Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[izzy.yichao.cai]

Hi folks,

I have tried to install elpy in emacs (24.5.1) on my server which is running Ubuntu 16.04.

When I run M-x package-refresh-contents, emacs successfully connected to stable.melpa.org:443. 
After that, it was hanged on "Contacting host: elpa.gnu.org:80". I am pretty sure that I am not behind proxy. 

Then I tried to ping this host and this is what I got:
me@server:~$ ping elpa.gnu.org:80
ping: unknown host elpa.gnu.org:80

However, pinging other websites is normal. I also tried to access this (elpa.gnu.org:80) on my local computer and it is accessible.

Does anyone get a hint of what is going on? Thank you so much!


Best regards,
Yichao

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[tomas]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Jan 17, 2018 at 03:56:34AM -0800, izzy.yichao.cai@gmail.com wrote:
> Hi folks,
> 
> I have tried to install elpy in emacs (24.5.1) on my server which is running Ubuntu 16.04.
> 
> When I run M-x package-refresh-contents, emacs successfully connected to stable.melpa.org:443. 
> After that, it was hanged on "Contacting host: elpa.gnu.org:80". I am pretty sure that I am not behind proxy. 

I don't know about this...

> Then I tried to ping this host and this is what I got:
> me@server:~$ ping elpa.gnu.org:80
> ping: unknown host elpa.gnu.org:80

...but this won't work. Indeed, "elpa.gnu.org:80" isn't a host name.
Try pinging "elpa.gnu.org". It's there and replies to pings :)

> However, pinging other websites is normal. I also tried to access this (elpa.gnu.org:80) on my local computer and it is accessible.

You don't ping websites -- you ping hosts. Actually, elpa.gnu.org
is serving a website at port 80 currently. So the URL
http://elpa.gnu.org:80/ should get you something (since port 80
is the default for http anyway, you can leave it out).

That said, elpa.gnu.org is also serving https, so I'd strongly
recommend going with https://elpa.gnu.org/

Cheers
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlpfPa0ACgkQBcgs9XrR2kZ+5wCfUj5LUoKJbu+ty2kjd6fJCKjK
d0gAnis0HbxOkzP0n579SeUupTJUFEAa
=136e
-----END PGP SIGNATURE-----

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[Dan Čermák]

If you are setting up a new emacs client, you might want to take a look
at this too: https://glyph.twistedmatrix.com/2015/11/editor-malware.html

tomas@tuxteam.de writes:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Wed, Jan 17, 2018 at 03:56:34AM -0800, izzy.yichao.cai@gmail.com wrote:
>> Hi folks,
>> 
>> I have tried to install elpy in emacs (24.5.1) on my server which is running Ubuntu 16.04.
>> 
>> When I run M-x package-refresh-contents, emacs successfully connected to stable.melpa.org:443. 
>> After that, it was hanged on "Contacting host: elpa.gnu.org:80". I am pretty sure that I am not behind proxy. 
>
> I don't know about this...
>
>> Then I tried to ping this host and this is what I got:
>> me@server:~$ ping elpa.gnu.org:80
>> ping: unknown host elpa.gnu.org:80
>
> ...but this won't work. Indeed, "elpa.gnu.org:80" isn't a host name.
> Try pinging "elpa.gnu.org". It's there and replies to pings :)
>
>> However, pinging other websites is normal. I also tried to access this (elpa.gnu.org:80) on my local computer and it is accessible.
>
> You don't ping websites -- you ping hosts. Actually, elpa.gnu.org
> is serving a website at port 80 currently. So the URL
> http://elpa.gnu.org:80/ should get you something (since port 80
> is the default for http anyway, you can leave it out).
>
> That said, elpa.gnu.org is also serving https, so I'd strongly
> recommend going with https://elpa.gnu.org/
>
> Cheers
> - -- tomás
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
>
> iEYEARECAAYFAlpfPa0ACgkQBcgs9XrR2kZ+5wCfUj5LUoKJbu+ty2kjd6fJCKjK
> d0gAnis0HbxOkzP0n579SeUupTJUFEAa
> =136e
> -----END PGP SIGNATURE-----

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[Rusi]

On Wednesday, January 17, 2018 at 6:11:59 PM UTC+5:30, Dan Čermák wrote:
> If you are setting up a new emacs client, you might want to take a look
> at this too: https://glyph.twistedmatrix.com/2015/11/editor-malware.html

Hoo Boy!
Was wondering when this would become a thing…

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[Dan Čermák]

The tile sounds a little click-baity, but it is actually a good tutorial
how to secure the connection to (m)elpa.

Afaik there has been no malware on melpa, but if you download your
packages via http, someone could in theory tamper with your connection
and inject malicious code.

So, don't panic & use https ;-)

Rusi <rustompmody@gmail.com> writes:

> On Wednesday, January 17, 2018 at 6:11:59 PM UTC+5:30, Dan Čermák wrote:
>> If you are setting up a new emacs client, you might want to take a look
>> at this too: https://glyph.twistedmatrix.com/2015/11/editor-malware.html
>
> Hoo Boy!
> Was wondering when this would become a thing…

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[Robert Pluim]

Dan Čermák <dan.cermak@cgc-instruments.com> writes:

> The tile sounds a little click-baity, but it is actually a good tutorial
> how to secure the connection to (m)elpa.
>
> Afaik there has been no malware on melpa, but if you download your
> packages via http, someone could in theory tamper with your connection
> and inject malicious code.
>
> So, don't panic & use https ;-)

The upcoming Emacs 26 should be much better in this regards, as it
uses https by default for elpa downloads.  Some of the advice in that
blog entry is still useful though.

