Re: GnuTLS for W32

[Ted Zlatanov]

On Fri, 6 Jan 2012 15:35:44 +0100 Juanma Barranquero <address@hidden> wrote: 

JB> 2012/1/6 Ted Zlatanov <address@hidden>:

>> I'm not.  The risk is not worth the effort with image libraries.

JB> I don't understand why. Buffer overruns exploited through
JB> carefully-crafted images have been used before. I would fear that (as
JB> a vector for malware) much more than someone eavesdropping my
JB> communications.

I don't think those are as risky, but even if I did it doesn't really
support your point.

>> SSH clients are not extensible layout engines with embedded interpreters
>> and flexible package managers.  As I keep saying, compare Emacs to
>> Firefox and Chrome, not to `vim' or `ssh' and `grep'.  It hasn't been
>> just an editor in a long while.  Eclipse is another good comparison
>> point.

JB> Compare it to Apache, which can be infinitely extended via external
JB> modules and it's mission-critical for so many business.

That's a very tough comparison.  I'm listing "extensible layout engines
with embedded interpreters and flexible package managers" which Apache
has never been, never mind that it's not interactive with the user since
it's a daemon.

>> No, it's not like that at all.  Intrusion detection and security
>> advisories are completely different things.

JB> I thought it was evident I was not comparing situations, but
JB> inadequate feelings of security.

Yes, I understood your point.  While you're right that AV software can
provide a false feeling of security, security advisories do not provide
a feeling of security at all.  They let you know when your security is
at risk.  None of my proposal aims to make users feel secure, but rather
to tell them when they are not.

Ted