From: Ted Zlatanov <tzz@lifelogs.com>
To: Lars Ingebrigtsen <larsi@gnus.org>
Cc: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>,
Roland Winkler <winkler@gnu.org>,
15057@debbugs.gnu.org, 16253@debbugs.gnu.org,
11267@debbugs.gnu.org, Tassilo Horn <tsdh@gnu.org>
Subject: bug#11267: bug#15057: 24.3.50; TLS error with reasonably high gnutls-min-prime-bits, bug#11267: 24.0.95; gnutls.c: [0] (Emacs) fatal error: The Diffie-Hellman prime sent by the server is not acceptable (not long enough)
Date: Wed, 12 Feb 2014 12:11:41 -0500 [thread overview]
Message-ID: <87k3d0gss2.fsf_-_@lifelogs.com> (raw)
In-Reply-To: <874n452br1.fsf@building.gnus.org> (Lars Ingebrigtsen's message of "Tue, 11 Feb 2014 20:30:58 -0800, Tue, 11 Feb 2014 20:29:09 -0800")
(I love how mangled the subject line became)
On Tue, 11 Feb 2014 20:30:58 -0800 Lars Ingebrigtsen <larsi@gnus.org> wrote:
LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> I'm sure we can come up with more helpful messaging. Does it have
>> to fit in 78 chars? Can we use buttons? If so, it could be like this,
>> going over 78 but not too much:
>>
>> !! remote host X requires lower security [OK once] [OK always] [Cancel] [?]
LI> Yeah, that would be nice. And, remember, somebody (ahem) also has to
LI> write code to handle invalid certificates. It could be done the
LI> same way.
Yes, it's a similar UI. After 24.4. Is that available as a debbugs
tag, "target-version=24.5" or something?
LI> And if the user types "OK always" for this (and for invalid
LI> certificates), it should be stored using the customize functions.
Right. I feel Customize is the right place to put certificate
exceptions. The user can set their custom.el file to be
GnuPG-encrypted if they are concerned.
>> If we provide that simple UI, plus some help messaging, I think we can
>> disable DHE by default. Based on Nikos' explanation, it seems to be the
>> best way forward.
LI> But why would we disable DHE? Prefer ECDHE over DHE, certainly, but I
LI> don't understand disabling...
Nikos advocates (and I agree) that it's prudent to add
"!DHE-RSA:!DHE-DSS" to the default priority string. We can make it easy
for the user to remove that exclusion or make a specific exception as
we've discussed.
Ted
next prev parent reply other threads:[~2014-02-12 17:11 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-09 8:52 bug#15057: 24.3.50; TLS error with reasonably high gnutls-min-prime-bits Tassilo Horn
2013-08-11 20:03 ` Lars Magne Ingebrigtsen
2013-10-07 22:27 ` Ted Zlatanov
2014-01-31 0:46 ` Lars Ingebrigtsen
2014-02-10 2:15 ` Ted Zlatanov
2012-04-17 21:14 ` bug#11267: 24.0.95; gnutls.c: [0] (Emacs) fatal error: The Diffie-Hellman prime sent by the server is not acceptable (not long enough) Roland Winkler
2012-04-18 16:48 ` Glenn Morris
2012-04-19 11:04 ` Roland Winkler
2012-04-19 16:19 ` Glenn Morris
2012-04-19 16:26 ` Lars Magne Ingebrigtsen
2012-04-19 16:31 ` Glenn Morris
2012-04-19 16:41 ` Roland Winkler
2012-04-24 12:45 ` Ted Zlatanov
2012-04-24 20:04 ` Roland Winkler
2012-05-13 19:04 ` Lars Magne Ingebrigtsen
2012-05-15 8:24 ` Ted Zlatanov
2012-05-15 15:16 ` Chong Yidong
[not found] ` <mailman.1129.1337070368.855.bug-gnu-emacs@gnu.org>
2012-05-18 11:38 ` n.mavrogiannopoulos
2014-02-10 2:39 ` Ted Zlatanov
2014-02-10 3:06 ` Roland Winkler
2014-02-10 8:28 ` Nikos Mavrogiannopoulos
2014-02-10 2:58 ` bug#15057: 24.3.50; TLS error with reasonably high gnutls-min-prime-bits Lars Ingebrigtsen
2014-02-10 10:52 ` bug#11267: bug#15057: 24.3.50; TLS error with reasonably high gnutls-min-prime-bits, bug#11267: 24.0.95; gnutls.c: [0] (Emacs) fatal error: The Diffie-Hellman prime sent by the server is not acceptable (not long enough) Ted Zlatanov
2014-02-11 5:09 ` Lars Ingebrigtsen
2014-02-11 10:35 ` Nikos Mavrogiannopoulos
2014-02-11 14:21 ` bug#16253: bug#11267: " Ted Zlatanov
2014-02-11 22:49 ` Roland Winkler
2014-02-11 23:54 ` Ted Zlatanov
2014-02-12 4:30 ` bug#15057: " Lars Ingebrigtsen
2014-02-12 17:11 ` Ted Zlatanov [this message]
2014-02-12 4:29 ` Lars Ingebrigtsen
2014-12-08 19:43 ` bug#15057: 24.3.50; TLS error with reasonably high gnutls-min-prime-bits Lars Magne Ingebrigtsen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87k3d0gss2.fsf_-_@lifelogs.com \
--to=tzz@lifelogs.com \
--cc=11267@debbugs.gnu.org \
--cc=15057@debbugs.gnu.org \
--cc=16253@debbugs.gnu.org \
--cc=larsi@gnus.org \
--cc=n.mavrogiannopoulos@gmail.com \
--cc=tsdh@gnu.org \
--cc=winkler@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.