Re: The netsec thread

[Lars Ingebrigtsen]

Jimmy Yuen Ho Wong <address@hidden> writes:

>>> Sorry I got lost in that giant thread.
>>> `gnutls_dh_set_prime_bits` is only deprecated on GnuTLS 3.1.7+. Are we
>>> dropping support for all version < 3.1.7? I'd be super happy to do it
>>> if that's the case and remove this var and the C code entirely.
>>
>> Sure, but making it obsolete won't mean that we drop anything until,
>> like, 2023, and by then GnuTLS will be up to 5.4.13.
>
> I take this means removing the related code entirely but not declare
> in the NEWS file like 26.1 that we are now requiring GnuTLS >= 3.1.7.
> Sounds good to me.

No, marking something as obsolete means that we leave the variable and
code in Emacs for a couple of release cycles.

> Fine by me. So, go back to the original wording and just checks the
> certs and fingerprints on low is what you are saying?

Yes.

>> There is no extra work, because we shouldn't call the functions
>> something containing "tls".
>
> But that's not what you argue for originally. I can drop the `-tls-`
> bit if that makes that part of the shed more palettable.

That is what I was arguing for originally.

>>> `nsm-tls-checks` is already a defcustom. It's super easy to add and
>>> remove a function. You can defun whatever name you want and add to it,
>>> and click [-] to remove. Using name mangling magic to fish out a check
>>> function makes defcustom super-awkward, and AFAIK, no other emacs core
>>> setting does it this way.
>>
>> There's a bunch of "feature" setting that do not include full function
>> names.
>
> ???

I'm not sure what you're asking...

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no