Re: A couple of questions and concerns about Emacs network security
From: | Lars Ingebrigtsen <larsi-AT-gnus.org> | |
To: | Jimmy Yuen Ho Wong <wyuenho-AT-gmail.com> | |
Subject: | Re: A couple of questions and concerns about Emacs network security | |
Date: | Sun, 08 Jul 2018 19:53:42 +0200 | |
Message-ID: | <87bmbhmx5l.fsf@mouse.gnus.org> | |
Cc: | Paul Eggert <eggert-AT-cs.ucla.edu>, Emacs-Devel devel <emacs-devel-AT-gnu.org> | |
Archive-link: | Article |
Jimmy Yuen Ho Wong <wyuenho@gmail.com> writes: > The last thing I would suggest to Lars is, `gnutls-verify-error` will > effectively bypass NSM, so please don't pretend NSM is the be-all and > end-all layer for all matters related to Emacs' network security. It's > not, not until you consent to removing or changing some of the > standard values of the defcustoms in the 'gnutls group, or better yet. > Merge NSM and GnuTLS together, and rename some of the `gnutls group's > options. i.e. (define-obsolete-variable-alias 'gnutls-verify-error > 'nsm-bypass' "27.1"). Better UI/UX/DX design is almost always more > preferrable than documentation. Some people want these checks on the TLS level, and that's why those checks exist. It's perfectly reasonable for a user with a specific need (for instance, to talk to a particularly ornery old private SSL 0.9 server) to use the gnutls functions and variables directly when implementing their solution. That's why these things are layered. gnutls is a low-level library that allows tweaking certain things about the connections it provides. The NSM is a high-level user facing library. Merging the two doesn't seem to make much sense. Both here and in other places in this thread you seem to fixate on the particular use cases you're interested in to the extent that you say that other use cases are wrong, somehow. People have different needs and different approaches, and Emacs should empower them to get their work done, and not pressure them into doing it the way we think they should do it. -- (domestic pets only, the antidote for overdose, milk.) bloggy blog: http://lars.ingebrigtsen.no