Theo de Raadt wrote:
> > Sendmail is, as we know, the most used daemon for SMTP in the world. This
> > is an International Infrastructure vulnerability and should have been
> > treated that way. It wasn't. It was handled not only poorly, but
> > irresponsibly.

The documentation is distressingly vague.

> Now, the same holds true with OpenSSH. I'll tell you what. If there
> is ever a security problem (again :) in OpenSSH we will disclose it
> exactly like we want, and in no other way, and quite frankly since
> noone has ever paid a cent for it's development they have nothing they
> can say about it.

Theo,

this is not about paying or not paying, it is not about owing somebody
something, but about sensible disclosure of security problems to the
world.

Sendmail has been an important part of the Internet infrastructure and
has gained a lot of honour and respect. Many people use this piece of
software and a lot of distributors/vendors are proliferating this
software. They do deserve better, as do the users who decide to trust
this vendor.

> Or run something else.

Maybe this is indeed the way to go. There are several other
feature-rich mail transport agents.

Regards,

Joey

--
Open source is important from a technical angle. -- Linus Torvalds

Please always Cc to me when replying to me on the lists.

[ reply ]