=== modified file 'TODO'
--- TODO	2014-12-21 12:54:46 +0000
+++ TODO	2015-03-10 18:03:38 +0000
@@ -88,6 +88,7 @@
 ** TODO Error handling on error parsing config files
 ** TODO init.d script error handling
 ** TODO D-Bus server properties; address, port, interface, etc.		     :2:
+** TODO [#C] In Python 3.3, use shlex.quote() instead of re.escape()
 
 * mandos.xml
 ** Add mandos contact info in manual pages

=== modified file 'intro.xml'
--- intro.xml	2014-06-22 02:19:30 +0000
+++ intro.xml	2015-03-10 18:03:38 +0000
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-<!ENTITY TIMESTAMP "2014-06-22">
+<!ENTITY TIMESTAMP "2015-03-08">
 <!ENTITY % common SYSTEM "common.ent">
 %common;
 ]>
@@ -197,6 +197,16 @@
       </para>
     </refsect2>
     
+    <refsect2 id="sniff">
+      <title>How about sniffing the network traffic and decrypting it
+      later by physically grabbing the Mandos client and using its
+      key?</title>
+      <para>
+	We only use <acronym>PFS</acronym> (Perfect Forward Security)
+	key exchange algorithms in TLS, which protects against this.
+      </para>
+    </refsect2>
+    
     <refsect2 id="physgrab">
       <title>Physically grabbing the Mandos server computer?</title>
       <para>

=== modified file 'mandos'
--- mandos	2014-12-21 12:54:46 +0000
+++ mandos	2015-03-10 18:03:38 +0000
@@ -2356,7 +2356,8 @@
                         "port": "",
                         "debug": "False",
                         "priority":
-                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
+                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
+                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
                         "servicename": "Mandos",
                         "use_dbus": "True",
                         "use_ipv6": "True",

=== modified file 'mandos-options.xml'
--- mandos-options.xml	2014-06-15 02:48:49 +0000
+++ mandos-options.xml	2015-03-10 18:03:38 +0000
@@ -49,25 +49,28 @@
   <para id="priority_compat">
     GnuTLS priority string for the <acronym>TLS</acronym> handshake.
     The default is <quote><literal
-    >SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:</literal>
-    <literal>+SIGN-RSA-RMD160</literal></quote>.
+    >SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA</literal>
+    <literal>:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160</literal></quote>.
     See <citerefentry><refentrytitle
     >gnutls_priority_init</refentrytitle>
     <manvolnum>3</manvolnum></citerefentry> for the syntax.
     <emphasis>Warning</emphasis>: changing this may make the
     <acronym>TLS</acronym> handshake fail, making server-client
-    communication impossible.
+    communication impossible.  Changing this option may also make the
+    network traffic decryptable by an attacker.
   </para>
   
   <para id="priority">
     GnuTLS priority string for the <acronym>TLS</acronym> handshake.
     The default is <quote><literal
-    >SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP</literal></quote>.  See
-    <citerefentry><refentrytitle >gnutls_priority_init</refentrytitle>
+    >SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA</literal></quote>.
+    See <citerefentry><refentrytitle
+    >gnutls_priority_init</refentrytitle>
     <manvolnum>3</manvolnum></citerefentry> for the syntax.
     <emphasis>Warning</emphasis>: changing this may make the
     <acronym>TLS</acronym> handshake fail, making server-client
-    communication impossible.
+    communication impossible.  Changing this option may also make the
+    network traffic decryptable by an attacker.
   </para>
   
   <para id="servicename">

=== modified file 'plugins.d/mandos-client.c'
--- plugins.d/mandos-client.c	2014-08-20 21:46:38 +0000
+++ plugins.d/mandos-client.c	2015-03-10 18:03:38 +0000
@@ -1902,7 +1902,7 @@
 int main(int argc, char *argv[]){
   mandos_context mc = { .server = NULL, .dh_bits = 1024,
 			.priority = "SECURE256:!CTYPE-X.509:"
-			"+CTYPE-OPENPGP", .current_server = NULL,
+			"+CTYPE-OPENPGP:!RSA", .current_server = NULL,
 			.interfaces = NULL, .interfaces_size = 0 };
   AvahiSServiceBrowser *sb = NULL;
   error_t ret_errno;