[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5
From: |
Daiki Ueno |
Subject: |
Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5 |
Date: |
Wed, 05 Feb 2014 17:19:13 +0900 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/24.3.50 (gnu/linux) |
Ted Zlatanov <address@hidden> writes:
> Please see my objection to loose coupling of encryption primitives in
> particular.
Didn't I post a link to the idea of this loose coupling? It is mainly
for security reasons. For example, there's usually a limit of secure
memory and it makes sense to do all the secret key operation in a
minimal core (gpg-agent) to utilize it.
I don't think you can provide the same level of security using
encryption primitives within Emacs.
> Right. Shelling out to an external binary every time you want to verify
> a package's signature or want to encrypt/decrypt/sign data makes perfect
> sense.
At least it works at acceptable performance now.
> Blindly entering your passphrase in an anonymous popup that says it's
> from the GnuPG agent is how things are done.
This could be fixed. Sounds definitely easier than importing plenty of
crypto primitives from a C library.
> Trusting loosely coupled components is standard industry practice.
See above.
> Forcing users to do all of that, or "no encryption for you" is for their
> own good, on every platform where Emacs runs, from Android to W32 to Mac
> OS X to many flavors of Unix. Users are just too stupid to decide these
> things on their own.
I don't get it. Are there any platforms where Emacs work, while GPG
does not?
> Is that how experts with a crypto/security background do it? I'm
> understanding now.
Better than letting you write encryption code for me.
Case study (sorry Jose):
https://lists.gnu.org/archive/html/bug-recutils/2012-04/msg00001.html
I can easily imagine you will make similar (or more serious) mistakes
here and there, once crypto primitives are available.
--
Daiki Ueno
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, (continued)
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Stephen J. Turnbull, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, David Kastrup, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Stephen J. Turnbull, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Stephen J. Turnbull, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Daiki Ueno, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/07
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Daiki Ueno, 2014/02/08
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/08
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5,
Daiki Ueno <=
Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Paul Eggert, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Paul Eggert, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Paul Eggert, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Ted Zlatanov, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Lars Ingebrigtsen, 2014/02/04
- Re: Wherein I argue for the inclusion of libnettle in Emacs 24.5, Daiki Ueno, 2014/02/05