From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Robert Pluim Newsgroups: gmane.emacs.devel Subject: Re: GnuTLS/TLS proposals for after the release Date: Thu, 07 Jul 2016 10:10:32 +0200 Organization: not if I can help it Message-ID: <87k2gx7ts7.fsf@gmail.com> References: <87furnhj3g.fsf@lifelogs.com> <8737nngdnr.fsf@lifelogs.com> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1467879100 14933 80.91.229.3 (7 Jul 2016 08:11:40 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 7 Jul 2016 08:11:40 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Thu Jul 07 10:11:30 2016 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1bL4PC-000105-2M for ged-emacs-devel@m.gmane.org; Thu, 07 Jul 2016 10:11:30 +0200 Original-Received: from localhost ([::1]:38138 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bL4PB-0004VL-AR for ged-emacs-devel@m.gmane.org; Thu, 07 Jul 2016 04:11:29 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:50430) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bL4OZ-0004Gl-0T for emacs-devel@gnu.org; Thu, 07 Jul 2016 04:10:54 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bL4OU-0004lR-Lw for emacs-devel@gnu.org; Thu, 07 Jul 2016 04:10:49 -0400 Original-Received: from plane.gmane.org ([80.91.229.3]:34514) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bL4OU-0004kj-FQ for emacs-devel@gnu.org; Thu, 07 Jul 2016 04:10:46 -0400 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1bL4ON-0000Vt-IP for emacs-devel@gnu.org; Thu, 07 Jul 2016 10:10:39 +0200 Original-Received: from 149.5.228.1 ([149.5.228.1]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 07 Jul 2016 10:10:39 +0200 Original-Received: from rpluim by 149.5.228.1 with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 07 Jul 2016 10:10:39 +0200 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 24 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: 149.5.228.1 Mail-Copies-To: never User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.95 (gnu/linux) Cancel-Lock: sha1:OLd295rM1Y8206CgDfZBwfbsrHU= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.229.3 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:205305 Archived-At: John Wiegley writes: >>>>>> Ted Zlatanov writes: > >> They have different purposes: (1) is to make tls.el, which uses command-line >> tunnels, more noisy by default, so users are led to the C bindings to GnuTLS >> (gnutls.el). (2) is to disable SSLv3 in tls.el. (3) is to change the >> variables in gnutls.el a bit to make customization and future work easier. >> (3) is the only risky one because it affects user customizations, but I >> think we have to bite that buller sooner or later. > > OK. Does anyone else have a reason to object to these changes? rfc7568 says, with good reason: >3. Do Not Use SSL Version 3.0 > > SSLv3 MUST NOT be used. Negotiation of SSLv3 from any version of TLS > MUST NOT be permitted. so I definitely vote for disabling SSLv3 (and rapidly deprecating tls.el) Robert