all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* A couple of questions and concerns about Emacs network security
@ 2018-06-22 22:00 Jimmy Yuen Ho Wong
  2018-06-22 22:43 ` Paul Eggert
  0 siblings, 1 reply; 221+ messages in thread
From: Jimmy Yuen Ho Wong @ 2018-06-22 22:00 UTC (permalink / raw)
  To: emacs-devel


Hi everyone,

I've been digging around Emacs' network security settings lately and
I've noticed a couple of oddities. I was wondering what the reasos are
and if there are any plans to improve them.

For `--with-gnutls` builds using GnuTLS 3.5.18:

1. `gnutls-verify-error` is set to nil by default, so server certs
   aren't verified by default.
2. `gnutls-min-prime-bits` has been 256 by default since 2012, whereas
   a reasonable number should probably be 2048 in 2018.
3. `gnutls-algorithm-priority` is nil by default.

All of this means there's zero network security OTTB for Emacs. After
some experimentation, I've come up with the following settings that
brings the balance of default security and compatibility to as good as I
could:

    (setq gnutls-algorithm-priority
          "SECURE192:+SECURE128:-VERS-ALL:+VERS-TLS1.2:%PROFILE_MEDIUM"
          gnutls-min-prime-bits 2048
          gnutl-verify-error t)

However, this setting still fail the following tests rather alarmingly:

    (mapcar (lambda (host)
              (ignore-errors (url-retrieve-synchronously host)))
            '("https://revoked.badssl.com/"
              "https://pinning-test.badssl.com/"
              "https://invalid-expected-sct.badssl.com/"))

    ;; This should return a list of `'(nil nil nil)`, but doesn't.

My questions are:

1. Can we update the default network security settings?
2. Now that `starttls.el` and `tls.el` are obsolete, and GnuTLS doesn't
   seem to be doing a very good job, can we link to something better
   maintained, such as OpenSSL/LibreSSL/BoringSSL/NSS?

Lastly, I notice there's this thing call `nsm.el` seemingly
doing redundant checks if your TLS settings are reasonable, what's the
history of it and why is it not obsolete when `tls.el` and `starttls.el`
are?

Thanks in advance,

Jimmy Wong



^ permalink raw reply	[flat|nested] 221+ messages in thread

end of thread, other threads:[~2018-07-14 18:25 UTC | newest]

