[OS X Emacs] Verifying Aquamacs

Win Treese treese at acm.org
Mon Apr 27 22:10:44 EDT 2020


Thanks, David (and other contributors to this discussion).

I added a page to respond to the update check that Aquamacs does, so that the updates work. As David notes, this does require disabling the required use of TLS on aquamacs.org. Requests initiated with TLS will stay that way, of course.

At a minimum, we’ll change the URL to use https for the next release. As David notes, because all the old versions have the http: URL, turning on TLS for the whole site would break that. Judging from the bug reports, there’s still a substantial base of older versions out there.

I’d certainly like to make a transition to having the site run over TLS at all times, but it’s not clear how to do that in a reasonable way without breaking the old download checks. The code specifically checks that redirects weren’t used, which is not a bad idea for that code, but that makes it hard to work around.

Thanks,
 - Win

> On Apr 25, 2020, at 5:18 AM, David Reitter <david.reitter at gmail.com> wrote:
> 
> The simpler solution (going forward) is to change the update URL going forward to be something like update.aquamacs.org, and make the update check via HTTP. 
>  
> FWIW, this is a little confusing because I’m not sure why it would be any easier to remotely change the URL being checked for update than it would be to remotely update the certificate being trusted. If the update mechanism isn’t working, _any_ client-side change to fix it would seem to need a manual download to get started.
> 
> Yes, that's what I meant when I wrote "going forward", and said that a solution is needed to not enforce HTTPS on requests to currentversion.cgi.  On the client-side, it is easy to change that URL, but of course people would have to update Aquamacs to get it.
> 
> On Fri, Apr 24, 2020 at 4:16 PM John Wroclawski <jtw at csail.mit.edu> wrote:
> Hi David,
> 
>> On Apr 24, 2020, at 4:00 PM, David Reitter <david.reitter at gmail.com> wrote:
>> 
>> You forget that there are some 100,000 copies of Aquamacs sitting on people's computers.  You can't remotely update which certificates are trusted.
>> 
>> The simpler solution (going forward) is to change the update URL going forward to be something like update.aquamacs.org, and make the update check via HTTP. 
> 
> FWIW, this is a little confusing because I’m not sure why it would be any easier to remotely change the URL being checked for update than it would be to remotely update the certificate being trusted. If the update mechanism isn’t working, _any_ client-side change to fix it would seem to need a manual download to get started.
> 
> (But, having said that, I do agree that the simplest short-term thing to do is almost surely to change the website so that the (current) update URL is loaded via HTTP..)
> 
> (But, having said _that_, I do also recognize that many people would prefer to see it be HTTPS in the end notwithstanding the code-signing, so maybe sometime there'll be motivation to wire the whole thing into macOS certificate validation so it’ll all “just work” going forward..)
> 
> Cheers, -John
> 
> 
> _____________________________________________________________
> MacOSX-Emacs mailing list
> MacOSX-Emacs at email.esm.psu.edu
> https://email.esm.psu.edu/mailman/listinfo/macosx-emacs
> List Archives: http://dir.gmane.org/gmane.emacs.macintosh.osx
> 
> _____________________________________________________________
> MacOSX-Emacs mailing list
> MacOSX-Emacs at email.esm.psu.edu
> https://email.esm.psu.edu/mailman/listinfo/macosx-emacs
> List Archives: http://dir.gmane.org/gmane.emacs.macintosh.osx



More information about the MacOSX-Emacs mailing list