Ignorance? How many bugs have been in Sendmail? How many servers have been rooted because of it? Hmm, run an insecure Mail program with root privs, ohhhh yes, there is a great idea. If you want to call me ignorant, you set up a mail server, give me the IP and a week to play with some friends, and a signed paper saying you won't take legal action, and if me and friends lose, I'll withdraw my statement, if we succeed, you get owned, and so does any box that server can connect to remotely. On Thursday 09 September 2004 16:53, Chris Cameron wrote:

Spoken with true ignorance. Congratulations.

On September 9, 2004 01:38 pm, Allen wrote:

...

Sendmail is one of the most insecure POS ever made. Windows ME would be more secure than sendmail.

Windows XP is secure if you actually know what you're doing. A friend of mine recently held a contest on antionline.com and not one person was able to break in. People who say bad things about XP in the reliability/security area have no idea what they are doing. XP can have months of uptime, (Record I've seen is about 100 days) and for security, well, I'm not going to go and search for the link but my friend who held the war game on his box documented everything on http://www.antionline.com I'm not going and searching for it, it's 2 AM, and this is my second day up, and I have to get up in a few hours. On Friday 10 September 2004 01:35, John Andersen wrote:

Now Windows ME, on the other hand, in spite of continuous patches is still the second most insecure system ever developed right behind the flagship product WinXP.

Your comparison is unwarranted.

-- _____________________________________ John Andersen

Is it really hard to install a firewall, anti virus, update, and shut down services you don't need? And then not using IE? Maybe you'd like a demo? I'm willing to bet my friend's XP machine, running a Web server, could take anything you could throw at it. On Friday 10 September 2004 05:08, peter Nikolic wrote:

On Friday 10 Sep 2004 07:01, Allen wrote:

...

Windows XP is secure if you actually know what you're doing. A friend of mine recently held a contest on antionline.com and not one person was able to break in.

People who say bad things about XP in the reliability/security area have no idea what they are doing. XP can have months of uptime, (Record I've seen is about 100 days) and for security, well, I'm not going to go and search for the link but my friend who held the war game on his box documented everything on http://www.antionline.com

I'm not going and searching for it, it's 2 AM, and this is my second day up, and I have to get up in a few hours.

On Friday 10 September 2004 01:35, John Andersen wrote:

...

Now Windows ME, on the other hand, in spite of continuous patches is still the second most insecure system ever developed right behind the flagship product WinXP.

Your comparison is unwarranted.

-- _____________________________________ John Andersen

Ho Ho Ho ..

Now thereś a joke if ever there was one what you on crack weed summit XP secure yeahhhhhhh! i dont think so (know so ) having to rescue Xp machines too many now more holes than a cullinder

Pete -- Linux user No: 256242 Machine No: 139931 G6NJR Pete also MSA registered "Quinton 11" A Linux Only area Happy bug hunting M$ clan PGN

Microsoft did ship XENIX, I'm not a person who used it but I would imagine it was more secure than the crap they started sending not long after. Well, DOS with the right application could be very secure. It can't handle more than one user or task at a time, so getting an application running that won't allow threads to be made would pretty much stop it from allowing another thread for command execution would pretty much lock it down good, because another user wouldn't be able to remotely get in, as it wouldn't be able to handle another user, and running a program on it, basically the fact it can't do this would help a lot. Of course you'd have to code an application to stop it from allowing threads and things that would allow a break in, but it could be done. I know it would take a lot but DOS could be secured very well. The only problem is if someone DOES manage to get in, you're screwed because they have access to everything, as DOS isn't multi user and has no concept of permissions. I can agree every OS can be secured though, which is why I stood up for XP. I rarely use it, but it's not like it can't be secured. On Friday 10 September 2004 11:55, Ken Schneider wrote:

On Fri, 2004-09-10 at 11:44, Allen wrote:

...

Is it really hard to install a firewall, anti virus, update, and shut down services you don't need? And then not using IE? Maybe you'd like a demo? I'm willing to bet my friend's XP machine, running a Web server, could take anything you could throw at it.

That's all well and good. ANY OS properly setup will be secure. Out of the box linux is more secure than -any- OS that MS shipped. Sendmail ,like postfix, can only be as secure as the person setting it up.

