From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Juanma Barranquero Newsgroups: gmane.emacs.devel Subject: Re: GnuTLS for W32 Date: Fri, 6 Jan 2012 15:35:44 +0100 Message-ID: References: <877h17scdo.fsf@wanadoo.es> <87hb0b77nr.fsf@lifelogs.com> <8739bvs27m.fsf@wanadoo.es> <87ty4b4329.fsf@lifelogs.com> <87hb0b3yoe.fsf@lifelogs.com> <6ED011D5-E185-44C6-BB31-A445A4E5F83A@gmail.com> <87wr976otx.fsf@lifelogs.com> <87ipkq6yy5.fsf@lifelogs.com> <87boqi6tzz.fsf@linux-hvfx.site> <87ehve3ul8.fsf@lifelogs.com> <87lipl22xm.fsf@lifelogs.com> <87boqh20ha.fsf@lifelogs.com> <877h151x01.fsf@lifelogs.com> <87y5tkzzwp.fsf@lifelogs.com> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Trace: dough.gmane.org 1325860597 9025 80.91.229.12 (6 Jan 2012 14:36:37 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Fri, 6 Jan 2012 14:36:37 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Fri Jan 06 15:36:34 2012 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([140.186.70.17]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1RjAuF-0006pm-8a for ged-emacs-devel@m.gmane.org; Fri, 06 Jan 2012 15:36:31 +0100 Original-Received: from localhost ([::1]:38522 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RjAuE-0003YM-Mb for ged-emacs-devel@m.gmane.org; Fri, 06 Jan 2012 09:36:30 -0500 Original-Received: from eggs.gnu.org ([140.186.70.92]:59573) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RjAuB-0003Xq-Rr for emacs-devel@gnu.org; Fri, 06 Jan 2012 09:36:29 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RjAuA-0000Vs-Db for emacs-devel@gnu.org; Fri, 06 Jan 2012 09:36:27 -0500 Original-Received: from mail-pz0-f41.google.com ([209.85.210.41]:64394) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RjAuA-0000Ve-8s for emacs-devel@gnu.org; Fri, 06 Jan 2012 09:36:26 -0500 Original-Received: by dakl33 with SMTP id l33so1450503dak.0 for ; Fri, 06 Jan 2012 06:36:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type:content-transfer-encoding; bh=MqzqI6rl7vFoKX6vyI/rPBtGh6lDeUKN9AS0ukimct0=; b=wgk5NoAlK+vF0KL9zq6/BmB92LBpzwsvZstrUYp4SniWQ9HTriQ4J7tKbK3kUVLzda NWbMENOrYJw5waZqzJhGviLB9cKqAxP4xJ7LwyuavU/7zdwC2ULYXv1AadASbeLqV03I UMl0Xjinnx+nJQpNi8BOqs7TNaCLAZbybo/P8= Original-Received: by 10.68.73.135 with SMTP id l7mr15884330pbv.57.1325860585186; Fri, 06 Jan 2012 06:36:25 -0800 (PST) Original-Received: by 10.142.247.28 with HTTP; Fri, 6 Jan 2012 06:35:44 -0800 (PST) In-Reply-To: <87y5tkzzwp.fsf@lifelogs.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-Received-From: 209.85.210.41 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:147399 Archived-At: 2012/1/6 Ted Zlatanov : > The intention is to do whatever is appropriate on the platform to let > the user know they need to update and make the update easy. There's no single, general definition of "appropriate". > I'm not. =C2=A0The risk is not worth the effort with image libraries. I don't understand why. Buffer overruns exploited through carefully-crafted images have been used before. I would fear that (as a vector for malware) much more than someone eavesdropping my communications. > You're ignoring the "deeply embedded" part. =C2=A0Obviously external > utilities are not able to compromise Emacs like internal C glue. =C2=A0Ca= n > you stick to comparable components like the libxml2 glue? See the image libraries comment above. > If you don't think the package manager is important to our users, you've > got your head stuck in the sand. I don't know about "our" users, but certainly is unimportant to many Emacs users (starting with myself). And, please, let's not turn this discussion into a description of the relative positions of our respective heads or other body parts. > I appreciate your attention to detail, but "need" is the verb I meant to > write there. I don't doubt it. My correction turned what you said into what I believe is real. > SSH clients are not extensible layout engines with embedded interpreters > and flexible package managers. =C2=A0As I keep saying, compare Emacs to > Firefox and Chrome, not to `vim' or `ssh' and `grep'. =C2=A0It hasn't bee= n > just an editor in a long while. =C2=A0Eclipse is another good comparison > point. Compare it to Apache, which can be infinitely extended via external modules and it's mission-critical for so many business. > That's oversimplifying the problem, but yes, this is the fundamental > question. You think it's an oversimplification, I think it's approaching it in a realistic way. > I was planning on that next. =C2=A0How did you know? With the head under the sand I had plenty of time to think, and I started having premonitions. > No, it's not like that at all. =C2=A0Intrusion detection and security > advisories are completely different things. I thought it was evident I was not comparing situations, but inadequate feelings of security. =C2=A0 =C2=A0 Juanma