Re: GnuTLS for W32

[Óscar Fuentes]

Juanma Barranquero <address@hidden> writes:

> On Fri, Jan 6, 2012 at 03:37, Óscar Fuentes <address@hidden> wrote:
>
>> Furthermore, if that's the
>> sentiment on the rest of the w32 emacs people and the project leaders,
>> I'll urge you to stop distributing MS Windows binaries. I'm pretty sure
>> that there will be no shortage of Emacs binaries for MS Windows.
>
> Oh, I'm not against distributing our binaries. Emphasis in "our".

Then I'm misunderstanding. IIRC you said, more or less: "we are a source
code shop and MS Windows is an exception because those users would have
a hard time getting an Emacs running on their machines". I fully
sympathize with the "we are a source code shop", but at the same time
I'll like to remark that the rest is no longer true.

>> That's not proactive.
>
> What's the proactive way to do it in a source-only project? Are you
> suggesting that all projects do include some kind of run-time check?

We are on emacs-devel, not on all-projects-devel.

But now that you ask, yes, I'll appreciate that all projects would
include a system for notifying me that its software is putting my
machine at risk.

> I already gave a short list of some software in my computer that does
> not take proactive action. I could add lots more, like git, mercurial,
> MinGW, Take Command, Python, Evernote, etc. Some of them have a menu
> option to check for updates, or installer programs with an update
> option, but they don't do it automatically.

The key here is to determine what the Right Thing is. Have you
considered the possibility that some or most of those projects doesn't
have the automatic notification not because they think it is a bad idea,
but because some other reason?

>> Really, I can't see how you object to automatic checks for
>> critical updates.
>
> Because we don't have (or very rarely have) critical updates.

That's like saying that smoke detectors are unneeded because fires
rarely occur, if at all, on most housings.

> Let GnuTLS announce their critical updates any way they see fit.
>
>> Even less can I understand how you object to that
>> feature in principle, not just as personal preference.
>
> It's a change from one model of development and distribution to
> another one. I like the way Emacs is right now. Source. You compile
> it, and have a binary that does not depend on some mythical,
> externally maintained resource.

You are sidetracking from my question by going back to the GnuTLS
dll. I'm genuinely interested in your reasoning for rejecting an
automatic notification system built into Emacs. Something you can use to
warn users that a problem was found that would pose a risk to their data
(a security breach, data corruption, whatever). That's independent from
how the user obtained its binary package.

[snip]