From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.devel Subject: GnuTLS/TLS proposals for after the release Date: Tue, 05 Jul 2016 17:26:43 -0400 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87furnhj3g.fsf@lifelogs.com> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1467754063 20167 80.91.229.3 (5 Jul 2016 21:27:43 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 5 Jul 2016 21:27:43 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Jul 05 23:27:31 2016 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1bKXsQ-0006CI-4j for ged-emacs-devel@m.gmane.org; Tue, 05 Jul 2016 23:27:30 +0200 Original-Received: from localhost ([::1]:58185 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKXsO-0000CQ-T6 for ged-emacs-devel@m.gmane.org; Tue, 05 Jul 2016 17:27:28 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:43525) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKXrq-0000C3-PN for emacs-devel@gnu.org; Tue, 05 Jul 2016 17:26:55 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bKXrm-0007Rf-IK for emacs-devel@gnu.org; Tue, 05 Jul 2016 17:26:53 -0400 Original-Received: from plane.gmane.org ([80.91.229.3]:33745) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bKXrm-0007Qz-Ag for emacs-devel@gnu.org; Tue, 05 Jul 2016 17:26:50 -0400 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1bKXrk-0005pM-Pg for emacs-devel@gnu.org; Tue, 05 Jul 2016 23:26:48 +0200 Original-Received: from c-98-229-60-157.hsd1.ma.comcast.net ([98.229.60.157]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 05 Jul 2016 23:26:48 +0200 Original-Received: from tzz by c-98-229-60-157.hsd1.ma.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 05 Jul 2016 23:26:48 +0200 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 31 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: c-98-229-60-157.hsd1.ma.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1.50 (gnu/linux) Cancel-Lock: sha1:b3nsXevMTny0BrYjcMBW903W/U8= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.229.3 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:205210 Archived-At: Here are some thoughts about the near future of gnutls.el and friends (none urgently needed for the release): 1) Proposal: after the 25.1 release, opening a secure network connection without `gnutls-available-p' should be an annoying warning. The alternative (tls.el) is less secure and IMHO should be discouraged. 2) I am concerned that SSLv3 is explicitly in the tls.el defaults. See http://disablessl3.com/ for why, no need to write up all the reasons here. I propose to cut those lines out. 3) refactor gnutls.el a bit to support per-host settings more easily: `gnutls-algorithm-priority', `gnutls-verify-error', `gnutls-trustfiles', and `gnutls-min-prime-bits' all have different kinds of customizations. For instance `gnutls-verify-error' can be global or per host regex, while `gnutls-trustfiles' can be a function. This mish-mash reflects the staggered work on that library over the years. I propose a single variable, `gnutls-settings' which can be set per host regex or globally, and which can contain an alist or plist specifying each of the settings above as a string/string list or as a function. Basically a unified view of all GnuTLS-related connectivity settings instead of scattering them over several variables. I think in Customize that will look nicer and more friendly, plus the code will be simplified. If proposal 3 is accepted, the old variables will be accepted for some time, deprecated later, and finally killed off. It won't be a sudden transition. Thanks Ted