From 473a2723207e54d15183f7ac2bff68f5e8a3c64a Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Thu, 12 Apr 2018 13:57:26 +0100
Subject: [PATCH 5/9] spec, dbus-daemon(1): Recommend against remote TCP for
 debugging

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 doc/dbus-daemon.1.xml.in   | 8 ++++++++
 doc/dbus-specification.xml | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/doc/dbus-daemon.1.xml.in b/doc/dbus-daemon.1.xml.in
index b0e0aae0..4bafaeae 100644
--- a/doc/dbus-daemon.1.xml.in
+++ b/doc/dbus-daemon.1.xml.in
@@ -415,6 +415,14 @@ a transport name plus possible parameters/options.</para>
   configuring the well-known system bus or the well-known session
   bus to listen on a non-loopback TCP address is insecure.
 </para>
+<para>
+  Developers are sometimes tempted to use remote TCP as a debugging
+  tool. However, if this functionality is left enabled in finished
+  products, the result will be dangerously insecure. Instead of
+  using remote TCP, developers should <ulink
+    url="https://lists.freedesktop.org/archives/dbus/2018-April/017447.html"
+    >relay connections via Secure Shell or a similar protocol</ulink>.
+</para>
 
 <para>Example: &lt;listen&gt;unix:path=/tmp/foo&lt;/listen&gt;</para>
 
diff --git a/doc/dbus-specification.xml b/doc/dbus-specification.xml
index fbeecdac..7f2933bf 100644
--- a/doc/dbus-specification.xml
+++ b/doc/dbus-specification.xml
@@ -3733,6 +3733,14 @@
         The <link linkend="auth-mechanisms-sha">DBUS_COOKIE_SHA1</link>
         mechanism is normally used instead.
       </para>
+      <para>
+        Developers are sometimes tempted to use remote TCP as a debugging
+        tool. However, if this functionality is left enabled in finished
+        products, the result will be dangerously insecure. Instead of
+        using remote TCP, developers should <ulink
+          url="https://lists.freedesktop.org/archives/dbus/2018-April/017447.html"
+          >relay connections via Secure Shell or a similar protocol</ulink>.
+      </para>
       <para>
         All <literal>tcp</literal> addresses are listenable.
         <literal>tcp</literal> addresses in which both
-- 
2.17.0