-- Ken Schneider unix user since 1989 linux user since 1994 SuSE user since 1998 (5.2) * PLEASE only reply to the list *

On Friday 10 September 2004 07:44 am, Allen wrote:

Is it really hard to install a firewall, anti virus, update, and shut down services you don't need? And then not using IE? Maybe you'd like a demo? I'm willing to bet my friend's XP machine, running a Web server, could take anything you could throw at it.

Why should I have to ? My suse installed SECURE out of the box. And it fetched the needed patches before It got out of install mode. Anti virus?!! Surely you jest! Firewall? Built in by Suse. Does your "Friend" know you are throwing down the Gauntlet on the Internet? This is a very silly thing to do.... -- _____________________________________ John Andersen

On Saturday 11 September 2004 03:56, Allen wrote:

The first viruses were made for UNIX, don't use this as a reason for anything.

wrong :) the first viruses were for apple os: 1981 Apple Viruses 1, 2, and 3 are some of the first viruses “in the wild,” or in the public domain. Found on the Apple II operating system, the viruses spread through Texas A&M via pirated computer games. Josephine

Allen, On Friday 10 September 2004 19:37, Allen wrote:

OK, for home systems, but I meant the ones people did at MIT in the 60's. They called them pranks, but today they would be called viruses. Could be 70s by the way, I don't know the exact date, as I wasn't even born yet.

Nor was Unix "born yet" in the sixties. It was a product of the seventies.

...

Randall Schulz

Allen, On Friday 10 September 2004 20:15, Allen wrote:

Actually it was done in 1968. Remember? AT&T? The 70's was when BSD and about 600 other UNIX OSs came out. by the 70s the first GUI had been made.

Check out http://www.unix.org/what_is_unix/history_timeline.html>. This quote is telling: "...the number of UNIX installations has grown to 10, with more expected..." - Dennis Ritchie and Ken Thompson, June 1972 Given that the first thing named Unix came out in 1969, I don't think it's unreasonable to say that Unix as we know it was a product of the 70's. Randall Schulz

Allen, Were you around then? I thought you said you hadn't even been born? As such, you'd think you have nothing to go on but published histories such as the one I referenced and quoted. That and the accounts of people who used early Unix systems, as I did. The first Unix I used was Version 6, in 1977. That's the same version listed as the starting point for BSD Unix. "The 60s" (i.e., 1969) did not see Unix outside a (thankfully) obscure corner of Bell Labs and a handful of staff who worked on it in their spare time. Likewise, very few people outside Berkeley used BSD Unix before the VAX came along at the end of the 1970s. RRS On Friday 10 September 2004 23:08, Allen wrote:

It wasn't released for use to anyone for a while. Only AT&T used it at first.

On Friday 10 September 2004 23:38, Randall R Schulz wrote:

...

Allen,

On Friday 10 September 2004 20:15, Allen wrote:

...

Actually it was done in 1968. Remember? AT&T? The 70's was when BSD and about 600 other UNIX OSs came out. by the 70s the first GUI had been made.

Check out http://www.unix.org/what_is_unix/history_timeline.html>. This quote is telling:

"...the number of UNIX installations has grown to 10, with more expected..."

- Dennis Ritchie and Ken Thompson, June 1972

Given that the first thing named Unix came out in 1969, I don't think it's unreasonable to say that Unix as we know it was a product of the 70's.

No, it was the late 60s. By the 70s a GUI had been made for use. The 60s had MIT and UNIX, the 70s were the BSD days at Berkeley.

...

Randall Schulz

On Saturday 11 September 2004 08:08, Allen wrote:

No, it was the late 60s. By the 70s a GUI had been made for use. The 60s had MIT and UNIX, the 70s were the BSD days at Berkeley.

The 60s had MULTICS, MIT didn't get into UNIX until much later, BSD 1 was 1977, and the first UNIX GUI was in the mid 80s. UNICS was 1969 and UNIX was 1970

On Sat, 11 Sep 2004 14:33:59 -0400 Allen wrote:

I didn't say the first UNIX GUI, I said the first GUI was in the 70's. WIMP. Richard Stallman says it was the 60s - 70s where the first hackers at MIT started doing their thing. MULTICS was what became UNIX And according to AT&T, it was 1968 for UNIX, and MULTICS was earlier. Ken Thompson had worked on the Multics system, and in 1968 he wrote Unix which had a lot of features inspired by his work on Multics. Unix was rewritten in C in 1970. -- Jerry Feldman Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9

Just as Linux was rewritten in C? Either way, UNIX has been around since the 60's, not the 70's. When Linux was first written (I do have a copy of 0.01) I was in 1st grade. Assembler all the way. On Sunday 12 September 2004 07:42, Jerry Feldman wrote:

On Sat, 11 Sep 2004 14:33:59 -0400

Allen wrote:

...

