[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: open-{gnutls,network}-stream backwards compatibility
From: |
Eli Zaretskii |
Subject: |
Re: open-{gnutls,network}-stream backwards compatibility |
Date: |
Fri, 04 Jan 2019 16:06:26 +0200 |
> From: Robert Pluim <address@hidden>
> Cc: address@hidden
> Date: Wed, 02 Jan 2019 19:56:25 +0100
>
> > change open-network-stream such that not specifying
> > :client-certificate is the same as specifying t
> >
> > Doesn't this mean an incompatible change in behavior?
>
> For what I think is a tiny (perhaps non-existent) minority of Emacs
> users.
We have no reliable way of estimating the number of affected users.
Besides, even if there's only a single user affected, it requires us
to consider this an incompatible change, which should be avoided if
possible.
> Currently, specifying ':client-certificate t' to open-network-stream
> causes client certificates to be looked up via auth-source up when
> using external gnutls-cli.
>
> My fix intends to extend that behaviour to do the same when using
> built-in GnuTLS. So far I think thatʼs uncontroversial.
Yes.
> My follow-on to that fix would be to assume that not specifying
> :client-certificate at all when calling open-network-stream is the
> same as specifying ':client certificate t'. Only people with existing
> client certificate entries in their auth-source provider (such as
> .authinfo) would see a change in behaviour.
It's still a change. At the very least, we should provide a way to
have the old behavior back.
> If that last change is unacceptable, Iʼd want to change all the
> callers of open-network-stream inside Emacs to specify
> ':client-certificate t'. People using built-in Emacs packages would
> then be able to use client certificates by changing configuration data
> only. People using packages developed outside Emacs would need to
> update those external packages to versions which specify
> ':client-certificate t', which is what Iʼd like to avoid.
>
> Short version: we assume a username/password entry in auth-source for
> a specific server means 'use this username/password', so we should do
> the same for a client-certificate specification.
I don't necessarily disagree, provided that we give users who
want/need that a way to get back the old behavior. Maybe I'm
misunderstanding, but it sounds like both of your alternatives are
backward-incompatible, so they both need such a "fire escape".
Thanks.
- open-{gnutls,network}-stream backwards compatibility, Robert Pluim, 2019/01/02
- Re: open-{gnutls,network}-stream backwards compatibility, Eli Zaretskii, 2019/01/02
- Re: open-{gnutls,network}-stream backwards compatibility, Robert Pluim, 2019/01/02
- Re: open-{gnutls,network}-stream backwards compatibility, Eli Zaretskii, 2019/01/02
- Re: open-{gnutls,network}-stream backwards compatibility, Robert Pluim, 2019/01/02
- Re: open-{gnutls,network}-stream backwards compatibility,
Eli Zaretskii <=
- Re: open-{gnutls,network}-stream backwards compatibility, Robert Pluim, 2019/01/04
- Re: open-{gnutls,network}-stream backwards compatibility, Eli Zaretskii, 2019/01/05
- Re: open-{gnutls,network}-stream backwards compatibility, Robert Pluim, 2019/01/05
- Re: open-{gnutls,network}-stream backwards compatibility, Eli Zaretskii, 2019/01/05
- Re: open-{gnutls,network}-stream backwards compatibility, Robert Pluim, 2019/01/09
- Re: open-{gnutls,network}-stream backwards compatibility, Ted Zlatanov, 2019/01/10
- Re: open-{gnutls,network}-stream backwards compatibility, Eli Zaretskii, 2019/01/10
- Re: open-{gnutls,network}-stream backwards compatibility, Eli Zaretskii, 2019/01/12
- Re: open-{gnutls,network}-stream backwards compatibility, Ted Zlatanov, 2019/01/02
- Re: open-{gnutls,network}-stream backwards compatibility, Eli Zaretskii, 2019/01/02