GNU bug report logs -
#20078
imap with openssl
Previous Next
Reported by: William F Hammond <gellmu <at> gmail.com>
Date: Wed, 11 Mar 2015 03:05:04 UTC
Severity: important
Tags: security
Merged with 21134
Found in version 24.5
Fixed in version 25.1
Done: Lars Ingebrigtsen <larsi <at> gnus.org>
Bug is archived. No further changes may be made.
Full log
View this message in rfc822 format
[Message part 1 (text/plain, inline)]
On Wed, Mar 11, 2015 at 10:33 AM, Glenn Morris <rgm <at> gnu.org> wrote:
>
> Thanks for the report.
> I think basically what you are talking about is the same as
>
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766397
>
> which was forwarded to emacs-devel, which is a great way to ensure
> things get lost, so it's good to have an actual bug report for it now.
>
> The discussion is here, but AFAICS nothing actually happened:
> http://lists.gnu.org/archive/html/emacs-devel/2014-10/msg00803.html
>
Debian is not really the place to talk about this kind of issue for
emacs/gnus.
But I note in the Debian thread that Richard Stallman, based on his
reading, made the same point about avoiding the options ssl3 and ssl2 with
s_client though he did not ask for the abandonment of s_client or of
imap.el.
There's discussion in those threads about whether 'anyone' still uses
imap.el and its calls to external openssl. It arises, for example, when
using mail-sources with, say, nnmbox.
My 'crisis' arose in a sun/solaris system where neither starttls nor gnutls
is available. It seems that starttls is now no longer maintained (for
cause) and, in my case, gnutls is not easy to build from source because of
recursive library dependencies. But openssl is available.
Would it make sense for emacs to incorporate gnutls? That way one could be
sure for a given build of emacs that it would work with gnutls.
--
William F Hammond
Email: gellmu <at> gmail.com
https://www.facebook.com/william.f.hammond
http://www.albany.edu/~hammond/
[Message part 2 (text/html, inline)]
This bug report was last modified 9 years and 152 days ago.
Previous Next
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.