From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/43919 Path: main.gmane.org!not-for-mail From: Simon Josefsson Newsgroups: gmane.emacs.gnus.general Subject: Re: pop3.el broken Date: Mon, 18 Mar 2002 18:12:10 +0100 Sender: owner-ding@hpc.uh.edu Message-ID: References: <02Mar18.104948est.119198@gateway.intersystems.com> NNTP-Posting-Host: localhost.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: main.gmane.org 1016471857 18965 127.0.0.1 (18 Mar 2002 17:17:37 GMT) X-Complaints-To: usenet@main.gmane.org NNTP-Posting-Date: Mon, 18 Mar 2002 17:17:37 +0000 (UTC) Cc: "(ding)" Original-Received: from malifon.math.uh.edu ([129.7.128.13]) by main.gmane.org with esmtp (Exim 3.33 #1 (Debian)) id 16n0lM-0004vn-00 for ; Mon, 18 Mar 2002 18:17:36 +0100 Original-Received: from sina.hpc.uh.edu ([129.7.128.10] ident=lists) by malifon.math.uh.edu with esmtp (Exim 3.20 #1) id 16n0gC-0007J1-00; Mon, 18 Mar 2002 11:12:16 -0600 Original-Received: by sina.hpc.uh.edu (TLB v0.09a (1.20 tibbs 1996/10/09 22:03:07)); Mon, 18 Mar 2002 11:12:22 -0600 (CST) Original-Received: from sclp3.sclp.com (qmailr@sclp3.sclp.com [209.196.61.66]) by sina.hpc.uh.edu (8.9.3/8.9.3) with SMTP id LAA07235 for ; Mon, 18 Mar 2002 11:12:01 -0600 (CST) Original-Received: (qmail 13078 invoked by alias); 18 Mar 2002 17:11:49 -0000 Original-Received: (qmail 13073 invoked from network); 18 Mar 2002 17:11:49 -0000 Original-Received: from 178.230.13.217.in-addr.dgcsystems.net (HELO yxa.extundo.com) (217.13.230.178) by gnus.org with SMTP; 18 Mar 2002 17:11:49 -0000 Original-Received: from localhost.localdomain (yxa.extundo.com [217.13.230.178]) (authenticated bits=0) by yxa.extundo.com (8.12.2/8.12.2) with ESMTP id g2IHBkKY019661; Mon, 18 Mar 2002 18:11:46 +0100 Original-To: Stainless Steel Rat In-Reply-To: <02Mar18.104948est.119198@gateway.intersystems.com> (Stainless Steel Rat's message of "18 Mar 2002 10:53:47 -0500") Mail-Copies-To: nobody Original-Lines: 43 User-Agent: Gnus/5.090006 (Oort Gnus v0.06) Emacs/21.2 (i686-pc-linux-gnu) Precedence: list X-Majordomo: 1.94.jlt7 Xref: main.gmane.org gmane.emacs.gnus.general:43919 X-Report-Spam: http://spam.gmane.org/gmane.emacs.gnus.general:43919 Stainless Steel Rat writes: > | The latter should be encoded with a reasonable coding-system before > | passing it to md5bin (which is mentioned below). > > A pass phrase is raw data, not text. It should not be treated as something > a human can read. It should -never- be smashed through any coding system. Huh? A password is a text string, entered on the keyboard. As such, it must be encoded in some character set in order to be input to a hash function. pop3 has implicitely encoded it as ASCII traditionally, assuming that (md5 "foobar") encodes the characters "foobar" as ASCII characters before applying md5 on it. This is no longer the case, (md5 "foobar") can end up encoding the characters as UTF-16 before running md5 if you have configured Emacs to use that encoding (by, say, enabling Mule-UCS). For a less Mule confused example, compare EBCDIC vs ASCII. If the pop3 server used a ASCII encoding of the password, the client must also use ASCII. > Something you should be aware of before applying any patches: pop3.el is > maintained directly by the FSF since they forked it in 1999 and never > bothered to tell me about it. If you send a patch to the Emacs maintainers that modifies it to what you want [as long as it works] I would hope that they will unfork it. > It is part of Emacs, not Gnus. All changes need to go through the > FSF; but your XEmacs code will most probably be stripped. XEmacs > has a vastly different fork that incorporates much of Franklin Lee's > work but will never be merged into the FSF's code tree. Right, I wish that XEmacs pop3.el could be reverted to your version (and that you would handle the bug reports ;)), and that people wanting enhanced behaviour could use epop3 or another package containing the current XEmacs pop3.el. It is confusing to fork code and not change the name. > Wrapping APOP auth with reasonable advice may be the sanest thing to do. > It certainly requires the least ammount of new code. Defadvice isn't a good long term solution.