Thread overview: 221+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-06-22 22:00 A couple of questions and concerns about Emacs network security Jimmy Yuen Ho Wong
2018-06-22 22:43 ` Paul Eggert
2018-06-22 23:21   ` Lars Ingebrigtsen
2018-06-22 23:33     ` Lars Ingebrigtsen
2018-06-23  1:35       ` Jimmy Yuen Ho Wong
2018-06-23 10:23         ` Lars Ingebrigtsen
2018-06-23 10:34           ` Lars Ingebrigtsen
2018-06-23 10:48           ` Jimmy Yuen Ho Wong
2018-06-23 11:32             ` Lars Ingebrigtsen
2018-06-23 11:55               ` Jimmy Yuen Ho Wong
2018-06-23 12:05                 ` Lars Ingebrigtsen
2018-06-23 12:13                   ` Eli Zaretskii
2018-06-23 12:15                     ` Lars Ingebrigtsen
2018-06-23 12:26                       ` Eli Zaretskii
2018-07-07  9:57                         ` Eli Zaretskii
2018-07-08 14:01                           ` Lars Ingebrigtsen
2018-07-08 14:53                             ` Eli Zaretskii
2018-07-08 15:06                               ` Lars Ingebrigtsen
2018-07-08 15:23                                 ` Eli Zaretskii
2018-06-23 12:45                   ` Jimmy Yuen Ho Wong
2018-06-24 12:53                     ` Lars Ingebrigtsen
2018-07-05 13:33           ` Perry E. Metzger
2018-07-05 13:49             ` Eli Zaretskii
2018-07-05 15:29               ` Perry E. Metzger
2018-07-05 18:55                 ` Eli Zaretskii
2018-07-05 19:26                   ` Paul Eggert
2018-07-05 19:35                     ` Eli Zaretskii
2018-07-05 20:01                       ` Eli Zaretskii
2018-07-06 17:03                       ` Paul Eggert
2018-07-06 17:36                         ` Eli Zaretskii
2018-07-06 18:15                           ` Paul Eggert
2018-07-07  7:04                             ` Eli Zaretskii
2018-07-07 10:30                               ` Jimmy Yuen Ho Wong
2018-07-07 11:35                                 ` Eli Zaretskii
2018-07-05 20:46                     ` Perry E. Metzger
2018-07-05 20:45                   ` Perry E. Metzger
2018-07-06  6:29                     ` Eli Zaretskii
2018-07-06 23:08                       ` Richard Stallman
2018-07-07 12:18                         ` Perry E. Metzger
2018-07-07 13:19                           ` Eli Zaretskii
2018-07-07 13:46                             ` Perry E. Metzger
2018-07-07 14:17                               ` Eli Zaretskii
2018-07-07 15:25                                 ` Perry E. Metzger
2018-07-07 16:08                                   ` Eli Zaretskii
2018-07-07 23:46                                   ` Richard Stallman
2018-07-08  0:25                                     ` Perry E. Metzger
2018-07-08  2:44                                     ` Eli Zaretskii
2018-07-08 22:55                                       ` Richard Stallman
2018-07-07 14:32                               ` Jimmy Yuen Ho Wong
2018-07-07 15:15                                 ` Perry E. Metzger
2018-07-07 15:39                                   ` Jimmy Yuen Ho Wong
2018-07-07 18:16                                     ` Paul Eggert
2018-07-07 23:03                                       ` Jimmy Yuen Ho Wong
2018-07-07 15:57                                   ` Eli Zaretskii
2018-07-07 23:45                           ` Richard Stallman
2018-07-05 13:50             ` Jimmy Yuen Ho Wong
2018-07-05 15:30               ` Perry E. Metzger
2018-07-05 15:36                 ` Stefan Monnier
2018-07-05 16:05                   ` Perry E. Metzger
2018-07-05 22:44             ` Richard Stallman
2018-07-06  6:01               ` Eli Zaretskii
2018-06-23  0:00     ` Paul Eggert
2018-06-23  0:10       ` Stefan Monnier
2018-06-23  9:57         ` Lars Ingebrigtsen
2018-06-23  2:17   ` Noam Postavsky
2018-06-23  6:40     ` Eli Zaretskii
2018-06-23 10:21       ` Jimmy Yuen Ho Wong
2018-06-23 11:26         ` Eli Zaretskii
2018-06-23 22:28       ` Noam Postavsky
2018-06-24 14:23         ` Eli Zaretskii
2018-06-24 14:34           ` Lars Ingebrigtsen
2018-06-24 14:48             ` Noam Postavsky
2018-06-24 15:30               ` Eli Zaretskii
2018-06-24 16:57                 ` Lars Ingebrigtsen
2018-06-24 17:10                   ` Jimmy Yuen Ho Wong
