bug#28597: 26.0.60; [Security] Configure should use --without-pop by default

[Robert Pluim]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: John Wiegley <jwiegley@gmail.com>
>> Date: Tue, 26 Sep 2017 11:51:59 -0700
>> Cc: "N. Jackson" <nljlistbox2@gmail.com>, 28597@debbugs.gnu.org
>> 
>> >>>>> Paul Eggert <eggert@cs.ucla.edu> writes:
>> 
>> > As Glenn noted, the 'configure' message N. mentions came from an uneasy
>> > compromise between worry about the default lack-of-security in Emacs, and
>> > worry about backward compatibility (see Bug#26102). Although I favor making
>> > --without-pop the default, at this point it's really an issue for the two
>> > maintainers to decide.
>> 
>> I'm OK making it the default. Let's wait until Eli's back from his trip and 
>> he
>> can add his thoughts.
>
> I already agreed in
> http://lists.gnu.org/archive/html/emacs-devel/2017-08/msg00054.html to
> have --without-pop be the default, and Paul already installed a patch
> to do that.  So I'm confused about this discussion: what exactly is
> the problem, and what needs to be done/decided?  Are we talking about
> Posix systems where GNU Mailutils are not available?  If so, do we
> want to leave them without movemail at all rather than with one which
> supports POP3?  Or do we want to give them movemail, but without POP3?

I thought we were discussing making --without-pop be the default even
if GNU Mailutils are not available, and it's what I'm
advocating. Paul's patch only did that if they were found.

If that means that some people need to install GNU Mailutils, which
support secure(r) protocols, then I'm all in favour.

Robert