0.12) Emacs/25.0.50 (gnu/linux) Cancel-Lock: sha1:P/WrgB416swZV+GvZIpEi7l7Lkw= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.229.3 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:177466 Archived-At: On Mon, 17 Nov 2014 12:31:35 -0500 Stefan Monnier wrote: TZ> I don't know how complicated it will be internally, but I don't think it TZ> will endanger any existing functionality (except TLS connections, of TZ> course). The only reason for it in 24.x is to add reasonable certificate TZ> handling so we can turn on certificate verification by default. I don't TZ> think it can be done otherwise without seriously damaging the user TZ> experience. SM> The issue is that if we have a 24.5 release, I want a very short pretest SM> phase, so such changes need to be "obviously safe". SM> One way to do that can be to make the changes conditional on some config SM> var, which stays disabled by default. So random users will use the old SM> code and those who care about security can enable it at the risk of SM> helping us fix bugs. I'd rather not ship with security disabled by default. That's exactly the situation we have now, just swept into a different corner. If fixing it is too risky then we put out an insecure 24.5 and 25.1 will be the first release to manage certificates and verify them by default. This is no worse than the current 24.x situation. It seems this is acceptable to everyone so far. I would have preferred to avoid that situation but the fault is mostly mine for leaving this unfinished for so long. >> BTW, I proposed using emacs-24 3 weeks ago in the thread "removing SSLv3 >> support by default from the Emacs GnuTLS integration (was: Bug#766395: >> emacs/gnus: Uses s_client to for SSL.)" you can find here >> https://lists.gnu.org/archive/html/emacs-devel/2014-10/msg00936.html SM> I don't know the underlying issues well enough. But it doesn't sound SM> "obviously safe" either. I'd rather just follow gnutls's own defaults. We are. Ted