Re: A couple of questions and concerns about Emacs network security

[Eli Zaretskii <eliz@gnu.org>]

> From: Robert Pluim <rpluim@gmail.com>
> Cc: "Perry E. Metzger" <perry@piermont.com>,  larsi@gnus.org,  eggert@cs.ucla.edu,  emacs-devel@gnu.org,  npostavs@gmail.com,  wyuenho@gmail.com
> Date: Fri, 06 Jul 2018 10:36:54 +0200
> 
> > Anyway, it seems you completely miss my point: I didn't say that we
> > shouldn't increase the number of bits, just that we shouldn't do that
> > on the release branch, unless we are willing to delay Emacs 26.2
> > significantly.
> 
> FWIW, Iʼve had gnutls-min-prime-bits set to 1024 since 2014-11-25, and
> have seen no adverse effects from it, so I donʼt think the risk is
> that great.

Thanks for the data point.

Unfortunately, our experience is that use patterns vary widely between
different Emacs users, and so problem-free experience of a single
individual, or even several people, is not enough to be sure there are
no significant issues.  And TLS secured connections are central to
many Emacs features.

Emacs 26.2 is supposed to have fewer significant bugs than Emacs 26.1,
so we must be careful if we make changes that could bring new
problems.