From: David De La Harpe Golden <david@harpegolden.net>
To: emacs-devel@gnu.org
Subject: Re: Making GNUS continue to work with Gmail
Date: Mon, 17 Aug 2020 17:05:58 +0100 [thread overview]
Message-ID: <d5251934-e98c-c4c7-e5fb-790a88dfc303@harpegolden.net> (raw)
In-Reply-To: <alpine.NEB.2.21.2008170916570394.24165@sdf.lonestar.org>
On 17/08/2020 08:51, Gregory Heytings via Emacs development discussions.
wrote:
> (Note that doing this (that is, including an app key in free software)
> also violates Google's terms of service. But apparently Google
> tolerates that these terms are violated by Kmail, Thunderbird and
> others, so would presumably also tolerate that they be violated by GNUS.)
>
Well, they're legal terms not program code. Apart from them just
tolerating/overlooking it, things can also happen between parties under
terms different to or supplemental to some generic published standard
terms, Cesar's point that the FSF could talk to Google about it on an
official basis certainly stands.
The legal side may just not have caught up with evolving native app /
public client not-a-secret usage anyway, the terms seem more suited to
traditional server-side web apps, still a common use case for oauth2
(contrast e.g. [1] and [2]).
I expect it's actually Mozilla and KDE representatives that self-service
manage their respective registrations via the relevant google api
console, not Google employees, in their cases, but it is also possible
to imagine (however unlikely in practice) Google and the FSF taking a
different approach and agreeing to a Google employee instead managing
and issuing on their side some client id(s) for various uses to the FSF
i.e. rather than an FSF representative agreeing to the generic terms and
logging in and self-service managing clients (though that has associated
loss of self-service control e.g. branding during the auth flow etc).
Then sending the client to the FSF under some sort of alternative legal
terms along the lines of "actually this here client id can be embedded
in emacs gnus sources under the GPL, it's fine, despite what those
generic terms say, Note it will only actually work for oauth2 if auth
code with pkce and a localhost redirect_uri flow is used. And google may
also temporarily or permanently cease recognising this client id at any
time for any reason, and a new client id may or may not be issued". A
Google employee contributing an actual source code patch with such a
client id embedded would make that rather on-the-record. Not saying
that is especially desirable or google would be likely to go for that
option anwyay, just seems another possible in principle thing worth
mentioning.
[1] https://auth0.com/docs/flows/authorization-code-flow
"""
Because regular web apps are server-side apps where the source code is
not publicly exposed, they can use the Authorization Code Flow (defined
in OAuth 2.0 RFC 6749, section 4.1), which exchanges an Authorization
Code for a token. Your app must be server-side because during this
exchange, you must also pass along your application's Client Secret,
which must always be kept secure, and you will have to store it in your
client.
"""
[2]
https://auth0.com/docs/flows/authorization-code-flow-with-proof-key-for-code-exchange-pkce
"""
When public clients (e.g., native and single-page applications) request
Access Tokens, some additional security concerns are posed that are not
mitigated by the Authorization Code Flow alone. This is because:
Native apps Cannot securely store a Client Secret. Decompiling the app
will reveal the Client Secret, which is bound to the app and is the same
for all users and devices.
[...]
To mitigate this, OAuth 2.0 provides a version of the Authorization Code
Flow which makes use of a Proof Key for Code Exchange (PKCE) (defined in
OAuth 2.0 RFC 7636).
