[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#28597: 26.0.60; [Security] Configure should use --without-pop by def
From: |
N. Jackson |
Subject: |
bug#28597: 26.0.60; [Security] Configure should use --without-pop by default |
Date: |
Fri, 29 Sep 2017 12:07:14 -0400 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/26.0.60 (gnu/linux) |
At 16:14 +0300 on Friday 2017-09-29, Eli Zaretskii wrote:
>
>> >>>>> Paul Eggert <eggert@cs.ucla.edu> writes:
>>
>> > As Glenn noted, the 'configure' message N. mentions came from
>> > an uneasy compromise between worry about the default
>> > lack-of-security in Emacs, and worry about backward
>> > compatibility (see Bug#26102). Although I favor making
>> > --without-pop the default, at this point it's really an issue
>> > for the two maintainers to decide.
>
> I already agreed in
> http://lists.gnu.org/archive/html/emacs-devel/2017-08/msg00054.html
> to have --without-pop be the default, and Paul already installed
> a patch to do that.
And yet --without-pop does not appear to be the default here on the
emacs-26 branch.
I updated a few minutes ago (commit
61225964edbaa01e49a6e776af00502ab31767b5), and running configure
writes the following to stderr:
configure: WARNING: Your version of Gtk+ will have problems with
closing open displays. This is no problem if you just use
one display, but if you use more than one and close one of them
Emacs may crash.
See http://bugzilla.gnome.org/show_bug.cgi?id=85715
configure: WARNING: This configuration installs a 'movemail' program
that retrieves POP3 email via only insecure channels.
To omit insecure POP3, you can use './configure --without-pop'.
> So I'm confused about this discussion: what exactly is the
> problem, and what needs to be done/decided?
The problem is that --without-pop is not the default, or at least
that it appears that it is not the default. The general agreement
seems to be that it should be the default.
N.
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default, N. Jackson, 2017/09/25
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default, John Wiegley, 2017/09/25
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default, Glenn Morris, 2017/09/26
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default, Paul Eggert, 2017/09/26
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default,
N. Jackson <=
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default, Eli Zaretskii, 2017/09/29
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default, N. Jackson, 2017/09/29
- bug#28597: 26.0.60; [Security] Configure should use --without-pop by default, Eli Zaretskii, 2017/09/29