I didn't say the first UNIX GUI, I said the first GUI was in the 70's. WIMP. Richard Stallman says it was the 60s - 70s where the first hackers at MIT started doing their thing. MULTICS was what became UNIX And according to AT&T, it was 1968 for UNIX, and MULTICS was earlier.

Ken Thompson had worked on the Multics system, and in 1968 he wrote Unix which had a lot of features inspired by his work on Multics. Unix was rewritten in C in 1970.

On Sunday 12 September 2004 11:19, Allen wrote:

... UNIX has been around since the 60's, not the 70's.

If a mere handful of experimental systems running Unix staring in 1969 is what you mean. If a grand total of ten systems by 1972 is what you mean, then yes. But let's be real. Out of a 35 year history, not more than one year of that history overlapped the 60s and only the merest sliver of what came to be the modern Unix system existed in that 12-month period. Give it a rest, boy. RRS

* Allen [09-12-04 21:23]:

Du Lecken Arsloch, Der Shwanz

So, you have German, top post and full quote, are immature, brash and impolite. Have a good day and try not to choke -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos

* Allen [09-12-04 21:39]:

Basically. You forgot elitist though.

Your opinion, not mine.

I just throw back. Just how "polite" was it when people said those things about me?

And you continue to top post and full quote. <plonk>! You remain impolite. Judge yourself....... -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos

Uhhh, OK, what exactly is "top post" ? It means starting a reply above the original post. If a threat progresses

I've used a mailing list maybe 5 times and I've yet to see that word explained. Search the archives for this list - it's been explained countless times. As it has been explained countless times on the Debian list, the Red Hat list,

On Monday 13 September 2004 06:56, Allen wrote: this long, it gets confusing. The correct way is to reply underneath the specific point you're referring to, and to snip out the stuff that's not relevant. When a thread gets long it's much easier to follow that way, especially if your mail client doesn't support threading. the Postfix list, and just about every other list that I've been reading for the past 8 or so years. It's called "netiquette," and include other bits like writing in uppercase is shouting and considered rude. Look it up.

I stated an opinion and got attacked, but when I said something back, In all fairness, trying to advertise Windows security on a linux list is nothing but flamebait. It's a bit like trying to promote Linux's ease of use to a Windows mailing list. You'll get slain for it, regardless.

I guess most people on this list are not Windows security experts (although most get to do with Windows mostly when it's compromised, which unfortunately happens more of then with Windows than Linux, even if you keep the ratio of usage in mind), hence you won't easily find someone who would attempt cracking your windows box. If you advertise on the right channels, and if that particular windows box is in fact running any standard microsoft services and making them available to the outside, that box will get compromised sooner or later. A linux list isn't the right place to look for that sort of competition. Please, would you (and everybody involved in this thread) take it to the suse-ot list, as Windows security and people's opinion of each other is way off topic for this list. -- Kind regards Hans du Plooy Newington Consulting Services hansdp at newingtoncs dot co dot za

And of course, the HAL-9000, was running Windows in 2001. ;-) Allen wrote:

Actually it was done in 1968. Remember? AT&T? The 70's was when BSD and about 600 other UNIX OSs came out. by the 70s the first GUI had been made.

On Friday 10 September 2004 22:57, Randall R Schulz wrote:

...

Allen,

On Friday 10 September 2004 19:37, Allen wrote:

...

OK, for home systems, but I meant the ones people did at MIT in the 60's. They called them pranks, but today they would be called viruses. Could be 70s by the way, I don't know the exact date, as I wasn't even born yet.

Nor was Unix "born yet" in the sixties. It was a product of the seventies.

...

...

Randall Schulz

On Saturday 11 September 2004 15:25, Carlos E. R. wrote:

The Saturday 2004-09-11 at 17:07 -0400, James Knott wrote:

...

And of course, the HAL-9000, was running Windows in 2001. ;-)

You gotta be kidding :-P

With working voice recognition, an ego, not failing (it was given conflicting orders)... no, not windows :-p

Well, it did become psychotic. That's very MS, don't you think?

-- Cheers, Carlos Robinson

RRS

On Saturday 11 September 2004 16:08, Carlos E. R. wrote:

The Saturday 2004-09-11 at 15:38 -0700, Randall R Schulz wrote:

[Very OT]

...