"""
next prev parent reply other threads:[~2020-08-17 16:05 UTC|newest]
Thread overview: 158+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-19 2:05 bug#41386: 28.0.50; Gnus nnimap OAuth 2.0 support Thomas Fitzsimmons
2020-05-19 12:46 ` Lars Ingebrigtsen
2020-05-19 12:58 ` Noam Postavsky
2020-05-19 13:12 ` Lars Ingebrigtsen
2020-05-20 4:02 ` Richard Stallman
2020-05-19 15:37 ` Thomas Fitzsimmons
2020-05-19 16:00 ` David Engster
2020-05-19 16:12 ` Lars Ingebrigtsen
2020-05-20 3:59 ` Richard Stallman
2020-05-20 13:32 ` Stefan Kangas
2020-05-20 16:16 ` Thomas Fitzsimmons
2020-05-21 3:45 ` Richard Stallman
2020-07-19 1:29 ` Lars Ingebrigtsen
2020-07-20 2:40 ` Richard Stallman
2020-08-10 16:13 ` Simon Leinen
2020-08-11 3:28 ` Richard Stallman
2020-08-11 20:56 ` Simon Leinen
2020-05-22 3:07 ` Richard Stallman
2020-05-22 8:28 ` David Engster
2020-05-20 3:53 ` Richard Stallman
2020-05-20 14:05 ` Thomas Fitzsimmons
2020-05-21 3:47 ` Richard Stallman
2020-05-21 14:30 ` Thomas Fitzsimmons
2020-05-22 3:09 ` Richard Stallman
2020-05-23 15:49 ` Thomas Fitzsimmons
2020-05-24 3:54 ` Richard Stallman
2020-05-24 14:35 ` Thomas Fitzsimmons
2020-05-25 4:38 ` Richard Stallman
2020-07-23 4:07 ` Richard Stallman
2020-07-23 13:22 ` Lars Ingebrigtsen
2020-07-24 3:33 ` Richard Stallman
2020-07-24 14:54 ` Lars Ingebrigtsen
2020-07-25 3:49 ` Richard Stallman
2020-07-27 21:55 ` Lars Ingebrigtsen
2020-07-30 0:39 ` 황병희
2020-07-30 3:04 ` Richard Stallman
2020-08-06 3:45 ` Making GNUS continue to work with Gmail Richard Stallman
2020-08-06 5:51 ` 황병희
2020-08-06 17:08 ` Cesar Crusius
2020-08-06 17:32 ` Robert Pluim
2020-08-06 18:09 ` Cesar Crusius
2020-08-11 13:43 ` Colin Baxter
2020-08-11 13:55 ` Colin Baxter
2020-08-11 15:19 ` Uwe Brauer
2020-08-11 15:22 ` Uwe Brauer
2020-08-11 16:02 ` Colin Baxter
2020-08-12 2:29 ` Richard Stallman
2020-08-12 5:29 ` Colin Baxter
2020-08-07 2:56 ` Richard Stallman
2020-08-07 17:02 ` Cesar Crusius
2020-08-07 18:37 ` Michael Anckaert
2020-08-08 0:01 ` Cesar Crusius
2020-08-08 0:53 ` T.V Raman
2020-08-08 3:53 ` Richard Stallman
2020-08-08 3:53 ` Richard Stallman
2020-08-08 3:54 ` Richard Stallman
2020-08-09 7:59 ` Uwe Brauer
2020-08-09 8:40 ` Lars Ingebrigtsen
2020-08-09 10:02 ` Uwe Brauer
2020-08-10 3:23 ` Richard Stallman
2020-08-10 6:43 ` Uwe Brauer
2020-08-10 9:03 ` Robert Pluim
2020-08-10 11:36 ` Uwe Brauer
2020-08-11 3:30 ` Richard Stallman
2020-08-09 10:06 ` Uwe Brauer
2020-08-09 10:36 ` Lars Ingebrigtsen
2020-08-09 10:57 ` Robert Pluim
2020-08-09 11:03 ` Robert Pluim
2020-08-09 13:06 ` 황병희
2020-08-09 16:04 ` Uwe Brauer
2020-08-09 13:01 ` 황병희
2020-08-09 16:06 ` Uwe Brauer
2020-08-10 1:03 ` 황병희
2020-08-10 15:54 ` T.V Raman
2020-08-11 2:40 ` 황병희
2020-08-11 9:59 ` Robert Pluim
2020-08-11 12:54 ` 황병희
2020-08-11 15:25 ` Uwe Brauer
2020-08-11 16:11 ` Robert Pluim
2020-08-11 18:05 ` João Távora
2020-08-11 18:17 ` Robert Pluim
2020-08-12 2:27 ` Richard Stallman
2020-08-12 4:27 ` 황병희
2020-08-12 3:41 ` arthur miller
2020-08-12 6:42 ` tomas
2020-08-12 12:11 ` Arthur Miller
2020-08-12 15:55 ` Stefan Monnier
2020-08-12 16:00 ` tomas
2020-08-12 6:54 ` Uwe Brauer
2020-08-12 7:53 ` tomas
2020-08-12 12:40 ` Uwe Brauer
2020-08-13 2:09 ` 황병희
2020-08-13 2:51 ` Stefan Monnier
2020-08-13 6:48 ` Uwe Brauer
2020-08-12 11:30 ` Eric S Fraga
2020-08-12 12:40 ` Arthur Miller
2020-08-12 13:02 ` Eric S Fraga
2020-08-12 17:13 ` Eric Abrahamsen
2020-08-13 15:39 ` David De La Harpe Golden
2020-08-13 17:40 ` David Engster
2020-08-13 17:53 ` Stefan Monnier
2020-08-14 10:06 ` Lars Ingebrigtsen
2020-08-15 4:35 ` Richard Stallman
2020-08-14 10:13 ` Lars Ingebrigtsen
2020-08-14 14:49 ` Uwe Brauer
2020-08-14 14:56 ` Lars Ingebrigtsen
2020-08-14 17:24 ` Uwe Brauer
2020-08-14 17:39 ` Cesar Crusius
2020-08-15 4:44 ` Richard Stallman
2020-08-15 9:45 ` Gregory Heytings via Emacs development discussions.
