From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.devel Subject: Re: Release-critical bugs Date: Wed, 24 Sep 2014 09:48:08 -0400 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87a95pnn8n.fsf@lifelogs.com> References: <87mw9yb2f8.fsf@engster.org> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1411566506 765 80.91.229.3 (24 Sep 2014 13:48:26 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 24 Sep 2014 13:48:26 +0000 (UTC) Cc: Eric Abrahamsen , Daiki Ueno , Jens Lechtenboerger , Juliusz Chroboczek To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Sep 24 15:48:21 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1XWmvY-0001SW-Ii for ged-emacs-devel@m.gmane.org; Wed, 24 Sep 2014 15:48:16 +0200 Original-Received: from localhost ([::1]:59970 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XWmvY-0005OW-9G for ged-emacs-devel@m.gmane.org; Wed, 24 Sep 2014 09:48:16 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:44718) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XWmvF-0005NU-VX for emacs-devel@gnu.org; Wed, 24 Sep 2014 09:48:02 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XWmvA-0004u2-Up for emacs-devel@gnu.org; Wed, 24 Sep 2014 09:47:57 -0400 Original-Received: from plane.gmane.org ([80.91.229.3]:40118) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XWmvA-0004so-PX for emacs-devel@gnu.org; Wed, 24 Sep 2014 09:47:52 -0400 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1XWmv4-0000wI-4U for emacs-devel@gnu.org; Wed, 24 Sep 2014 15:47:46 +0200 Original-Received: from c-98-229-61-72.hsd1.ma.comcast.net ([98.229.61.72]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 24 Sep 2014 15:47:46 +0200 Original-Received: from tzz by c-98-229-61-72.hsd1.ma.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 24 Sep 2014 15:47:46 +0200 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 51 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: c-98-229-61-72.hsd1.ma.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never User-Agent: Gnus/5.130008 (Ma Gnus v0.8) Emacs/24.4.50 (gnu/linux) Cancel-Lock: sha1:WBOOpcV0KH1uVhtHgDCK7ryI80A= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.229.3 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:174685 Archived-At: On Wed, 17 Sep 2014 15:40:39 -0400 Glenn Morris wrote: GM> David Engster wrote: >> Especially the GnuTLS stuff goes way over my head, I'm afraid. GM> And most people's I think. That's why these are long-term issues that GM> don't see much progress. It seems far too late to make any changes GM> related to GnuTLS for this release anyway. But nevertheless they remain GM> important issues (which is why using severity in this way is not great). Let me try to summarize (adding CCs to the parties involved that may not read emacs-devel): http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16978 [i|*| ] [emacs] 24.3; SSL/TLS with multiple man-in-the-middle vulnerabilities Reported by: Jens Lechtenboerger fsfe.org>; Date: Mon, 10 Mar 2014 07:00:02 UTC; Severity: important; Tags: security; Found in version 24.3; Filed 198 days ago; Modified 184 days ago; We made some fixes. To make things work well we'll need a certificate management UI, which IMO can happen after the current release. http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17625 [i|*| ] [emacs] details of package signing mechanism Reported by: Eric Abrahamsen ericabrahamsen.net>; Date: Thu, 29 May 2014 03:12:01 UTC; Severity: important; Tags: security; Found in version 24.4.50; Filed 118 days ago; Modified 89 days ago; Daiki Ueno made some fixes. Stefan got the detailed steps for generating a package signature and we need at least one package plus the archive-contents signed by the maintainer in the GNU ELPA to test the client behavior. This seems OK to me as far as the code. Stefan suggested some behavior changes that we can implement and test easily, but are not IMO critical for the release. http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17660 [i|*| ] [emacs] 24.3; gnutls-min-prime-bits is 256 Reported by: Juliusz Chroboczek pps.univ-paris-diderot.fr>; Date: Sun, 1 Jun 2014 13:25:01 UTC; Severity: important; Tags: security; Found in version 24.3; Filed 115 days ago; Modified 110 days ago; This touches several older tickets. I said "the proper fix seems to be to change the default for `gnutls-algorithm-priority' but that may break some people's setups (just like raising `gnutls-min-prime-bits' would)" and it's still the case. Opinions are welcome. Considering the Emacs user base, I'd rather live with a slightly insecure setting in 24.4 and address this in 24.5 together with the certificate management UI. I hope that's helpful. Ted