Earlier quoted context omitted.
Yes, but who actually does that?
There are tons of people who read email in Emacs, mu4e is great. Browsing the web is probably less common.
Don’t all of the package managers use the web?
Emacs and TLS
11–20 of 83 posts
Re: Emacs and TLS
#12Earlier quoted context omitted.
You answered it yourself: When you browse the web and read email.
Yes, but who actually does that?
I use exwm (emacs) as my windows manager, rcirc as my irc client, eww as my browser, gnus for email, magit for git, tramp for remote control. All of these tools make use of TLS. Honestly, I literally live my life on a computer. If you do it to the extreme that I do then you will find that customizing your experience becomes important. Emacs is designed from the ground up for customizability.
Re: Emacs and TLS
#13I'm the new guy mentioned in the article. This article is a bit late to the party and misses a lot of details that I've discovered since June.
One of the reasons prompted this giant thread on the emacs-devel mailing list is when I was updating my Emacs config to try out Gnus for email and newsgroup, I discovered that no one seems to know exactly what a good TLS Emacs config should look like and that Emacs comes with horrible defaults. In addition, I was shocked that I've been exposed to a dozen TLS vulns that might cause arbitrary code execution the whole time since package.el became a part of Emacs back in circa-2013. After stuffing myself with about a dozen RFCs and many dozen more papers and Chrome and Firefox blog posts, here's what I found very concerning:
1. The initial "a bit concerning" and "very concerning" qualifiers I originally posted aren't as clear cut anymore, most of the 2 dozen failing badssl tests are actually quite bad.
2. NSM has got half a foot in the 2010s and half a foot in the 2000s. The latest stable version of Emacs (26.1) only checks for SHA1 end-certificate, usage of SSL, DH 3. The half-done pinning mechanism does Trust on First Use while the user can't even see the entire cert chain or the end cert.
4. Only one fingerprint per host for TOFU, where Google low balances at least between 2 end-certs AFAIK.
5. Excessive and theatrical prompts for any URL that has not been visited on a security level called 'paranoid.
6. Multiple prompts for different problems found for the same TLS handshake.
7. Setting one option in a configuration group called GnuTLS to true bypasses NSM entirely. i.e. no cipher suite checks and happily accepts any 256-bit DH key exchange attempts.
8. No attempt to do any OCSP or Certificate Transparency revocation checking.
9. 4 packages intermingled with each other all securing some network connections badly with no documented relationships between them.
10. Virtually no one who has commit access to the Emacs repo understands TLS.
11. RMS prefixes every one of his email with:
[[[ To any NSA and FBI agents reading my email: please consider ]]]
[[[ whether defending the US Constitution against all enemies, ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]
The good news is, a few of these problems are already fixed on master and I've pushed a branch called "netsec" to the Emacs repo last week that fixes most of the rest. OCSP is coming this weekend. CT is going to wait quite a bit longer as GnuTLS has no plan to support it anytime soon. I have hope to make at least some of these security fixes to Emacs 26.2 or 26.3 in the short term. Medium term plan is to lobby for requiring TLS for all email protocols because RFC 8314. The long plan is obviously support TLS 1.3 for Emacs 27, and possibly HTTP2.
Re: Emacs and TLS
#14> It isn't the Emacs way to second-guess our users' needs, definitely not to decide for them what is and what isn't a matter of life and death for them. We provide options with some reasonable defaults, and then let users make informed decisions which defaults are not good enough for them.
> It is IMO unreasonable to make our defaults match what happens in dictatorships that you describe, because that would unnecessarily inconvenience the majority of the users. Let's not follow the bad example of the TSA (whose rationale is, unsurprisingly, also matters of life and death).
Here's that same response in an alternate Gnuniverse where software development is... different...:
"Thanks, Jimmy. Security is outside my wheelhouse, so let me run your ideas by a security researcher I already know and trust. Then we'll figure out the most effective way to improve TLS in Emacs without creating a maintenance burden for the project.
Best, A sensible developer who knows what they don't know"
Re: Emacs and TLS
#15> It isn't the Emacs way to second-guess our users' needs, definitely not to decide for them what is and what isn't a matter of life and death for them. We provide options with some reasonable defaults, and then let users make informed decisions which defaults are not good enough for them. > It is IMO unreasonable to make our defaults match what happens in dictatorships that you describe, because that would unnecessa…
LOL, if only. It'll certainly save me a lot of work.
//edit BTW, those aren't my words, those are Eli's responding to Perry
Re: Emacs and TLS
#16I'm the new guy mentioned in the article. This article is a bit late to the party and misses a lot of details that I've discovered since June. One of the reasons prompted this giant thread on the emacs-devel mailing list is when I was updating my Emacs config to try out Gnus for email and newsgroup, I discovered that no one seems to know exactly what a good TLS Emacs config should look like and that Emacs comes with…
Your point #11 is a bit distasteful.
Beyond that, npm is far more vulnerable. But it rarely matters. The reason is culture and community.
Re: Emacs and TLS
#17I am missing something here. Emacs is a text/programmer's editor (I know you browse the web, read email, talk to eliza, etc...), but where is TLS being used exactly? (BTW, I have been using emacs since at least the early 90's, but never did anything requiring TLS).
Do you ever install packages from Emacs? If so, you definitely want that to be at least TLS protected.
https://glyph.twistedmatrix.com/2015/11/editor-malware.html is a post describing the problem and some solutions. I haven't checked to see how many of the steps are still necessary on Emacs 26, but I bet it's still non-zero.
Re: Emacs and TLS
#18I'm the new guy mentioned in the article. This article is a bit late to the party and misses a lot of details that I've discovered since June. One of the reasons prompted this giant thread on the emacs-devel mailing list is when I was updating my Emacs config to try out Gnus for email and newsgroup, I discovered that no one seems to know exactly what a good TLS Emacs config should look like and that Emacs comes with…
Your point #11 is a bit distasteful. Beyond that, npm is far more vulnerable. But it rarely matters. The reason is culture and community.
I appreciate you announcing your preference of taste, but honestly, if you don't have anything of substance to add to the conversation, please don't pollute the thread.
Re: Emacs and TLS
#19Earlier quoted context omitted.
Your point #11 is a bit distasteful. Beyond that, npm is far more vulnerable. But it rarely matters. The reason is culture and community.
I appreciate you announcing your preference of taste, but honestly, if you don't have anything of substance to add to the conversation, please don't pollute the thread.
I'm a former pentester. I used to do this kind of work for a living. Secondly, the Snowden leaks were one of the most important events in modern history, and you're on here using them as a cheap way to push your own agenda. Thirdly, RMS hasn't been an active emacs developer for quite awhile, but you're still trying to criticize him.
To bring this back to the topic at hand: npm as an ecosystem is far more vulnerable than the points you mention. It's worth considering why people do not routinely pwn those who use npm. The fact that you are vulnerable does not mean it's a good idea to try to throw an entire ecosystem under the bus.
Re: Emacs and TLS
#20Earlier quoted context omitted.
I appreciate you announcing your preference of taste, but honestly, if you don't have anything of substance to add to the conversation, please don't pollute the thread.
I'm a former pentester. I used to do this kind of work for a living. Secondly, the Snowden leaks were one of the most important events in modern history, and you're on here using them as a cheap way to push your own agenda. Thirdly, RMS hasn't been an active emacs developer for quite awhile, but you're still trying to criticize him. To bring this back to the topic at hand: npm as an ecosystem is far more vulnerable t…
What's my agenda exactly and why do you think I'm criticizing RMS? Is that quote my words? And what does being a former pentester have to do with anything you said? Which ecosystem am I throwing under the bus?