Re: Builtin GnuTLS support and certificate verification

[Vincent Bernat <bernat@luffy.cx>]

 ❦  8 décembre 2013 05:22 CET, Ted Zlatanov <tzz@lifelogs.com> :

>>> Verification options could be:
>>> 
>>> - `expired-certificate`
>>> - `revoked-certificate`
>>> - `untrusted-certificate`
>>> - `hostname-mismatch`
>
> I'm not sure this granularity is necessary.  I just have :trustfiles and
> :hostname as options right now.  Anyone else with an opinion?

I thought you wanted something granular, hence the proposition. I don't
know of any other software proposing granular verification. So, no
problem with dropping this.

> My concern is that suddenly connections will start failing for our users
> and bug reports will flow, and I don't have time to explain to everyone
> why their self-signed certificates need exceptions.  This can be really,
> really annoying.  But logging in *Messages* is not very useful either,
> users don't read it.  So what's the right thing?  How about a default
> behavior of flashing a warning, then sit-for 3 seconds?  A hard error
> can be optional but not the default.

For a first release, just default to the previous behaviour. However,
some day, it would be nice to be "secure by default".

> I'm also not sure I like the look and feel of the `gnutls-verify-error'
> defcustom.  It's kind of awkward.

I am don't know defcustom enough to know if this would give something
like this:

'((".*\\.internal" :hostname)
  (".*" :trustfiles :hostname))

If yes, this seems fine for me. Just add the possible values for tags in
the document string.

> I'd like to get this done before the Emacs code freeze next week or so.
> Please give me your opinions and test the code.

I'll try to test later this day.
-- 
panic("aha1740.c"); /* Goodbye */
	2.2.16 /usr/src/linux/drivers/scsi/aha1740.c