Re: A couple of questions and concerns about Emacs network security

[Perry E. Metzger]

On Thu, 5 Jul 2018 12:20:54 -0700 Paul Eggert <address@hidden>
wrote:
> Perry E. Metzger wrote:
> > The security of OpenSSL is, so far as I can tell, more reliably
> > managed.  
> 
> Yes, OpenSSL is surely the best choice for current applications,
> despite its obvious drawbacks. That being said, Emacs shouldn't be
> tied down to OpenSSL, just as it should not be tied down to GnuTLS.
> There is currently quite a bit of interest in replacing OpenSSL
> with something better, and with luck we'll see improvements in the
> not-too-distant future. We insulate Emacs users from this turmoil
> as best we can.

This seems completely reasonable. That said, for now, I think the best
possible default should be what we recommend until some better
possible default exists.

Perry
-- 
Perry E. Metzger                address@hidden