configure.ac: fix default behavior

Set enable_password_save to "yes", if the option is not given, as stated in the description.

---
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 608ab6d..9dcd2ab 100644
@@ -166,7 +166,7 @@ AC_ARG_ENABLE(
 	[password-save],
 	[AS_HELP_STRING([--enable-password-save], [allow --askpass and --auth-user-pass passwords to be read from a file @<:@default=yes@:>@])],
 	,
-	[enable_password_save="no"]
+	[enable_password_save="yes"]
 )
 
 AC_ARG_ENABLE(

1.8.3.2

Hi Yegor,

Thanks for the patch. But this explanation doesn't help me much in understanding why this feature needs to be enabled by default. Could you please explain?

(My first thought would be that locally storing a password defeats the purpose of the password, so it is a good thing this is disabled by default. But good arguments might change my view.)

-Steffan

Hi,

My thoughts are along the line - yes, there seems to be a discrepancy between what configure claims to be the default and "the real default", but should we change the actual default here, or the configure help message?

Given the previous discussions, there seems to be belief that this is a "dangerous feature" that should be "turned off by default" - so I tend to, for the sake of consistency, not change the default but change the configure help output instead.

... which makes this a feature-NAK.

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 22.11.2014 11:21, Gert Doering wrote:

Almost anybody always turns this feature on, at least all distribution have it on.

Arne
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iEYEARECAAYFAlRwaacACgkQe8+cMNS4zReyrwCgq1gUP6AYs99pGV3M64e6ws/u cngAnAyl0sR/tExltgYbzsHRbXW3exe0
=Sr9B
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Almost anybody always turns this feature on, at least all distribution have it on.

Arne
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iEYEARECAAYFAlRwaakACgkQe8+cMNS4zRfeUACdG+bFWRPy0WuekfdRSxzZAtJ6 DhQAoOit70W8Z/M72vCqkOq4bsLJPfVZ
=uCYv
-----END PGP SIGNATURE-----

Hiya,

Which is indeed a strong argument for removing the conditional... maybe quickly discuss this ("anyone strongly opposed?") at the next meeting?

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Btw another mismatch:

AC_ARG_ENABLE(
[small],
[AS_HELP_STRING([--enable-small], [enable smaller executable
size (disable OCC, usage message, and verb 4 parm list) @<:@default=yes@:>@])],

        ,
        [enable_small="no"]

)

Yegor

That some features are disabled by default is not related to any kind of "mismatch". First things first.

Regarding --enable-password-save, I don't see any reasons why we want to change that. I don't buy the argument that "all distros do it", because they already have added --enable-password-save in their build tools. In fact, for those who depend on this being disabled by default may get a bigger surprise if we change this default. And it's been off by default since the beginning of OpenVPN, iirc, so this may have a bigger impact than what we can foresee right now. Changing defaults are tricky, especially when it comes to compile time options.

The only place this is enabled by default is on our Windows binary builds, as it would be generally too much to ask Windows users to rebuild OpenVPN themselves with this feature enabled + we had several queries about this feature from Windows users. For non-Windows environments, people are usually far more capable of building OpenVPN themselves and if not, they can report this to the package maintainers for their distros and they can decide whether this is a good idea or not for their distro.

So I'm saying NACK on --enable-password-save unless I get a really good argument why we need to change this default.

When it comes to --enable-small. I encourage you to try that on your own box first and to see what happens with --help and the log files. Further, go through the source code and look for #ifdef ENABLE_SMALL, and you might get yourself a big surprise, especially when playing with the --verb option in the config.

The --enable-small feature is here to reduce the size of the openvpn binary by reducing information generally not found useful on embedded systems - due to people configuring these systems generally have a better understand of what they are doing and can do their testing on systems without --enable-small. For "normal" users, it is generally far better to have the "fatter" version of OpenVPN.

Please don't fall into the trap thinking that "everything should be enabled by default". It's really not that simple.

--
kind regards,

David Sommerseth

Am 22.11.2014 um 10:43 schrieb Steffan Karger:

You can't stop the user doing stupid things, so why bother? Print a warning instead, or if the password is read from auto-mounted USB keys during boot-up, that might be considered safe enough...

ACK from me.

Hi,

to followup on this:

For now, I have committed David's patch that just corrects the help text in configure, without changing the actual default.

As far as --enable-password-save goes, the opinions here on the list and at the last IRC meeting have been "we can change the default *AND* completely get rid of the option while at it", so that would be taking it even further.

Awaiting a patch for this :-)

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...