wyuenho

32 ms·

301.
by wyuenho 8y ago
I LOL'ed when I read that line too
302.
by wyuenho 8y ago
Have you tried tabbing the home button lightly twice?
303.
by wyuenho 8y ago
Literally how every IDE works since Eclipse, and may be even earlier
304.
by wyuenho 8y ago
I love Emacs, but if I'm to be honest, if network security is of concern per a company's policy, Emacs, any version of it past and present, should be immediately banned.
305.
by wyuenho 8y ago
You seem to be singularly focused on pentesting, whatever that means to you, and I'm mostly concerned with leakage of information. Being able to prove whether I can pwn Emacs or not is irrelevent. For my purpose, all I have to establis
306.
by wyuenho 8y ago
Oh it's won many years ago :)
307.
by wyuenho 8y ago
Yeeeeeep. You are correct. That subthread was too contentious for me to intervene with this information, but I think I subsequently correctly him.
308.
by wyuenho 8y ago
Ah, then you might like the new `nsm-trust-local-network` knob I'm putting in. My "netsec" branch will also trust localhost unconditionally.
309.
by wyuenho 8y ago
This blog post was not a complete advice then and it's not a complete advice now, as it says nothing about what to give to gnutls-min-prime-bit, gnutls-algorith-priority and how to turn off NSM. See if this works for you on Emacs 25 an
310.
by wyuenho 8y ago
What about emacs -q ? Does the same issue still happen? If it doesn't, that sounds like a different package is locking up your emacs.
311.
by wyuenho 8y ago
There isn't. I've said this a couple of times in the mailing list. It's just some people appear to think there is, but I don't believe them. We all agree that Emacs should provide sensible defaults, the disagreement is w
312.
by wyuenho 8y ago
Now I'm curious. Can you elaborate?
313.
by wyuenho 8y ago
I agree with your first paragraph, but I didn't claim RMS thinks Emacs security is faulty. In fact, RMS doesn't seem to be aware of the problems of Emacs' network security. That RMS quote is there to point out the irony that
314.
by wyuenho 8y ago
Don't thank me yet, a lot of these haven't made into master, thank me later if my lobbying effort is successful. :)
315.
by wyuenho 8y ago
A number of people on emacs-devel, and IIRC, RMS too, suggests that we should not be over-protective parents of Emacs users, and on most levels, I agree. While this might seem like a strange philosophical position to take when it comes to s
316.
by wyuenho 8y ago
I don't know exactly why this solution won't work for you, there could be a number of issues at play here. In short, try this: 1. Reset all your 'tls 'nsm and 'gnutls customize options to their defaults. 2. $ rm -rf
317.
by wyuenho 8y ago
What I'm working on is only tangentially related to that Fedora bug. Essentially, what the user is seeing in the GnuTLS debug log will supposedly be checked by NSM. I wasn't even aware of that bug report before I emailed emacs-dev
318.
by wyuenho 8y ago
I thought about linking in curl, but curl doesn't seem to offer any help in making OCSP requests separately, it only has support for OCSP stapling. Not that not having OCSP by itself is a major issue, but not having OCSP, CT and a reli
319.
by wyuenho 8y ago
I'm not trying to win anything, I'm trying to find out where that dismissive tone came from, and see if there's any merit. Back to topic: While I agree that being vulnerable is not the same as being attacked, I still have a h
320.
by wyuenho 8y ago
I agree. Many of the checks in my "netsec" branch does take inspirations from Firefox and Chrome. However, there's a fundamental distinction - Emacs currently has 4 security levels (hopefully soon reduced to 3), whereas brows
321.
by wyuenho 8y ago
What's my agenda exactly and why do you think I'm criticizing RMS? Is that quote my words? And what does being a former pentester have to do with anything you said? Which ecosystem am I throwing under the bus?
322.
by wyuenho 8y ago
I appreciate you announcing your preference of taste, but honestly, if you don't have anything of substance to add to the conversation, please don't pollute the thread.
323.
by wyuenho 8y ago
LOL, if only. It'll certainly save me a lot of work. //edit BTW, those aren't my words, those are Eli's responding to Perry
324.
by wyuenho 8y ago
I'm the new guy mentioned in the article. This article is a bit late to the party and misses a lot of details that I've discovered since June. One of the reasons prompted this giant thread on the emacs-devel mailing list is when I
325.
by wyuenho 8y ago
This makes more sense, but I'm still confused by that self-signed bit. By master cert, if you mean that's your internal CA's cert that's distributed across every client and server as a part of your trust root, than this
326.
by wyuenho 8y ago
This makes a lot more sense than the answers below thank you.
327.
by wyuenho 8y ago
I don't know how in your experience how these orchestration servers are setup, but in my experience, these clusters are all on the Cloud, which means accessing them requires going out to the public internet. In the off chance someone i
328.
by wyuenho 8y ago
Sounds like these OPS teams don't know what they are doing, but I'm not sure what you are saying is correct. Conceivably, in an ideal situation, the org has an internal intermediate CA created using a cert signed by a real root CA
329.
by wyuenho 8y ago
So.much.experience and wisdom in this answer. I learned something new today. Thank you.
330.
by wyuenho 8y ago
Surely all these APIs do not demand client certs right? In the case of Kubernetes, a typical server cert is self-signed, so half of TLS's security measures are defeated, to mitigate that you have to white-list clients by checking t

More ›