...

With working voice recognition, an ego, not failing (it was given conflicting orders)... no, not windows :-p

Well, it did become psychotic. That's very MS, don't you think?

No, MS did not exist when Mr. Clark wrote that.

Do I have to say it? IT WAS A JOKE. It is NOT TO BE TAKEN SERIOUSLY. It doesn't even have to make a lot of sense. Just chuckle and leave it at that. Oy.

-- Cheers, Carlos Robinson

On Sun, 2004-09-12 at 01:49 +0200, Carlos E. R. wrote:

Humour is not so international, your sense of humor may not be necessarily be understood. :-|

Some people have problems on international forums, they make too much of language nuances that non-native speakers fail completely to notice. I think it's the biggest source of conflict on the internet

The Sunday 2004-09-12 at 02:12 +0200, Anders Johansson wrote:

On Sun, 2004-09-12 at 01:49 +0200, Carlos E. R. wrote:

...

Humour is not so international, your sense of humor may not be necessarily be understood. :-|

Some people have problems on international forums, they make too much of language nuances that non-native speakers fail completely to notice. I think it's the biggest source of conflict on the internet

Just my point. I never thought he was joking, I thought he was absolutely serious. Face value. That's why smileys were invented, to clarify those situations and avoid missinterpretations like mine. -- Cheers, Carlos Robinson

The Sunday 2004-09-12 at 18:35 -0700, Randall R Schulz wrote:

...

That's why smileys were invented, to clarify those situations and avoid missinterpretations like mine.

Then I'll take my chances with being misunderstood, 'cause I refuse to use emoticons.

That's ok, as long as you don't blame us for the misunderstandings. Or you can try to be clearer. -- Cheers, Carlos Robinson

*** Reply to message from "Carlos E. R." on Sun, 12 Sep 2004 01:08:40 +0200 (CEST) One more candle and a trip around the Sun***

No, MS did not exist when Mr. Clark wrote that.

Actually, HAL is very "human". It was given instructions (hide information from the crew) that conflicted heavily with its basic design (give all information) - and this fact was hidden from HAL designer, Mr Chandra. Thus, it developed a mental illness, thinking that only he was really necessary, the human crew redundant, and trying to severe the connection with the source of conflicting orders (ie, Earth) :-p

That was pretty much as Clark described it in a later interview.Chandra was attempting to make the computer as human as posible , and it was Chandra who thought of HAL as more important to the success of the mission than the human crew. Chandra was very much an introvert and didn't have a lot of use for human contact. It was thought, when considered even further that HAL might have developed similar problems mimicing serious mental diseases strictly on the basis of Chandra's programming him. Arthur Clark thought many computer scientists had much too much of their own being invested in some of their computer alter egos, and were in many ways "stage mothers and fathers" in that. Nothing must be said against their "baby", and no critisim was ever allowed to stand. He had hope tho, did Clark, that no one person would be so intertwined w/ a single point of failure , as HAL and any decendants might become, and that such failures would be caught before they became life threatening. I guess it was a point of reference tho that HAL was NOT any form of a robot, since that programming would have violated the robotic imprimatur. No robot could ever harm a human, etc... Of course, a lot of the thinking about plot points etc happened afterwards, as the story for the movie was made up as they went from a brief outline. And the way movies are made is get it on film first and figure out what it means later. -- j -- nemo me impune lacessit

The Saturday 2004-09-11 at 19:00 -0500, jfweber@bellsouth.net wrote: [very OT]

That was pretty much as Clark described it in a later interview.

He also explained it, albeit somewhat differently, on the first sequel of the novel.

I guess it was a point of reference tho that HAL was NOT any form of a robot, since that programming would have violated the robotic imprimatur. No robot could ever harm a human, etc...

Mmmmm... HAL, together with Discovery, could be argued as a "robot", in the sense that it is a computer with the ability to move and change things, open doors, orientate antennas, fire up the motors, etc. Ie, HAL is not the standard computer with only a console, or even a voice interface.

Of course, a lot of the thinking about plot points etc happened afterwards, as the story for the movie was made up as they went from a brief outline. And the way movies are made is get it on film first and figure out what it means later.

