[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Enforcing TLS for GNU ELPA
From: |
Vasilij Schneidermann |
Subject: |
Re: Enforcing TLS for GNU ELPA |
Date: |
Tue, 20 Oct 2020 12:07:01 +0200 |
> > - There's still Windows users who do not have an installation with the
> > gnutls libraries, despite the strong suggestion to download it for the
> > full experience.
>
> I would say, sorry, there is no access to Emacs supported packages. If
> they want without signing, they can find out configuration option.
>
> > - Emacs versions below 26.1 are affected by a HTTPS proxy bug [1] that
> > makes life in corporate environments hard.
>
> I would say sorry for that, and would push security.
What you propose is different: Adjust the default value of
`package-archives` to always use https:// URLs, whereas I propose a more
invasive change: Adjust the server-side behavior to not allow any kind
of opt-out.
> Administrator in corporate environment can provide all allowed or by
> corporation approved packages to each user, either by making general
> settings on a single computer, or by entering defaults in
> /etc/skel/.emacs.d/elpa/you-name-it
>
> Majority of GNU/Linux distributions already have Emacs packages inside
> of distribution. Some of them have more than few hundred packages.
>
> In that sense, corporate environment is not a problem as BOFH can do
> it for its users.
That assumes a different kind of corporate environment where the focus
is on provisioning users with software known to be safe. The issue I've
pointed out is about communication via corporation-mandated proxy being
impossible, something very different.
> There is reason of security, it could be announced in new Emacs
> version. Provided it is done.
Yes, an announcement would be required in any case.
signature.asc
Description: PGP signature