From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/65769 Path: news.gmane.org!not-for-mail From: Elias Oltmanns Newsgroups: gmane.emacs.devel,gmane.emacs.gnus.general Subject: Re: [Patch] Make tls.el support certificate verification Date: Sun, 25 Nov 2007 01:35:08 +0100 Message-ID: <87r6iff9hf.fsf@denkblock.local> References: <877imqtdhb.fsf@denkblock.local> <87zlzc35bh.fsf@mocca.josefsson.org> <87ps063ixd.fsf@mocca.josefsson.org> <87zlxo4lwr.fsf@denkblock.local> <87d4uaksur.fsf@denkblock.local> <877ikhlrgs.fsf@denkblock.local> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1195951234 20458 80.91.229.12 (25 Nov 2007 00:40:34 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sun, 25 Nov 2007 00:40:34 +0000 (UTC) Cc: ding@gnus.org To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sun Nov 25 01:40:40 2007 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1Iw5Y3-0002Zw-Tw for ged-emacs-devel@m.gmane.org; Sun, 25 Nov 2007 01:40:36 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Iw5Xp-0002ZY-9h for ged-emacs-devel@m.gmane.org; Sat, 24 Nov 2007 19:40:21 -0500 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Iw5Xj-0002Xy-Lf for emacs-devel@gnu.org; Sat, 24 Nov 2007 19:40:15 -0500 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Iw5Xi-0002WM-GE for emacs-devel@gnu.org; Sat, 24 Nov 2007 19:40:15 -0500 Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Iw5Xi-0002WG-6u for emacs-devel@gnu.org; Sat, 24 Nov 2007 19:40:14 -0500 Original-Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1Iw5Xh-0008BS-NK for emacs-devel@gnu.org; Sat, 24 Nov 2007 19:40:14 -0500 Original-Received: from root by ciao.gmane.org with local (Exim 4.43) id 1Iw5XW-0007Zv-8E for emacs-devel@gnu.org; Sun, 25 Nov 2007 00:40:02 +0000 Original-Received: from pd9e879c3.dip.t-dialin.net ([217.232.121.195]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sun, 25 Nov 2007 00:40:02 +0000 Original-Received: from eo by pd9e879c3.dip.t-dialin.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sun, 25 Nov 2007 00:40:02 +0000 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 39 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: pd9e879c3.dip.t-dialin.net User-Agent: Gnus/5.110007 (No Gnus v0.7) Cancel-Lock: sha1:A8V4dthHHjOUdyAcNNU4Yrtbrmc= X-detected-kernel: by monty-python.gnu.org: Linux 2.6, seldom 2.4 (older, 4) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:84090 gmane.emacs.gnus.general:65769 Archived-At: Reiner Steib wrote: [...] > Some remarks for future contributions: [...] Thanks for those hints. > > See http://article.gmane.org/gmane.emacs.gnus.commits/5529 for my > cosmetic/style changes. Unfortunately, this link seems to be a dead end. > > Would it be useful to add the strings suggested in the doc string of > `tls-checktrust' to `tls-program'? Or provide them as custom options > for `tls-program'? Well, I wasn't quite sure about it at the time and I'm not any wiser yet. I'm using the examples given in the doc string in a Debian environment but they need not work properly for other distributions or OSes. In fact, I think it is so hard to come up with sensible default values that are actually worth making the effort that the best GNU developers can do is to provide the facilities and sufficient documentation to make use of them. Distributors may or may not tweak the default settings and give further advice to their users but even they shouldn't enable tls-checktrust by default as this really should be a decision consciously taken by the end user. After all, the mail server needn't have a certificate signed by one of the well known CAs and may still be valid. Besides, users might want to specify the set of trusted root certificates depending on the server emacs is connecting to. All this seems to make proper documentation more important than presetting any defaults. Do you think the provided doc strings can serve this purpose or should I squeeze in a few sentences somewhere else? Regards, Elias