From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Lars Magne Ingebrigtsen Newsgroups: gmane.emacs.devel Subject: Re: The SHA1 sunset Date: Mon, 04 Jan 2016 23:15:56 +0100 Message-ID: References: <83fuyead32.fsf@gnu.org> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1451945952 16112 80.91.229.3 (4 Jan 2016 22:19:12 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 4 Jan 2016 22:19:12 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Mon Jan 04 23:19:02 2016 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1aGDSv-0007wA-A3 for ged-emacs-devel@m.gmane.org; Mon, 04 Jan 2016 23:19:01 +0100 Original-Received: from localhost ([::1]:47337 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aGDSu-0004g8-Mo for ged-emacs-devel@m.gmane.org; Mon, 04 Jan 2016 17:19:00 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:44482) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aGDSg-0004fj-Ai for emacs-devel@gnu.org; Mon, 04 Jan 2016 17:18:50 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aGDSb-0004VS-AO for emacs-devel@gnu.org; Mon, 04 Jan 2016 17:18:46 -0500 Original-Received: from hermes.netfonds.no ([80.91.224.195]:34846) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aGDSb-0004VI-3e for emacs-devel@gnu.org; Mon, 04 Jan 2016 17:18:41 -0500 Original-Received: from cm-84.215.1.64.getinternet.no ([84.215.1.64] helo=stories) by hermes.netfonds.no with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.72) (envelope-from ) id 1aGDPx-0003Of-7C for emacs-devel@gnu.org; Mon, 04 Jan 2016 23:15:57 +0100 Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAHlBMVEUQCQwfGBL+//JWTjYM BgsKBAn///8FAQPl2sEHAgTVb6JyAAACWUlEQVQ4jV2UsWvjMBTGJeJAbrNQCpl9EDzGVQ88ulSG 6+Zy1pC1g+l4SzEdYx1B4x2cCfpv73uSHaf3hkD00/e+J+k9M9NqXTEKcRspG40xEyhEmqbg4R/D uk7CdlmEnXMAtBpAFgoRt2sEpQrrSpWOCEsSPYNK0Lp1zll1YCzRFdXjR8OkwHY3ZJlTMAkKAAgk 1rOs67rcFoIUCerxhtP+fUfxamF/VXCpXNbFyC3ZB3M/Agz7CUBShHIrNo6Pshy6OZwq0qTWLVK1 XLnrepcTiB4Ai6B7sxGw/8ErCp4UnyxCwdHcc1lmn0Gq2wl0N0FlxXK5uHf7ReFiKoZzVKo8Lwry qENVYyXUAt6iOR67HzWXS1n5DWi5dDcWuHgWUnnNFgUE8Xqh8G0l7vfXU6h4cgKm4i7bTwJqoSR6 AKzQB/t4OpFydlU0K/QObLLuKzkv4GUlBN4kdy4v0thuAfiGmtOhUjUUUx/CpPeXPyuVSkfG8sRu FJe/6DLpzhYFOVYlM3hveNpqIc8ngN1B6wl8YAKauik25YFL5LqCseJC1FLtCrZCDTZmgnnLCAix EeyJcj1UM8DphdFmI7ePACvkqkPDGeTjz0e/USkNJUOuOgwZDQ579mYnixfcOCsfCGDKvMe9j/64 Ky2nCXw6aUNzSeDjy2/fl0O+lWJdNzYoTACXvo+gWBtTbgkc2SUs970a8rsfW+/Hp1/m4scj62N8 2CEXUPuxscbfgHd774q17zHE5R1+ruCnHTJ7B+CP378FjxnQB2N99CMeFKA1M+jxxAiYmHCM+h+2 yD8khyOT2gAAAABJRU5ErkJggg== In-Reply-To: (John Wiegley's message of "Sun, 03 Jan 2016 17:05:17 -0800") User-Agent: Gnus/5.130014 (Ma Gnus v0.14) Emacs/25.1.50 (gnu/linux) X-MailScanner-ID: 1aGDPx-0003Of-7C MailScanner-NULL-Check: 1452550616.32387@7S2U24T6BI0z9dhGYPK9nw X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.224.195 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:197633 Archived-At: John Wiegley writes: >>>>>> Lars Magne Ingebrigtsen writes: > >> On the fourth hand, we release Emacs so seldomly that we have to plan for >> the future, so perhaps it should be in "medium" anyway. > > Yeah, that was my thinking. Mm. I wonder what the percentage of TLS certificates are SHA-1 these days... anybody have statistics? A user just discovered that the (self-signed) certificate on news.gmane.org is SHA-1, for instance. :-) >> It would have been nice if Emacs had a way to retroactively change these >> things. I mean, "push" very, very selective security-related updates on >> users... Hm... could we imagine using the package system for doing security >> updates? It would mean that Emacs would "call home" once in a while... > > Or associate your warnings with times, and after a certain date being > proclaiming that doom is likely upon them. :-) -- (domestic pets only, the antidote for overdose, milk.) bloggy blog: http://lars.ingebrigtsen.no