From: Ted Zlatanov <tzz@lifelogs.com>
To: emacs-devel@gnu.org
Subject: Re: GnuTLS invasion of Emacs published)
Date: Fri, 03 Feb 2012 11:51:01 -0500 [thread overview]
Message-ID: <87vcnnj1xm.fsf@lifelogs.com> (raw)
In-Reply-To: 83mx8zev8s.fsf@gnu.org
On Fri, 03 Feb 2012 18:29:07 +0200 Eli Zaretskii <eliz@gnu.org> wrote:
>> From: Ted Zlatanov <tzz@lifelogs.com>
>> Date: Fri, 03 Feb 2012 08:23:12 -0500
>> Cc: help-emacs-windows@gnu.org
>>
EZ> What other features in Emacs use TLS as of this writing? I thought
EZ> only email protocols do, which is why I described GnuTLS as I did.
>>
>> Any network connection can use it.
EZ> I asked about actual use, not potential uses.
I think the potential use is just as important, since much of Emacs's
utility is in 3rd party packages. But Stefan answered about the actual
uses in the Emacs trunk; the URL package is most important (because of
package.el) to the Emacs users in general.
>> I think Lars introduced that option, and at least HTTP/S connections
>> can use it.
EZ> Then this needs to be documented somewhere.
I agree.
`open-network-stream' has some documentation, and is most useful as an
API.
User customization of gnutls.el is minimal right now, just
`gnutls-algorithm-priority' and `gnutls-min-prime-bits'. But those are
tricky: the specific library that uses the API may need to override them
too. And generally they should not be tweaked. So I'm not sure those
two deserve more mention in the manual.
>> It's a replacement for the previous libraries that managed secure
>> connections, except it doesn't depend on external binaries. So it
>> really doesn't change much in terms of Emacs functionality, only in the
>> underlying implementation.
EZ> Lisp programmers should know they can use TLS when Emacs was compiled
EZ> with GnuTLS support. Users should know that as well, because they
EZ> will need to set up their machines for that. E.g., this:
>> There is one annoying detail with the cert bundle on W32. It
>> defaults to /etc/ssl/certs/ca-certificates.crt which is not valid on
>> W32 and on many other platforms.
I mentioned this because it's the only important GnuTLS-related
configuration bit on all platforms. It should be in the manual, I
think, but consider that I proposed a while back that Emacs should ship
with its own version of the Mozilla cert bundle, so that this works on
all platforms, but that was not OK with the maintainers.
So that leaves us with the options of 1) trusting the platform (which
doesn't work on W32, AFAIK it doesn't have a cert bundle we can use; and
many GNU/Linux distros don't have a cert bundle in a standard place or
at all), or 2) making the cert bundle a GNU ELPA package than any
installer or user can activate.
Because of these concerns, currently we don't verify the peer
certificate in SSL and TLS connections. See `gnutls-negotiate' for how
that would work. The connections are still encrypted, but you could be
talking to an impostor.
I prefer the GNU ELPA package approach instead of trusting the platform,
but I also think the user should be able to customize this (and an
installer should offer the choice). Coming back to documentation, I'd
like to settle the greater question of how to distribute the cert bundle
before we document the configuration options for it.
WDYT?
Ted
next prev parent reply other threads:[~2012-02-03 16:51 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-30 2:02 Emacs 24.0.93 Pretest Windows Binaries published Christoph Scholtes
2012-01-30 4:55 ` Drew Adams
2012-01-30 17:47 ` Eli Zaretskii
2012-01-30 18:17 ` [h-e-w] " Drew Adams
2012-01-30 18:57 ` Eli Zaretskii
2012-01-30 19:08 ` Drew Adams
2012-01-30 19:09 ` Eli Zaretskii
2012-01-30 18:49 ` Eli Zaretskii
2012-01-31 14:03 ` Christoph Scholtes
2012-01-31 14:15 ` Drew Adams
2012-02-02 19:22 ` Ted Zlatanov
2012-02-02 19:52 ` Drew Adams
2012-02-02 21:46 ` Ted Zlatanov
2012-02-02 22:05 ` Drew Adams
2012-02-03 13:26 ` Ted Zlatanov
2012-02-03 7:48 ` Eli Zaretskii
2012-02-03 13:23 ` GnuTLS invasion of Emacs (was: Emacs 24.0.93 Pretest Windows Binaries published) Ted Zlatanov
2012-02-03 16:29 ` GnuTLS invasion of Emacs published) Eli Zaretskii
2012-02-03 16:51 ` Ted Zlatanov [this message]
2012-02-09 14:16 ` need help with certificate bundles for ALL the platforms Emacs supports (was: GnuTLS invasion of Emacs published)) Ted Zlatanov
2012-02-09 18:53 ` Eli Zaretskii
2012-02-10 13:06 ` need help with certificate bundles for ALL the platforms Emacs supports Ted Zlatanov
2012-02-10 15:51 ` Eli Zaretskii
2012-02-10 16:37 ` Ted Zlatanov
2012-02-11 17:22 ` Andy Moreton
2012-02-11 17:45 ` Eli Zaretskii
2012-02-12 2:43 ` Ted Zlatanov
2012-02-12 4:05 ` Eli Zaretskii
2012-02-12 13:36 ` Ted Zlatanov
2012-02-13 10:29 ` Andy Moreton
2012-02-13 13:15 ` Ted Zlatanov
2012-02-10 17:11 ` Ted Zlatanov
2012-02-10 18:57 ` Stefan Monnier
2012-02-12 22:13 ` Ted Zlatanov
2012-02-13 3:28 ` Stefan Monnier
2012-02-13 13:24 ` Ted Zlatanov
2012-02-13 15:12 ` Stefan Monnier
2012-02-13 16:30 ` Ted Zlatanov
2012-02-13 21:04 ` Stefan Monnier
2012-02-13 21:54 ` Ted Zlatanov
2012-02-13 21:55 ` Lars Ingebrigtsen
2012-02-13 22:20 ` Stefan Monnier
2012-02-14 0:05 ` Ted Zlatanov
2012-02-14 2:13 ` Stefan Monnier
2012-02-14 2:32 ` Glenn Morris
2012-02-14 13:01 ` Ted Zlatanov
2012-02-03 13:25 ` Emacs 24.0.93 Pretest Windows Binaries published Stefan Monnier
2012-02-03 0:48 ` [h-e-w] " Richard M. Heiberger
2012-02-03 8:12 ` Eli Zaretskii
2012-02-03 10:03 ` Stephen J. Turnbull
2012-02-03 10:31 ` Eli Zaretskii
2012-02-03 13:49 ` Stephen J. Turnbull
2012-02-03 15:44 ` Eli Zaretskii
2012-02-12 4:04 ` Lennart Borgman
2012-02-12 4:08 ` Lennart Borgman
2012-02-12 16:23 ` Eli Zaretskii
2012-02-12 22:19 ` Lennart Borgman
2012-02-13 3:29 ` Stefan Monnier
2012-02-13 3:51 ` Eli Zaretskii
2012-02-13 19:23 ` Lennart Borgman
2012-02-14 22:43 ` Lennart Borgman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87vcnnj1xm.fsf@lifelogs.com \
--to=tzz@lifelogs.com \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.