Re: secure plist store

[Ted Zlatanov]

On Wed, 29 Jun 2011 20:59:10 +0900 Daiki Ueno <address@hidden> wrote: 

DU> Ted Zlatanov <address@hidden> writes:
>> I would appreciate it if you were more specific about "does not work" by
>> either filing a bug or explaining.  Obviously it works for me and Lars,
>> who tested it.  Similarly, since you wrote EPA/EPG, your advice on
>> reducing complexity when we use it is greatly appreciated but you don't
>> give us any here.

DU> I have too many minor comments to list here, but at least duplicate code
DU> regarding stashfile should be simplified by supplying a custom
DU> passphrase-callback and calling epg-{encrypt,decrypt}-string.  

Can I use the way you have it in plstore.el?  That seems a good approach
but I want to be sure you agree before I rewrite the relevant
auth-source.el code.

Feel free to send me your comments as a patch or otherwise.  I
appreciate your time and attention.

DU> Currently it's really hard to understand what the code does.

Sorry about that.  I will try to simplify it.  It was written in a hurry
and I don't know the EPA/EPG interfaces well.

DU> I don't want to see that the Gnus password-caching feature becomes
DU> harder and harder to use daily...
>> 
>> I don't think we've done anything that makes it harder to use.  The GPG
>> token functionality is off by default right now.

DU> Yes, and I hope that it won't be on by default.

I think it's a useful feature, but your feedback matters and I will not
turn it on by default without discussing it further.

>> So it's not line-based.  I think that's a minus: people expect to be
>> able to copy a line out of the netrc file, and it makes managing such
>> files easier.

DU> I think typical users don't want to edit the auto-saved passwords file
DU> itself, as long as it saves their passwords and serves it to services as
DU> needed.

I guess we've observed different user patterns and see different needs.
I still think a simple line-based format is better than a multi-line
format, if the netrc file is going to be portable and extensible.  For
instance I could (and intend to) submit a patch to libcurl to handle
gpg: tokens, but I don't think I could do it for plstore-formatted
files.

Thanks
Ted