Re: bug#10612: GnuTLS bundled with the windows Emacs binaries

[Juanma Barranquero <lekktu@gmail.com>]

On Sun, Jan 29, 2012 at 18:08, Christoph Scholtes
<cschol2112@googlemail.com> wrote:

> Why is that?

Because the number of Windows machines with a compiler and a build
environment is almost zero, and though they are available (and free)
the average Windows users knows nothing about them and wouldn't know
how to (or be interested in) install and use them.

It's been said a few times here, by RMS and others, than providing
Emacs for Windows (binary or not) is intended to be a bridgehead to
introduce users of non-free software to the advantages of free
software (not to facilitate them using Windows). If we didn't offer
binaries for Windows, almost nobody would use it. It's politically
convenient to provide them.

> I agree, but doesn't that also start with compiling support for GnuTLS into
> the prebuilt Emacs?

No. That's just an enabler. Whether they use it or not is their
decision, and they should be aware of the risks and benefits before
doing it.

> If  there is a security update for GnuTLS that requires the user to use the
> latest certain version, don't we have to provide support for the latest
> version in the binary?

Yes, but bugs that force a change in the API are less frequent. Of
course as soon as we add some capability we expose the user to
security risks (23.4 wouldn't be needed without EDE). We have to put
the line at some point.

And, in any case, bearing the responsibility of the upgrades isn't my
main objection, and never has, just another inconvenience. The main
argument is still that GnuTLS, etc. have their own projects and
maintainers, and they should be the ones taking care of building and
distributing it.

    Juanma