bug#28597: 26.0.60; [Security] Configure should use --without-pop by default

[nljlistbox2@gmail.com (N. Jackson)]

At 16:14 +0300 on Friday 2017-09-29, Eli Zaretskii wrote:
>
>> >>>>> Paul Eggert <eggert@cs.ucla.edu> writes:
>> 
>> > As Glenn noted, the 'configure' message N. mentions came from
>> > an uneasy compromise between worry about the default
>> > lack-of-security in Emacs, and worry about backward
>> > compatibility (see Bug#26102). Although I favor making
>> > --without-pop the default, at this point it's really an issue
>> > for the two maintainers to decide.
>
> I already agreed in
> http://lists.gnu.org/archive/html/emacs-devel/2017-08/msg00054.html
> to have --without-pop be the default, and Paul already installed
> a patch to do that.

And yet --without-pop does not appear to be the default here on the
emacs-26 branch.

I updated a few minutes ago (commit
61225964edbaa01e49a6e776af00502ab31767b5), and running configure
writes the following to stderr:

  configure: WARNING: Your version of Gtk+ will have problems with
         closing open displays.  This is no problem if you just use
         one display, but if you use more than one and close one of them
         Emacs may crash.
         See http://bugzilla.gnome.org/show_bug.cgi?id=85715
  configure: WARNING: This configuration installs a 'movemail' program
  that retrieves POP3 email via only insecure channels.
  To omit insecure POP3, you can use './configure --without-pop'.

> So I'm confused about this discussion: what exactly is the
> problem, and what needs to be done/decided?

The problem is that --without-pop is not the default, or at least
that it appears that it is not the default. The general agreement
seems to be that it should be the default.

N.