Re: [Emacs-diffs] /srv/bzr/emacs/trunk r104668: Set :use-starttls-if-possible so that we always use STARTTLS if the server supports it.

Re: [Emacs-diffs] /srv/bzr/emacs/trunk r104668: Set :use-starttls-if-possible so that we always use STARTTLS if the server supports it.

[Stefan Monnier]

>   Set :use-starttls-if-possible so that we always use STARTTLS if the
>   server supports it.

Looks like an ugly hack.  The explanation for what it does is unclear,
and there's a good reason for that: what it does (and the reason for
its existence) has to do with a failure of the non-builtin gnutls code
to do what it's requested to do.
So this option should be called something like "work-around-bug" or
"dont-optimize" or something.

But I'd first like to understand more precisely why it is that the
non-builtin code doesn't handle it right in the first place.


        Stefan

Re: [Emacs-diffs] /srv/bzr/emacs/trunk r104668: Set :use-starttls-if-possible so that we always use STARTTLS if the server supports it.

[Lars Magne Ingebrigtsen]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

> But I'd first like to understand more precisely why it is that the
> non-builtin code doesn't handle it right in the first place.

Like I said before committing that code:

> So I'm wondering what's the best approach here.

> 1) `open-network-stream' can do opportunistic STARTTLS upgrades for all
> protocols, using the external STARTTLS support.  This will be slower,
> and may be more buggy.

> 2) I can add yet another parameter to `open-network-stream',
> :always-use-starttls-if-possible, and have smtpmail.el set it.  This
> will have least impact overall, but, like, adds yet another parameter,
> so it's kinda tacky.

> I think I'll do 2) for now to get things working, and we can reexamine
> this later.

Using the external STARTTLS will quite often work, unless your
gnutls-cli installation is broken.  (I.e., if you're using Windows, from
the error reports I've gotten.  :-)

However, using the external STARTTLS means first connecting to the
server, querying it for STARTTLS, dropping the connection, starting
gnutls-cli and connecting to the server again, which I think is slightly
uncouth.  Especially if we're doing it opportunistically for protocols
like NNTP, where STARTTLS really isn't what the user expects.  (I.e.,
it's nice if we can get it for free, but it's not really important if we
can't get it.)

So...  there we are.

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/