5 ms·

I am missing something here. Emacs is a text/programmer's editor (I know you browse the web, read email, talk to eliza, etc...), but where is TLS being used exa

I am missing something here. Emacs is a text/programmer's editor (I know you browse the web, read email, talk to eliza, etc...), but where is TLS being used exactly? (BTW, I have been using emacs since at least the early 90's, but never did anything requiring TLS).

__david__ 8y ago
Many places. Emacs has a built-in web browser, IMAP client, etc. It also has a package manager that can download packages over https.
sbjs 8y ago
The old joke goes, Emacs is a great OS, if only it had a decent text editor!
- eftychis 8y ago
  You beat me to the punchline. Yes, you can do pretty much anything. (Edit: I guess in the spirit of the joke anything besides writing lol. Shameless plug: I use emacs.)
  - NegativeLatency 8y ago
    How about booting straight into emacs? https://www.informatimago.com/linux/emacs-on-user-mode-linux.html https://www.informatimago.com/linux/emacs-on-user-mode-linux...
testcross 8y ago
Most common use case for people using only the text editor part is probably the package manager downloading files in clear text.
eftychis 8y ago
There are people running and working with emacs' shell, read the news, rss, stock market, emails, calendar etc. See the OS punchline below. Thus beyond basic operations of emacs like package management that require a secure connection you have a user's day to day activity.
phyzome 8y ago
You answered it yourself: When you browse the web and read email.
- waynecochran 8y ago
  Yes, but who actually does that?
  - Spivak 8y ago
    There are tons of people who read email in Emacs, mu4e is great. Browsing the web is probably less common.
    - greglindahl 8y ago
      Don’t all of the package managers use the web?
      - tazjin 8y ago
        I build my Emacs distribution, including packages, using Nix[1], which means that input hashes of all the package sources are fully pinned. This process is external to Emacs though. The Emacs internal managers all go towards the same HTTP(S) sources and I haven't seen one that pins input hashes or uses signatures, with the exception of pinning git commit hashes when using git as a package source in straight.el[2]. [1]: https://github.com/tazjin/nixos-config/blob/master/emacs.nix https://github.com/tazjin/nixos-config/blob/master/emacs.nix [2]: https://github.com/raxod502/straight.el#advantages-of-straightel-2 https://github.com/raxod502/straight.el#advantages-of-straig...
  - dustfinger 8y ago
    I use exwm (emacs) as my windows manager, rcirc as my irc client, eww as my browser, gnus for email, magit for git, tramp for remote control. All of these tools make use of TLS. Honestly, I literally live my life on a computer. If you do it to the extreme that I do then you will find that customizing your experience becomes important. Emacs is designed from the ground up for customizability.
akalin 8y ago
Do you ever install packages from Emacs? If so, you definitely want that to be at least TLS protected. https://glyph.twistedmatrix.com/2015/11/editor-malware.html https://glyph.twistedmatrix.com/2015/11/editor-malware.html is a post describing the problem and some solutions. I haven't checked to see how many of the steps are still necessary on Emacs 26, but I bet it's still non-zero.
- simias 8y ago
  >Do you ever install packages from Emacs? If so, you definitely want that to be at least TLS protected. Wouldn't it make more sense to sign individual packages so that it doesn't matter if an attacker can mess with them "in flight"? That's generally how package managers work in my experience. It also means that you can let third parties create mirrors without trusting them fully. TLS doesn't really seem like the right solution for something like that.
  - tialaramex 8y ago
    This feels like enough, doesn't it? But it's not. You will also need to sign and timestamp all repository metadata. Otherwise when you learn of bug X and fix it with patch P to produce new package package-V+1 I also learn of bug X, but I ensure my victims don't get told about new package-V+1, they will be told package-V is the latest version and they're now safely up-to-date - but I can exploit them. If you use TLS I can't meddle with the packages, or the metadata, or anything. You absolutely can secure everything in your package management system, but it will be a bit trickier than just signing individual packages. Whereas using TLS is enough. Back in 1995 when anonymous FTP distribution was commonplace, signing packages made a whole lot more sense than trying to get all your mirrors to update to HTTPS. In 2018 this is not so true.
    - wahern 8y ago
      They should be doing all of that anyhow. Servers get hacked. TLS doesn't fix the metadata replay problem.
- wyuenho 8y ago

