Re: pop3.el broken

[Simon Josefsson <jas@extundo.com>]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:

> |    The latter should be encoded with a reasonable coding-system before
> |    passing it to md5bin (which is mentioned below).
>
> A pass phrase is raw data, not text.  It should not be treated as something
> a human can read.  It should -never- be smashed through any coding system.

Huh?  A password is a text string, entered on the keyboard.  As such,
it must be encoded in some character set in order to be input to a
hash function.  pop3 has implicitely encoded it as ASCII
traditionally, assuming that (md5 "foobar") encodes the characters
"foobar" as ASCII characters before applying md5 on it.  This is no
longer the case, (md5 "foobar") can end up encoding the characters as
UTF-16 before running md5 if you have configured Emacs to use that
encoding (by, say, enabling Mule-UCS).

For a less Mule confused example, compare EBCDIC vs ASCII.  If the
pop3 server used a ASCII encoding of the password, the client must
also use ASCII.

> Something you should be aware of before applying any patches: pop3.el is
> maintained directly by the FSF since they forked it in 1999 and never
> bothered to tell me about it.

If you send a patch to the Emacs maintainers that modifies it to what
you want [as long as it works] I would hope that they will unfork it.

> It is part of Emacs, not Gnus.  All changes need to go through the
> FSF; but your XEmacs code will most probably be stripped.  XEmacs
> has a vastly different fork that incorporates much of Franklin Lee's
> work but will never be merged into the FSF's code tree.

Right, I wish that XEmacs pop3.el could be reverted to your version
(and that you would handle the bug reports ;)), and that people
wanting enhanced behaviour could use epop3 or another package
containing the current XEmacs pop3.el.  It is confusing to fork code
and not change the name.

> Wrapping APOP auth with reasonable advice may be the sanest thing to do.
> It certainly requires the least ammount of new code.

Defadvice isn't a good long term solution.