From: Ivan Shmakov <ivan@siamics.net>
To: 19284@debbugs.gnu.org
Subject: bug#19284: 25.0.50; tls.el uses option --insecure
Date: Tue, 29 Dec 2015 19:25:48 +0000 [thread overview]
Message-ID: <87y4cdvyyr.fsf@violet.siamics.net> (raw)
In-Reply-To: <87k2ny1b8a.fsf@lifelogs.com> (Ted Zlatanov's message of "Mon, 28 Dec 2015 17:04:21 -0500")
>>>>> Ted Zlatanov <tzz@lifelogs.com> writes:
>>>>> On Sat, 26 Dec 2015 22:15:45 +0100 Lars Ingebrigtsen wrote:
>> As Stefan said in a different report -- perhaps we should just
>> require Emacs with built-in TLS support if you want to use TLS.
>> That would essentially mean that we should just remove tls.el and
>> starttls.el.
>> Alternatively we could, in Emacs 25.1, just remove the --insecure
>> settings
FWIW, I tend to support this option.
>> and let people who try to connect to their IMAP server just fail
>> somewhat mysteriously (it's very common to have self-signed certs
>> for IMAP).
I see little value in self-signed certificates in general,
especially given that there’s for a long-time a community-driven
CA who offer X.509 certificates free of charge.
Sure, for a small group, and assuming typical “desktop” TLS
clients, self-signed certificates can be used to implement a
public key dissemination model akin to that’s typical of SSH.
However, I’ve seen them being used on MXes facing the world
(say, the MX that serves bugs.debian.org), and I fail to see any
point whatsoever in that.
> I am in favor of either option and I think the first is cleaner.
> There will be a small but vocal group that wants to use the external
> tunnel utility.
… Or there will be a group with a small number of its members
being vocal; the difference may be not that easy to tell.
To note is that Gnus’ nnimap method has its own “tunnel utility”
support, which I use to interface the local IMAP server (below),
and which (I suppose) could be used in place of tls.el.
(nnimap-stream shell)
(nnimap-shell-program "MAIL=maildir:\"$HOME\"/Maildir imapd")
That said, the lack of possibility to use something similar for
non-nnimap connections is not something I’d appreciate.
I’ve sure seen external utility support in other software, too.
Check the OpenSSH client’s ProxyCommand option, for instance.
> I think the benefit to the rest of the users will be worth it, and
> that group can have a ELPA package to support them.
As long as the hooks are in place to route the requests via that
package, I have no (strong) objections to the move. But given
that tls.el is about 300 LoC in total, and hardly incurs a high
maintenance cost, I don’t see much value in the move, either.
--
FSF associate member #7257 http://am-1.org/~ivan/ … 3013 B6A0 230E 334A
next prev parent reply other threads:[~2015-12-29 19:25 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-05 19:43 bug#19284: 25.0.50; tls.el uses option --insecure Jens Lechtenboerger
2015-12-26 21:15 ` Lars Ingebrigtsen
2015-12-26 21:39 ` Andreas Schwab
2015-12-26 21:49 ` Lars Ingebrigtsen
2015-12-27 9:59 ` Andreas Schwab
2015-12-28 22:04 ` Ted Zlatanov
2015-12-29 13:29 ` Lars Ingebrigtsen
2015-12-29 19:25 ` Ivan Shmakov [this message]
2015-12-30 14:46 ` Ted Zlatanov
2015-12-30 15:57 ` Ivan Shmakov
2015-12-30 16:38 ` Ted Zlatanov
2015-12-30 18:22 ` Lars Magne Ingebrigtsen
2015-12-31 16:00 ` Ted Zlatanov
2015-12-31 18:32 ` Ivan Shmakov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y4cdvyyr.fsf@violet.siamics.net \
--to=ivan@siamics.net \
--cc=19284@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.