Well, noting that it was made by Kubrick, with Clark as guionist (or whatever), they both spent a good deal of design time on the movie before they started shooting. The idea was to make the best scifi movie possible, and no need to return ever to scifi. K. never made another, I think. Fascinating movie. Perfection. I raise my hat. To stay half on topic, any possibility of a voice interface in Linux? ;-) -- Cheers, Carlos Robinson

The Sunday 2004-09-12 at 18:39 -0700, Randall R Schulz wrote:

...

To stay half on topic, any possibility of a voice interface in Linux? ;-)

It's there, but I just can't stand the thought of Steven Hawking trapped in my computer.

Can it recognise voice commands? :-o I know how to make it talk, with festival - in fact, a cron job gives me the hours. -- Cheers, Carlos Robinson

The Monday 2004-09-13 at 11:04 -0700, Randall R Schulz wrote:

...

I know how to make it talk, with festival - in fact, a cron job gives me the hours.

I know someone who snagged the AOL "You have mail" sound and rigged a check into his shell prompt action to play that sound whenever new mail appears in is in-box. It's very annoying to work with him over the phone...

I recogn I would kill that clock fast, had I made it to talk oftener. It's only every 30 minutes, at a low volume, and I'm considering changing it to the hours. -- Cheers, Carlos Robinson

Randall R Schulz wrote:

On Monday 13 September 2004 05:08, Carlos E. R. wrote:

...

...

Can it recognise voice commands? :-o

How timely. Fred Miller just posted to SuSE-OT (where all this belongs, I admit) about an announcement from IBM that they're releasing some of their speech recognition software for open source use: http://news.com.com/2100-7344-5363164.html>

I remember seeing some demos of the OS/2 Voice Type Dictation, about 10 years ago. It was quite good for the time. I wonder what's happened since then? I never installed VTD on my own systems, as I didn't have much need for it.

The Monday 2004-09-13 at 13:58 -0700, Randall R Schulz wrote:

...

Can it recognise voice commands? :-o

If you (or anyone who's interested in this topic) are not subscribed to or watching via the archive, SuSE-OT has a few messages about the general topic of voice recognition for Linux following on from Fred Miller's post on the IBM announcement about opening the source on some of its voice recognition software.

I subscribed for a bit, but I run away fast. Too oftopic for me. I'll have a look at the archive, sounds interesting. -- Cheers, Carlos Robinson

Randall R Schulz wrote:

Allen,

On Friday 10 September 2004 19:37, Allen wrote:

...

OK, for home systems, but I meant the ones people did at MIT in the 60's. They called them pranks, but today they would be called viruses. Could be 70s by the way, I don't know the exact date, as I wasn't even born yet.

Nor was Unix "born yet" in the sixties. It was a product of the seventies.

I thought it was created in 1969.

My friend already did put it out for anyone to try and break through. No one succeeded. If you're going to say it's not secure, then ante up and accept a war game to prove it. On Saturday 11 September 2004 08:53, Mike wrote:

On Fri, 10 Sep 2004 21:56:16 -0400, you wrote:

...

On Friday 10 September 2004 20:13, John Andersen wrote:

...

On Friday 10 September 2004 07:44 am, Allen wrote:

...

Is it really hard to install a firewall, anti virus, update, and shut down services you don't need? And then not using IE? Maybe you'd like a demo? I'm willing to bet my friend's XP machine, running a Web server, could take anything you could throw at it.

Why should I have to ?

Because some people aren't wussy.

Most people who turn on firewalls, IME, lose their connection to the internet due to firewall configuration problems.

...

...

My suse installed SECURE out of the box.

No OS is secure out of the box. If it was updates wouldn't exist.

...

Anti virus?!! Surely you jest!

The first viruses were made for UNIX, don't use this as a reason for anything.

I have a question here. What is the percentage of Linux vs MS servers on the Internet? The thing is, Linux virus' exist, at this point from what I have read, as proof of concept, and are not out in the wild. 70%+ of all e-mail runs through FOSS software, and with Unix being replaced by Linux, this means that there are a number of servers out there as a target for what virus' do best, send spam e-mail.

...

...

Firewall? Built in by Suse.

And XP doesn't have one? SUSEFirewall is of course the best I've ever used, but I like to argue, which is why I keep this going.

XP's FireWall does exist, turned off in the initial install, and SP2 does turn it on by default, but it hasn't won any kudos that I've read about other than the it's better than nothing variety, search ZD-Net.

...

...

Does your "Friend" know you are throwing down the Gauntlet on the Internet? This is a very silly thing to do....