2018-06-24 17:39                     ` Lars Ingebrigtsen
2018-06-24 18:29                       ` Jimmy Yuen Ho Wong
2018-06-24 18:51                         ` Eli Zaretskii
2018-06-24 21:30                         ` Jimmy Yuen Ho Wong
2018-06-25  1:25                           ` Van L
2018-06-25  2:28                             ` Jimmy Yuen Ho Wong
2018-06-25  2:38                               ` Jimmy Yuen Ho Wong
2018-06-25 17:16                           ` Eli Zaretskii
2018-06-25 17:25                             ` Jimmy Yuen Ho Wong
2018-06-25 18:06                             ` Jimmy Yuen Ho Wong
2018-06-24 20:58             ` Lars Ingebrigtsen
2018-06-24 21:07               ` Lars Ingebrigtsen
2018-06-24 22:47                 ` Jimmy Yuen Ho Wong
2018-06-25  0:04                   ` Lars Ingebrigtsen
2018-06-25  0:33                     ` Noam Postavsky
2018-06-25  0:36                       ` Lars Ingebrigtsen
2018-06-24 21:28               ` Noam Postavsky
2018-06-24 21:57                 ` Lars Ingebrigtsen
2018-06-25 16:06               ` Eli Zaretskii
2018-06-25 16:29                 ` Jimmy Yuen Ho Wong
2018-06-25 16:58                   ` Lars Ingebrigtsen
2018-06-25 17:08                     ` Jimmy Yuen Ho Wong
2018-06-25 17:18                       ` Eli Zaretskii
2018-06-30 17:40                         ` Jimmy Yuen Ho Wong
2018-06-30 18:04                           ` Eli Zaretskii
2018-06-25 17:09                     ` Eli Zaretskii
2018-06-25 17:17                   ` Eli Zaretskii
2018-06-25 16:55                 ` Lars Ingebrigtsen
2018-06-25 17:06                   ` Eli Zaretskii
2018-06-25 17:20                   ` Jimmy Yuen Ho Wong
2018-06-25 17:33                     ` Lars Ingebrigtsen
2018-07-05 15:52                       ` Perry E. Metzger
2018-07-05 15:58                         ` Jimmy Yuen Ho Wong
2018-07-05 16:36                           ` Perry E. Metzger
2018-07-05 16:51                             ` Jimmy Yuen Ho Wong
2018-07-05 18:25                               ` Perry E. Metzger
2018-07-05 18:32                           ` Eli Zaretskii
2018-07-05 18:43                         ` Noam Postavsky
2018-07-05 20:31                           ` Perry E. Metzger
2018-07-08 11:43                   ` Lars Ingebrigtsen
2018-07-08 14:48                     ` Eli Zaretskii
2018-07-06  9:01                 ` Eli Zaretskii
2018-07-05 15:33       ` Perry E. Metzger
2018-07-05 18:58         ` Eli Zaretskii
2018-07-06  8:36           ` Robert Pluim
2018-07-06  8:49             ` Eli Zaretskii
2018-07-06  9:35               ` Robert Pluim
2018-07-06 12:32                 ` Eli Zaretskii
2018-07-06 12:52                   ` Robert Pluim
2018-07-06 13:31                     ` Eli Zaretskii
2018-07-06  9:45               ` Stephen Berman
2018-07-06 12:41                 ` Eli Zaretskii
2018-07-06 13:50                   ` Stephen Berman
2018-07-07  7:15                     ` martin rudalics
2018-07-07 12:22                       ` Stephen Berman
2018-07-07 13:22                         ` Eli Zaretskii
2018-07-07 13:47                           ` Stephen Berman
2018-07-08  8:11                         ` martin rudalics
2018-07-05 15:10     ` Perry E. Metzger
2018-06-23  6:45   ` Eli Zaretskii
2018-06-23 10:34     ` Jimmy Yuen Ho Wong
2018-07-05 15:58     ` Perry E. Metzger
2018-07-05 19:20       ` Paul Eggert
2018-07-05 20:46         ` Perry E. Metzger
2018-07-05 22:44       ` Richard Stallman
2018-07-06  6:42         ` Jimmy Yuen Ho Wong
2018-07-06  8:16           ` Eli Zaretskii
2018-07-06  9:28             ` Robert Pluim
2018-07-06 13:18               ` Eli Zaretskii
2018-07-06 18:06               ` Jimmy Yuen Ho Wong
2018-07-06 18:48                 ` Perry E. Metzger
2018-07-07  7:02                 ` Eli Zaretskii
2018-07-07  9:36                 ` Robert Pluim
2018-07-07  9:59                   ` Jimmy Yuen Ho Wong
2018-07-07 10:01                     ` Jimmy Yuen Ho Wong
2018-07-07 21:44                     ` Ted Zlatanov
2018-07-07 21:59                       ` Paul Eggert
2018-07-07 22:11                         ` Jimmy Yuen Ho Wong
2018-07-09 23:09                           ` Ted Zlatanov
