Re: lisp/url/url-https.el

[Stefan Monnier]

>> Can't we write a generic "auto-decrypt-mode" which works similarly
>> to auto-compress-mode (or maybe even a patch to auto-compress-mode
>> which allows "compression using gpg") ?  This package wouldn't be
>> distributable with Emacs but it doesn't have anything specific to do
>> with Gnus and can distributed separately (e.g. from a non-US
>> location).

> crypt++.el does that.

No, it doesn't.  auto-compress-mode uses file-name-handler-alist, whereas
crypt++ uses things like find-file-hooks.

> I find it intrusive, not to mention that it doesn't play nice with many
> packages (noted as bugs in the comments of crypt++.el).

Using file-name-handler-alist would make it much less intrusive and much
more reliable (but would require crypted files to have an easily
recognizable name).

> I feel that, because of the complexity and variety of encryption programs
> and ciphers, a file encryption API is better than the crypt++.el approach.

I agree that the implementation technique used by crypt++ is inappropriate
(seems to be inherited from way back, probably a time when
file-name-handlers-alist wasn't available).

But could you explain what a file encryption API would provide that can't
be obtained directly from file-name-handlers?

>> Or maybe we can even make the patch to jka-compr.el generic enough
>> (allow "(de)compression with a program that requires interactive
>> user input") to make it acceptable for inclusion in Emacs.

> Encryption, unfortunately, is not easy to implement correctly.  This
> sort of shell pipe could present security risks, for instance, if
> done without care.  gencrypt.el will do it properly.

I don't understand why jka-compr would be restricted to "a shell pipe" in
a way that gencrypt.el wouldn't.  Could you explain with some
concrete examples?

Admittedly, I'm of the people would don't believe in overwriting files and
data (e.g. I don't see the point of the new clear-string function), so maybe
I disagree more than I fail to understand.

>> And then somehow make sure Gnus can be customized to use
>> .authinfo.gz (or .authinfo.gpg).

> That's the easy part :)

And the only hook needed to get file-name-handlers in the game.


        Stefan