GNU bug report logs - #28597
26.0.60; [Security] Configure should use --without-pop by default

Previous Next

Full log

Message #11 received at 28597 <at> debbugs.gnu.org (full text, mbox):

From: Robert Pluim <rpluim <at> gmail.com>
To: John Wiegley <jwiegley <at> gmail.com>
Cc: "N. Jackson" <nljlistbox2 <at> gmail.com>, 28597 <at> debbugs.gnu.org,
 Richard Stallman <rms <at> gnu.org>
Subject: Re: bug#28597: 26.0.60;
 [Security] Configure should use --without-pop by default
Date: Tue, 26 Sep 2017 11:13:38 +0200

John Wiegley <jwiegley <at> gmail.com> writes:

>>>>>> "NJ" == N Jackson <nljlistbox2 <at> gmail.com> writes:
>
> NJ> Configure issues the following warning:
> NJ>   configure: WARNING: This configuration installs a 'movemail' program
> NJ>   that retrieves POP3 email via only insecure channels.
> NJ>   To omit insecure POP3, you can use './configure --without-pop'.
>
> NJ> If the warning is true, then --without-pop should be the default, and
> NJ> users should have to explicitly request an insecure Emacs with --with-pop.
>
> You are requesting a change in behavior that is exceedingly old, so I would
> like to hear from others what they think about making a change like this.
> Given how much less of a thing POP is becoming over the years, I'd be in favor
> of changing the default here.

I'm sure there are still people stuck with using POP3, but they should
be gently incited to move to POP3S or IMAPS the same way people should
be steered away from http and TLS < 1.2. Making the default be
--without-pop is one way to do that.

Regards

Robert

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.