Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emacs and TLS

lwn.net

Post reply on HN
Print view View original

51–60 of 83 posts

Re: Emacs and TLS

#51

Post by wyuenho »

vemv wrote: post #49
wyuenho wrote: post #42

Earlier quoted context omitted.

I don't know exactly why this solution won't work for you, there could be a number of issues at play here. In short, try this: 1. Reset all your 'tls 'nsm and 'gnutls customize options to their defaults. 2. $ rm -rf ~/.emacs.d/network-security.data 3. Install https://github.com/antifuchs/safe-tls-defaults-mode/blob/mas... This nice gentlement packaged up the settings I suggested on a Reddit thread. It should work mos…

Tried out, no luck unfortunately. With that setup, both E25 and E26 get stuck forever while trying to fill the `~/.emacs/d/elpa` directory (with an actual freeze and no feedback)

What about emacs -q ? Does the same issue still happen? If it doesn't, that sounds like a different package is locking up your emacs.

Re: Emacs and TLS

#52

Post by wyuenho »

akalin wrote: post #17
waynecochran wrote: post #2

I am missing something here. Emacs is a text/programmer's editor (I know you browse the web, read email, talk to eliza, etc...), but where is TLS being used exactly? (BTW, I have been using emacs since at least the early 90's, but never did anything requiring TLS).

Do you ever install packages from Emacs? If so, you definitely want that to be at least TLS protected. https://glyph.twistedmatrix.com/2015/11/editor-malware.html is a post describing the problem and some solutions. I haven't checked to see how many of the steps are still necessary on Emacs 26, but I bet it's still non-zero.

This blog post was not a complete advice then and it's not a complete advice now, as it says nothing about what to give to gnutls-min-prime-bit, gnutls-algorith-priority and how to turn off NSM.

See if this works for you on Emacs 25 and 26: https://news.ycombinator.com/item?id=17573969

Re: Emacs and TLS

#53

Post by marbletiles »

wyuenho wrote: post #47
jcelerier wrote: post #36

Earlier quoted context omitted.

> Firefox and Chrome are secure-by-default and I do not find them inconvenient at all. I really do.

Now I'm curious. Can you elaborate?

I can, since I share the viewpoint. For me as a consumer, the security doesn’t affect me negatively at all. For me as a developer, working often on incomplete, immature, broken or partially broken systems, it often gets in the way. Because those things often can’t reach the high barrier of consumer-grade security - maybe because they’re broken!

So to interact with those systems via HTML I have do lots of “yes I know it’s insecure, I’m trying to fix that, let me past.” As the barrier is getting higher, sometimes I simply can’t get past.

This is a pain.

Emacs, let’s be kind, doesn’t have a consumer audience. It has an audience working on immature/developing/broken systems.

Re: Emacs and TLS

#54

Post by wyuenho »

marbletiles wrote: post #53
wyuenho wrote: post #47

Earlier quoted context omitted.

Now I'm curious. Can you elaborate?

I can, since I share the viewpoint. For me as a consumer, the security doesn’t affect me negatively at all. For me as a developer, working often on incomplete, immature, broken or partially broken systems, it often gets in the way. Because those things often can’t reach the high barrier of consumer-grade security - maybe because they’re broken! So to interact with those systems via HTML I have do lots of “yes I know…

Ah, then you might like the new `nsm-trust-local-network` knob I'm putting in. My "netsec" branch will also trust localhost unconditionally.

Re: Emacs and TLS

#55

Post by tazjin »

greglindahl wrote: post #11
Spivak wrote: post #10

Earlier quoted context omitted.

There are tons of people who read email in Emacs, mu4e is great. Browsing the web is probably less common.

Don’t all of the package managers use the web?

I build my Emacs distribution, including packages, using Nix[1], which means that input hashes of all the package sources are fully pinned. This process is external to Emacs though.

The Emacs internal managers all go towards the same HTTP(S) sources and I haven't seen one that pins input hashes or uses signatures, with the exception of pinning git commit hashes when using git as a package source in straight.el[2].

[1]: https://github.com/tazjin/nixos-config/blob/master/emacs.nix [2]: https://github.com/raxod502/straight.el#advantages-of-straig...

Re: Emacs and TLS

#56

Post by move-on-by »

> Pinning is what is done by sites like gmail to prevent third world dictatorships from using stolen certificate credentials to spy on their citizens. People who have been victims of this have had their email read, been arrested by state security forces for dissent, and have been tortured to death for lack of certificate pinning working in their browsers.