__david__ 8y ago

Many places. Emacs has a built-in web browser, IMAP client, etc. It also has a package manager that can download packages over https.

sbjs 8y ago

The old joke goes, Emacs is a great OS, if only it had a decent text editor!

eftychis 8y ago
You beat me to the punchline. Yes, you can do pretty much anything. (Edit: I guess in the spirit of the joke anything besides writing lol. Shameless plug: I use emacs.)
- NegativeLatency 8y ago
  How about booting straight into emacs? https://www.informatimago.com/linux/emacs-on-user-mode-linux.html https://www.informatimago.com/linux/emacs-on-user-mode-linux...

testcross 8y ago

Most common use case for people using only the text editor part is probably the package manager downloading files in clear text.

eftychis 8y ago

There are people running and working with emacs' shell, read the news, rss, stock market, emails, calendar etc. See the OS punchline below. Thus beyond basic operations of emacs like package management that require a secure connection you have a user's day to day activity.

phyzome 8y ago

You answered it yourself: When you browse the web and read email.

waynecochran 8y ago
Yes, but who actually does that?
- Spivak 8y ago
  There are tons of people who read email in Emacs, mu4e is great. Browsing the web is probably less common.
  - greglindahl 8y ago
    Don’t all of the package managers use the web?
    - tazjin 8y ago
      I build my Emacs distribution, including packages, using Nix[1], which means that input hashes of all the package sources are fully pinned. This process is external to Emacs though. The Emacs internal managers all go towards the same HTTP(S) sources and I haven't seen one that pins input hashes or uses signatures, with the exception of pinning git commit hashes when using git as a package source in straight.el[2]. [1]: https://github.com/tazjin/nixos-config/blob/master/emacs.nix https://github.com/tazjin/nixos-config/blob/master/emacs.nix [2]: https://github.com/raxod502/straight.el#advantages-of-straightel-2 https://github.com/raxod502/straight.el#advantages-of-straig...
- dustfinger 8y ago
  I use exwm (emacs) as my windows manager, rcirc as my irc client, eww as my browser, gnus for email, magit for git, tramp for remote control. All of these tools make use of TLS. Honestly, I literally live my life on a computer. If you do it to the extreme that I do then you will find that customizing your experience becomes important. Emacs is designed from the ground up for customizability.

akalin 8y ago

Do you ever install packages from Emacs? If so, you definitely want that to be at least TLS protected. https://glyph.twistedmatrix.com/2015/11/editor-malware.html https://glyph.twistedmatrix.com/2015/11/editor-malware.html is a post describing the problem and some solutions. I haven't checked to see how many of the steps are still necessary on Emacs 26, but I bet it's still non-zero.

simias 8y ago
>Do you ever install packages from Emacs? If so, you definitely want that to be at least TLS protected. Wouldn't it make more sense to sign individual packages so that it doesn't matter if an attacker can mess with them "in flight"? That's generally how package managers work in my experience. It also means that you can let third parties create mirrors without trusting them fully. TLS doesn't really seem like the right solution for something like that.
- tialaramex 8y ago
  This feels like enough, doesn't it? But it's not. You will also need to sign and timestamp all repository metadata. Otherwise when you learn of bug X and fix it with patch P to produce new package package-V+1 I also learn of bug X, but I ensure my victims don't get told about new package-V+1, they will be told package-V is the latest version and they're now safely up-to-date - but I can exploit them. If you use TLS I can't meddle with the packages, or the metadata, or anything. You absolutely can secure everything in your package management system, but it will be a bit trickier than just signing individual packages. Whereas using TLS is enough. Back in 1995 when anonymous FTP distribution was commonplace, signing packages made a whole lot more sense than trying to get all your mirrors to update to HTTPS. In 2018 this is not so true.
  - wahern 8y ago
    They should be doing all of that anyhow. Servers get hacked. TLS doesn't fix the metadata replay problem.
wyuenho 8y ago