2018-07-10 18:20                             ` Jimmy Yuen Ho Wong
2018-07-10 18:36                               ` Eli Zaretskii
2018-07-10 18:40                                 ` Jimmy Yuen Ho Wong
2018-07-10 18:58                                   ` Eli Zaretskii
2018-07-13 20:50                                     ` Jimmy Yuen Ho Wong
2018-07-14  6:37                                       ` Eli Zaretskii
2018-07-14 17:18                                         ` Jimmy Yuen Ho Wong
2018-07-14 18:25                                           ` Eli Zaretskii
2018-07-07 22:13                       ` Jimmy Yuen Ho Wong
2018-07-09 13:09                     ` Robert Pluim
2018-07-09 13:33                       ` Jimmy Yuen Ho Wong
2018-07-09 13:43                         ` Lars Ingebrigtsen
2018-07-09 13:49                           ` Jimmy Yuen Ho Wong
2018-07-09 17:15                           ` Eli Zaretskii
2018-07-09 17:24                             ` Jimmy Yuen Ho Wong
2018-07-10  0:06                               ` Perry E. Metzger
2018-07-10  0:03                           ` Perry E. Metzger
2018-07-10  0:02                         ` Perry E. Metzger
2018-07-06 13:03             ` Jimmy Yuen Ho Wong
2018-07-06 14:06               ` Eli Zaretskii
2018-07-06 21:24                 ` Jimmy Yuen Ho Wong
2018-07-07  7:55                   ` Eli Zaretskii
2018-07-08 14:06           ` Lars Ingebrigtsen
2018-07-08 14:54             ` Jimmy Yuen Ho Wong
2018-07-08 15:13               ` Lars Ingebrigtsen
2018-07-08 16:56                 ` Jimmy Yuen Ho Wong
2018-07-08 17:06                   ` Paul Eggert
2018-07-08 17:25                     ` Jimmy Yuen Ho Wong
2018-07-08 17:53                       ` Lars Ingebrigtsen
2018-07-08 18:54                         ` Jimmy Yuen Ho Wong
2018-07-08 19:30                           ` Lars Ingebrigtsen
2018-07-08 19:32                             ` Jimmy Yuen Ho Wong
2018-07-08 22:56                     ` Richard Stallman
2018-07-08 17:47                   ` Lars Ingebrigtsen
2018-07-08 18:10                     ` Eli Zaretskii
2018-07-08 18:12                       ` Jimmy Yuen Ho Wong
2018-07-08 18:26                         ` Eli Zaretskii
2018-07-08 18:39                           ` Lars Ingebrigtsen
2018-07-08 18:53                             ` Eli Zaretskii
2018-07-08 19:22                               ` Jimmy Yuen Ho Wong
2018-07-09 16:57                                 ` Eli Zaretskii
2018-07-09 17:17                                   ` Jimmy Yuen Ho Wong
2018-07-09 17:36                                   ` Jimmy Yuen Ho Wong
2018-07-09 17:38                                     ` Jimmy Yuen Ho Wong
2018-07-09 18:04                                       ` Eli Zaretskii
2018-07-09 18:10                                         ` Jimmy Yuen Ho Wong
2018-07-09 18:33                                           ` Eli Zaretskii
2018-07-09 18:47                                             ` Jimmy Yuen Ho Wong
2018-07-10 16:10                                               ` Eli Zaretskii
2018-07-08 19:28                               ` Lars Ingebrigtsen
2018-07-08 19:31                                 ` Jimmy Yuen Ho Wong
2018-07-09 17:04                                   ` Eli Zaretskii
2018-07-09 17:02                                 ` Eli Zaretskii
2018-07-09 17:09                                   ` Jimmy Yuen Ho Wong
2018-07-09 15:29                               ` Jimmy Yuen Ho Wong
2018-07-09 16:35                                 ` Robert Pluim
2018-07-08 18:31                     ` Jimmy Yuen Ho Wong
2018-07-08 18:42                       ` Lars Ingebrigtsen
2018-07-08 19:28                         ` Jimmy Yuen Ho Wong
2018-07-08 17:53                   ` Eli Zaretskii
2018-07-08 19:16                     ` Jimmy Yuen Ho Wong
2018-07-08 14:55             ` Eli Zaretskii
2018-07-08 14:58               ` Jimmy Yuen Ho Wong
2018-07-08 15:18                 ` Eli Zaretskii
2018-07-08 15:16               ` Lars Ingebrigtsen
2018-07-06 16:53         ` Paul Eggert
2018-07-06 23:11           ` Richard Stallman

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.