Robert

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[Stefan Monnier]

> The upcoming Emacs 26 should be much better in this regards, as it
> uses https by default for elpa downloads.  Some of the advice in that
> blog entry is still useful though.

http vs https is largely irrelevant when downloading from elpa.gnu.org
since those packages come with a PGP signature which Emacs can check
(and does check, assuming you have PGP installed).

IIRC this has been true since Emacs-25.


        Stefan

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[izzy.yichao.cai]

to...@tuxteam.de於 2018年1月17日星期三 UTC+8下午8時12分42秒寫道：
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Wed, Jan 17, 2018 at 03:56:34AM -0800, izzy.yichao.cai@gmail.com wrote:
> > Hi folks,
> > 
> > I have tried to install elpy in emacs (24.5.1) on my server which is running Ubuntu 16.04.
> > 
> > When I run M-x package-refresh-contents, emacs successfully connected to stable.melpa.org:443. 
> > After that, it was hanged on "Contacting host: elpa.gnu.org:80". I am pretty sure that I am not behind proxy. 
> 
> I don't know about this...
> 
> > Then I tried to ping this host and this is what I got:
> > me@server:~$ ping elpa.gnu.org:80
> > ping: unknown host elpa.gnu.org:80
> 
> ...but this won't work. Indeed, "elpa.gnu.org:80" isn't a host name.
> Try pinging "elpa.gnu.org". It's there and replies to pings :)
> 
> > However, pinging other websites is normal. I also tried to access this (elpa.gnu.org:80) on my local computer and it is accessible.
> 
> You don't ping websites -- you ping hosts. Actually, elpa.gnu.org
> is serving a website at port 80 currently. So the URL
> http://elpa.gnu.org:80/ should get you something (since port 80
> is the default for http anyway, you can leave it out).
> 
> That said, elpa.gnu.org is also serving https, so I'd strongly
> recommend going with https://elpa.gnu.org/
> 
> Cheers
> - -- tomás
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> 
> iEYEARECAAYFAlpfPa0ACgkQBcgs9XrR2kZ+5wCfUj5LUoKJbu+ty2kjd6fJCKjK
> d0gAnis0HbxOkzP0n579SeUupTJUFEAa
> =136e
> -----END PGP SIGNATURE-----

Hi Tomas,

Basically, I've been following the instruction from elpy github repo for installation. (https://github.com/jorgenschaefer/elpy)

In my .emacs file. I've added the following:
```
(require 'package)
(add-to-list 'package-archives
             '("melpa-stable" . "https://stable.melpa.org/packages/"))

(package-initialize)
(elpy-enable)
```

So, I am using https, which is a safe practice as Dan pointed out.
How did emacs decide to connect to elpa.gnu.org? Is this a default of emacs? Because I never included the elpa.gnu.org link in my .emacs file or evaluated it in my buffer. (That means I have no choice in using https or http. :( It just happened and I don't know why.)

> ...but this won't work. Indeed, "elpa.gnu.org:80" isn't a host name.
> Try pinging "elpa.gnu.org". It's there and replies to pings :)
Yep, I tried to ping "elpa.gnu.org" and it did replied.

------------------
**ISSUE UPDATE**:
------------------
This is an update on the issue.

So, I have successfully installed eply in my emacs right now! However, this remains mysterious to me as in how it worked out.

In my first post, emacs was hanged on "Contacting host: elpa.gnu.org:80". Exiting emacs here and running package-install resulted in could not find the elpy package. 
Since I am running emacs on my server, I decided to let it run in hope that it would get connected anyhow. 
After two days, when I come back to it, it's still hanged. So I quite emacs (C-x C-c) and restart it. Then, I run package-install and elpy now can be installed.

Then, I tried package-refresh-content again but it still got hanged.

Do you have any idea how this might happen?
Thank you so much!

Best regards,
Yichao

Re: Ubuntu 16.04 server --- Contacting host: elpa.gnu.org:80 when package-refresh-contents

[Robert Pluim]

izzy.yichao.cai@gmail.com writes:

> In my .emacs file. I've added the following:
> ```
> (require 'package)
> (add-to-list 'package-archives
>              '("melpa-stable" . "https://stable.melpa.org/packages/"))
>
> (package-initialize)
> (elpy-enable)
> ```
>
> So, I am using https, which is a safe practice as Dan pointed out.
> How did emacs decide to connect to elpa.gnu.org? Is this a default of
> emacs? Because I never included the elpa.gnu.org link in my .emacs
> file or evaluated it in my buffer. (That means I have no choice in
> using https or http. :( It just happened and I don't know why.)

package-archives by default contains elpa.gnu.org. Run M-x customize
package-archives instead of your add-to-list there if you want to
remove it (or change it to use https)

Robert