Well, this is awkward - Chrome has deprecated HPKP in favor of a new header: 'Expect-CT' [1]. The new header requires any cert to have a valid certificate transparency log entry and has reporting features as well [2]. This is slightly different - the scenario above would be allowed to happen and would be be valid, but that it would be logged publicly. Whatever CA (dictatorships) had issued the cert would lose their trusted status. But then again, if you have a dictatorship, then you can require that your CA remains trusted and the burden of removing trust to your dictatorship CA would be on individual users.

[1]: https://www.zdnet.com/article/google-chrome-is-backing-away-... [2]: https://scotthelme.co.uk/a-new-security-header-expect-ct/

Re: Emacs and TLS

#57

Post by cmiles74 »

waynecochran wrote: post #9
phyzome wrote: post #8

Earlier quoted context omitted.

You answered it yourself: When you browse the web and read email.

Yes, but who actually does that?

I use notmuch-mode[0] to read my email and I get a lot of email. It's easy to sort and quick to search. In this case, other tools communicate with the mail server.

I use Calfw[1] to keep an eye on my calendar, I believe this mode uses TLS when communicating with Google, etc.

[0]: https://notmuchmail.org/notmuch-emacs/

[1]: https://github.com/kiwanami/emacs-calfw

Re: Emacs and TLS

#58

Post by ekidd »

wyuenho wrote: post #44
gsnedders wrote: post #37

Earlier quoted context omitted.

> There are also a few RFCs that demand terminating your connection say when you've negotiated SSLv3. Emacs doesn't terminate and won't terminate before asking the user first (with caveats). That seems bad. There's plenty of evidence that if you ask the user "hey, do you want to continue but be insecure?" they'll blindly click "yes". While non-browser focused protocols may still rely on clients not forbidding insecur…

A number of people on emacs-devel, and IIRC, RMS too, suggests that we should not be over-protective parents of Emacs users, and on most levels, I agree. While this might seem like a strange philosophical position to take when it comes to security, I don't think it is (or will be) the case for Emacs. An Emacs user can override pretty much everything Emacs does, and there are well-defined options where you can force a…

> A number of people on emacs-devel, and IIRC, RMS too, suggests that we should not be over-protective parents of Emacs users, and on most levels, I agree. While this might seem like a strange philosophical position to take when it comes to security, I don't think it is (or will be) the case for Emacs.

I've been a heavy Emacs user since 1997, using it as my primary editor on all platforms. (In the last year or so, I've been mixing Emacs and Visual Studio Code, because of the latter's solid support for particular language servers.)

I am completely horrified at the suggestion that it might be OK for Emacs to have have insecure TLS defaults. This would be an absolute deal-breaker for me (and would almost certainly result in Emacs being banned at work, with no objection from me).

I do not have the time to fix every Emacs install on every server to be secure with the latest TLS standards. I need to be able to trust the developers of the software I use to get this right. I do not want to worry about whether `package-install` has been affected by a MITM attack.

Re: Emacs and TLS

#59

Post by wyuenho »

move-on-by wrote: post #56

> Pinning is what is done by sites like gmail to prevent third world dictatorships from using stolen certificate credentials to spy on their citizens. People who have been victims of this have had their email read, been arrested by state security forces for dissent, and have been tortured to death for lack of certificate pinning working in their browsers. Well, this is awkward - Chrome has deprecated HPKP in favor of…

Yeeeeeep. You are correct. That subthread was too contentious for me to intervene with this information, but I think I subsequently correctly him.

Re: Emacs and TLS

#60

Post by Ajedi32 »

move-on-by wrote: post #56

> Pinning is what is done by sites like gmail to prevent third world dictatorships from using stolen certificate credentials to spy on their citizens. People who have been victims of this have had their email read, been arrested by state security forces for dissent, and have been tortured to death for lack of certificate pinning working in their browsers. Well, this is awkward - Chrome has deprecated HPKP in favor of…

> if you have a dictatorship, you can require that your CA remains trusted

How?

I mean, I suppose you could mandate that all computers sold in your country come preinstalled with state-approved monitoring software. But barring that, what's going to stop users from downloading the latest version of Firefox which includes code marking your CA as untrusted?

Post reply on HN