Subject: bug#19284: 25.0.50; tls.el uses option --insecure

From: Jens Lechtenboerger <[email-masked]>
Date: Fri, 05 Dec 2014 20:43:09 +0100

This is a followup to bug#16978, where I reported multiple MITM
issues.

tls.el calls gnutls-cli with option --insecure.

As Emacs applies TOFU by default via nsm.el (great work, many
thanks!), the above is dangerous.  I continue to use the following:
(setq tls-program '("gnutls-cli --strict-tofu -p %p %h"))

I’m not sure under what conditions tls.el is necessary.  Is it?

Best wishes
Jens