GNU bug report logs - #20078
imap with openssl

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 20078 in the body.
You can then email your comments to 20078 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: William F Hammond <gellmu <at> gmail.com>
To: bug-gnu-emacs <at> gnu.org
Subject: imap with openssl
Date: Tue, 10 Mar 2015 19:31:51 -0700

[Message part 1 (text/plain, inline)]

I've been using imap with openssl happily for about 15 years.

Recently it stopped working with a very well-known mail host.  A friend who
is usually on top of these things tells me that there is a vulnerability
named "poodle" when using the -ssl3 option of openssl s_client and one
should now have at the top of the list
imap-ssl-program (in imap.el) the following:

         "openssl s_client -quiet -tls1 -connect %s:%p"

He hastens to point out that the option -tls1 does not mean that one is
using tls rather than ssl -- a statement that means little to me.

Meanwhile, without the latest imap.el one can patch this easily enough in
.gnus by cons-ing the new string into imap-ssl-program AFTER manually
loading imap.

-- 
William F Hammond
Email: gellmu <at> gmail.com
https://www.facebook.com/william.f.hammond
http://www.albany.edu/~hammond

[Message part 2 (text/html, inline)]

Message #8 received at 20078 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: William F Hammond <gellmu <at> gmail.com>
Cc: 20078 <at> debbugs.gnu.org
Subject: Re: bug#20078: imap with openssl
Date: Wed, 11 Mar 2015 13:33:10 -0400

Thanks for the report.
I think basically what you are talking about is the same as

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766397

which was forwarded to emacs-devel, which is a great way to ensure
things get lost, so it's good to have an actual bug report for it now.

The discussion is here, but AFAICS nothing actually happened:
http://lists.gnu.org/archive/html/emacs-devel/2014-10/msg00803.html

Message #17 received at 20078 <at> debbugs.gnu.org (full text, mbox):

From: William F Hammond <gellmu <at> gmail.com>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 20078 <at> debbugs.gnu.org
Subject: Re: bug#20078: imap with openssl
Date: Wed, 11 Mar 2015 11:47:03 -0700

[Message part 1 (text/plain, inline)]

On Wed, Mar 11, 2015 at 10:33 AM, Glenn Morris <rgm <at> gnu.org> wrote:

>
> Thanks for the report.
> I think basically what you are talking about is the same as
>
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766397
>
> which was forwarded to emacs-devel, which is a great way to ensure
> things get lost, so it's good to have an actual bug report for it now.
>
> The discussion is here, but AFAICS nothing actually happened:
> http://lists.gnu.org/archive/html/emacs-devel/2014-10/msg00803.html
>

Debian is not really the place to talk about this kind of issue for
emacs/gnus.

But I note in the Debian thread that Richard Stallman, based on his
reading, made the same point about avoiding the options ssl3 and ssl2 with
s_client though he did not ask for the abandonment of s_client or of
imap.el.

There's discussion in those threads about whether 'anyone' still uses
imap.el and its calls to external openssl.  It arises, for example, when
using mail-sources with, say, nnmbox.

My 'crisis' arose in a sun/solaris system where neither starttls nor gnutls
is available.  It seems that starttls is now no longer maintained (for
cause) and, in my case, gnutls is not easy to build from source because of
recursive library dependencies.  But openssl is available.

Would it make sense for emacs to incorporate gnutls?  That way one could be
sure for a given build of emacs that it would work with gnutls.

-- 
William F Hammond
Email: gellmu <at> gmail.com
https://www.facebook.com/william.f.hammond
http://www.albany.edu/~hammond/

[Message part 2 (text/html, inline)]

Message #20 received at 20078 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: William F Hammond <gellmu <at> gmail.com>
Cc: 20078 <at> debbugs.gnu.org
Subject: Re: bug#20078: imap with openssl
Date: Wed, 11 Mar 2015 14:59:38 -0400

William F Hammond wrote:

> Would it make sense for emacs to incorporate gnutls?

You mean, bundle it?
No, bundling libraries is terrible eg wrt security updates.

Message #23 received at 20078 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: William F Hammond <gellmu <at> gmail.com>
Cc: Glenn Morris <rgm <at> gnu.org>, 20078 <at> debbugs.gnu.org
Subject: Re: bug#20078: imap with openssl
Date: Thu, 12 Mar 2015 10:24:07 -0400

> There's discussion in those threads about whether 'anyone' still uses
> imap.el and its calls to external openssl.  It arises, for example, when
> using mail-sources with, say, nnmbox.

I consider imap.el's use of an external process to be a bug.

> My 'crisis' arose in a sun/solaris system where neither starttls nor gnutls
> is available.  It seems that starttls is now no longer maintained (for
> cause) and, in my case, gnutls is not easy to build from source because of
> recursive library dependencies.

Hmm... we're definitely moving in the direction of requiring libgnutls
when building Emacs.

> Would it make sense for emacs to incorporate gnutls?

No, there be dragons.

> That way one could be sure for a given build of emacs that it would
> work with gnutls.

That would just mean that you wouldn't be able to build Emacs without
first solving the "recursive library dependencies".

But yes, I encourage you to try and solve these gnutls build problems,


        Stefan

Message #28 received at 20078 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>
Cc: William F Hammond <gellmu <at> gmail.com>, 20078 <at> debbugs.gnu.org,
 Glenn Morris <rgm <at> gnu.org>
Subject: Re: bug#20078: imap with openssl
Date: Sat, 26 Dec 2015 21:48:53 +0100

Stefan Monnier <monnier <at> iro.umontreal.ca> writes:

>> There's discussion in those threads about whether 'anyone' still uses
>> imap.el and its calls to external openssl.  It arises, for example, when
>> using mail-sources with, say, nnmbox.
>
> I consider imap.el's use of an external process to be a bug.

I've now changed imap.el to use open-network-stream and removed all the
variables specifying gnutls-cli etc.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Message #33 received at 20078 <at> debbugs.gnu.org (full text, mbox):

From: William F Hammond <gellmu <at> gmail.com>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: Glenn Morris <rgm <at> gnu.org>, 20078 <at> debbugs.gnu.org,
 Stefan Monnier <monnier <at> iro.umontreal.ca>
Subject: Re: bug#20078: imap with openssl
Date: Sat, 26 Dec 2015 13:46:48 -0800

[Message part 1 (text/plain, inline)]

On Sat, Dec 26, 2015 at 12:48 PM, Lars Ingebrigtsen <larsi <at> gnus.org> wrote:

> I've now changed imap.el to use open-network-stream and removed all the
> variables specifying gnutls-cli etc.
>

Thanks.

Do you have any guess as to when, e.g., year or emacs version, this will
find its way into the version of gnus included with GNU Emacs?

            -- Bill

-- 
William F Hammond
Email: gellmu <at> gmail.com
https://www.facebook.com/william.f.hammond
http://www.albany.edu/~hammond/

[Message part 2 (text/html, inline)]

Message #36 received at 20078 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: William F Hammond <gellmu <at> gmail.com>
Cc: Glenn Morris <rgm <at> gnu.org>, 20078 <at> debbugs.gnu.org,
 Stefan Monnier <monnier <at> iro.umontreal.ca>
Subject: Re: bug#20078: imap with openssl
Date: Sat, 26 Dec 2015 22:53:16 +0100

William F Hammond <gellmu <at> gmail.com> writes:

> Do you have any guess as to when, e.g., year or emacs version, this will find
> its way into the version of gnus included with GNU Emacs?

It's already in GNU Emacs.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.