2020-08-17 6:00 ` 范凯
2020-08-17 8:23 ` tomas
2020-08-17 12:30 ` Gregory Heytings via Emacs development discussions.
2020-08-17 15:09 ` tomas
2020-08-17 13:03 ` David De La Harpe Golden
2020-08-15 11:09 ` Robert Pluim
2020-08-16 4:13 ` Richard Stallman
2020-08-16 8:17 ` Gregory Heytings via Emacs development discussions.
2020-08-17 3:23 ` Richard Stallman
2020-08-17 7:51 ` Gregory Heytings via Emacs development discussions.
2020-08-17 16:05 ` David De La Harpe Golden [this message]
2020-08-18 4:08 ` Richard Stallman
2020-08-18 9:15 ` Gregory Heytings via Emacs development discussions.
2020-08-21 3:38 ` Richard Stallman
2020-08-21 17:16 ` Gregory Heytings via Emacs development discussions.
2020-08-22 7:24 ` Arthur Miller
2020-08-22 9:44 ` Gregory Heytings via Emacs development discussions.
2020-08-23 4:46 ` Richard Stallman
2020-08-17 15:02 ` Uwe Brauer
2020-08-17 16:44 ` Gregory Heytings via Emacs development discussions.
2020-08-17 19:34 ` Uwe Brauer
2020-08-17 21:47 ` Gregory Heytings via Emacs development discussions.
2020-08-18 4:10 ` Richard Stallman
2020-08-18 4:11 ` Richard Stallman
2020-08-26 14:44 ` Eric S Fraga
2020-08-26 20:22 ` Pierre Téchoueyres
2020-08-27 11:25 ` Eric S Fraga
2020-08-27 2:50 ` Richard Stallman
2020-08-27 11:28 ` Eric S Fraga
2020-08-27 12:03 ` tomas
2020-08-27 12:26 ` Making GNUS continue to work with Gail Eric S Fraga
2020-08-27 12:30 ` Making GNUS continue to work with Gmail Andrew Cohen
2020-08-27 12:52 ` Eric S Fraga
2020-08-28 3:49 ` Richard Stallman
2020-08-28 5:35 ` Andrew Cohen
2020-08-29 4:10 ` Richard Stallman
2020-08-28 3:50 ` Richard Stallman
2020-09-01 16:23 ` Uwe Brauer
2020-09-02 9:57 ` Pankaj Jangid
2020-08-15 19:39 ` Cesar Crusius
2020-08-16 17:23 ` David De La Harpe Golden
2020-08-16 11:54 ` Uwe Brauer
2020-08-16 14:27 ` David De La Harpe Golden
2020-08-11 16:09 ` Mingde (Matthew) Zeng
2020-08-12 2:28 ` Richard Stallman
2020-08-12 6:47 ` tomas
2022-10-29 15:36 ` bug#41386: 28.0.50; Gnus nnimap OAuth 2.0 support Björn Bidar via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-30 12:22 ` Deus Max
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d5251934-e98c-c4c7-e5fb-790a88dfc303@harpegolden.net \
--to=david@harpegolden.net \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.