From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.devel Subject: Re: GnuTLS for W32 Date: Sat, 07 Jan 2012 08:28:11 -0500 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87y5tjr6ac.fsf@lifelogs.com> References: <87hb0b3yoe.fsf@lifelogs.com> <6ED011D5-E185-44C6-BB31-A445A4E5F83A@gmail.com> <87wr976otx.fsf@lifelogs.com> <87ipkq6yy5.fsf@lifelogs.com> <87boqi6tzz.fsf@linux-hvfx.site> <87ehve3ul8.fsf@lifelogs.com> <87lipl22xm.fsf@lifelogs.com> <87boqh20ha.fsf@lifelogs.com> <877h151x01.fsf@lifelogs.com> <87y5tkzzwp.fsf@lifelogs.com> <87r4zczwbq.fsf@lifelogs.com> <87aa60yduw.fsf@lifelogs.com> <87d3av95eg.fsf@gnu.org> Reply-To: emacs-devel@gnu.org NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: dough.gmane.org 1325942918 11323 80.91.229.12 (7 Jan 2012 13:28:38 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Sat, 7 Jan 2012 13:28:38 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sat Jan 07 14:28:34 2012 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([140.186.70.17]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1RjWK2-000281-0O for ged-emacs-devel@m.gmane.org; Sat, 07 Jan 2012 14:28:34 +0100 Original-Received: from localhost ([::1]:53089 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RjWK1-0006kj-JC for ged-emacs-devel@m.gmane.org; Sat, 07 Jan 2012 08:28:33 -0500 Original-Received: from eggs.gnu.org ([140.186.70.92]:45377) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RjWJy-0006kU-Lq for emacs-devel@gnu.org; Sat, 07 Jan 2012 08:28:31 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RjWJw-0005C8-U9 for emacs-devel@gnu.org; Sat, 07 Jan 2012 08:28:30 -0500 Original-Received: from lo.gmane.org ([80.91.229.12]:57471) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RjWJw-0005Bs-LW for emacs-devel@gnu.org; Sat, 07 Jan 2012 08:28:28 -0500 Original-Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1RjWJs-00023A-OU for emacs-devel@gnu.org; Sat, 07 Jan 2012 14:28:24 +0100 Original-Received: from c-76-28-40-19.hsd1.vt.comcast.net ([76.28.40.19]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 07 Jan 2012 14:28:24 +0100 Original-Received: from tzz by c-76-28-40-19.hsd1.vt.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 07 Jan 2012 14:28:24 +0100 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: emacs-devel@gnu.org Original-Lines: 59 Original-X-Complaints-To: usenet@dough.gmane.org X-Gmane-NNTP-Posting-Host: c-76-28-40-19.hsd1.vt.comcast.net User-Agent: Gnus/5.110018 (No Gnus v0.18) Emacs/24.0.90 (gnu/linux) X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never Cancel-Lock: sha1:CcASbmxqbVst2BWgiuVFCwGpozw= X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-Received-From: 80.91.229.12 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:147442 Archived-At: On Sat, 07 Jan 2012 18:24:39 +0800 Chong Yidong wrote: CY> - First of all, any change involving distributing GnuTLS with Emacs CY> should be post-24.1. OK; see below. CY> - Phoning home on startup by default is out of the question. There are CY> lots of users with the "open Emacs many times" usage pattern, even CY> though that usage pattern is discouraged. Accessing the network for CY> each startup would be unreasonable, quite apart from the privacy CY> concerns (GNU knows each time you launch Emacs!) CY> - I am open to improvements to package.el to implement _periodic_ update CY> checking, and improvements to check for updates in M-x list-packages. CY> It is probably not too difficult to add some infrastructure to CY> highlight "strongly recommended updates" in the Package Menu. OK. How about a new variable `package-critical-packages' which is empty by default? When it has elements, Emacs will check on startup if those packages have been updated, and after the 24.1 release we can add highlighting to the package list, plus some UI to add/remove packages to the critical list. I would really like to get the basic functionality, off by default, into 24.1. I think the risk is minimal and the benefit to users is significant. The UI will also be simpler, just y/n to the update (no need for the "never bother me about this again" choice), since we know that any packages in the critical list were added by the user. I think periodic checks won't work well in the Emacs world, but perhaps I am misunderstanding what you mean. CY> - I agree with Lars' point that >> I don't really see that there's much of a difference between bugs in >> libgnutls and in the Emacs binary proper. If a major security hole was >> discovered in Emacs, then presumably a new Emacs release would be made. >> If a major libgnutls hole was discovered, then presumably someone would >> zip up a new Windows release. CY> If a really serious security flaw is found in GnuPG, and we are CY> distributing GnuPG with Emacs, we should make an Emacs security CY> release, exactly as though it was a security flaw in Emacs itself. OK. Since the consensus seems to be that the platform-specific installer's maintainers, not emacs-devel, should deal with installing GnuTLS and other third-party libraries, the responsibility for such security releases should be with the installer's maintainers, and each platform will have to figure out its own way to notify the user that there's a critical security update. If you agree, this work doesn't have to wait for the 24.1 release since it won't require changes to Emacs. For a W32 installer I can work with Joakim. For Mac OS X I don't know if the NS port, when bundled as an app, can include its own GnuTLS and other libraries, or if we'll require a real installer. On both those platforms self-updating should be possible. Does all of that make sense? Ted