What the hell? I have no idea what you meant by this.

Because your friend will become a target for a number of malicious attackers, and there are still a lot of nasty security flaws in XP. MS itself has admitted that they won't be able to put out a secure version of windows until 2012. Again search ZD-Net for that info.

I said it was an insecure POS, no where did I say it was incapable of doing it's job. Just to bring back the Windows ME argument, it's insecure and has no idea what Multiuser means, but that doesn't stop it from booting up and being used by a lot of home users either. I can't comment on Qmail as I've never used it, but for me I've liked Postfix more than Sendmail. For Vi and Emacs, generally I use Vi more because it's loads and executes faster for me, but I use Emacs too. In that one I'm neutral. On Friday 10 September 2004 10:40, Chris Cameron wrote:

I've been running sendmail since 2000 (so, not -too- long) and haven't had any security problems. In fact, I believe what I'm running is quite superior to your average MTA setup; in both configuration and security.

There's no way I'm going to invite someone to break into one of my servers, no matter how secure I believe it to be (and you'd be a damn fool if you thought differently). However, the sendmail I run is backed by ProPolice, W^X and systrace; all of which are tertiary precautions considering none of them have ever been needed.

Now lets keep in mind what we're arguing here. You contend sendmail is "the most insecure POS ever made". This is truly ignorant. Considering the gigs of mail traffic any one of my sendmail servers move each day, you'd think the "most insecure POS ever made" would have run into some problem within that 4 years. Not to mention the thousands of servers just like mine that do just as much or more traffic.

Certainly not the model of security, but hardly a POS in any regards.

I'm not arguing against any MTAs here (I do have qmail running on 1 server), but the reason you'd use sendmail is the flexibility.

Sendmail lets me: Keep multiple queues and filter messages into these queues based on destination and delivery attempts, this lets sendmail spend time delivering messages it knows will go through and leaving the slow ones for when there aren't more important messages waiting.

It lets me queue before delivery when someone decides to mail the 10000 people on their mailing list, which allows me to determine what load the server will be under (because not all servers are strictly mail servers).

Scan for viruses and spam with as little overhead as possible with Milter.

It lets me reject spam and viruses even before I accept them for delivery thanks to Milter. This prevents my mail server from having to deal with bouncing back messages to non-existant hosts.

It lets me setup mail servers that deliver only in specific time frames to take advantage of lower Internet charges.

Security problems are for the most part a problem of the past, and considering it's been around since the 80's, it obviously has a long "past". A number of security problems were the result of insecure setup more than anything. It's also actively maintained and has an excellent track record of promptly responding to all kinds of bugs.

Anyway, perhaps you should live in the real world and not run around making definitive statements about what is and isn't insecure pieces of shit.

Chris

On September 9, 2004 11:07 pm, Allen wrote:

...

Ignorance? How many bugs have been in Sendmail? How many servers have been rooted because of it? Hmm, run an insecure Mail program with root privs, ohhhh yes, there is a great idea. If you want to call me ignorant, you set up a mail server, give me the IP and a week to play with some friends, and a signed paper saying you won't take legal action, and if me and friends lose, I'll withdraw my statement, if we succeed, you get owned, and so does any box that server can connect to remotely.

On Thursday 09 September 2004 16:53, Chris Cameron wrote:

...

Spoken with true ignorance. Congratulations.

On September 9, 2004 01:38 pm, Allen wrote:

...

Sendmail is one of the most insecure POS ever made. Windows ME would be more secure than sendmail.

Careful man. Next they will call you ignorant. For the other replies where people are doubting and un-willing to back it up, how about I challenge the people who doubt XP can be secured to a war game? Or are you afraid of losing? On Friday 10 September 2004 14:39, Danny Sauer wrote:

Chris wrote regarding 'Re: [SLE] sendmail vs postfix.' on Fri, Sep 10 at 09:46: [...]

...

I'm not arguing against any MTAs here (I do have qmail running on 1 server), but the reason you'd use sendmail is the flexibility.

Lemme counter a few of these, just FYI:

...

Sendmail lets me: Keep multiple queues and filter messages into these queues based on destination and delivery attempts, this lets sendmail spend time delivering messages it knows will go through and leaving the slow ones for when there aren't more important messages waiting.

Postfix does that out of the box, with one queue.

...

It lets me queue before delivery when someone decides to mail the 10000 people on their mailing list, which allows me to determine what load the server will be under (because not all servers are strictly mail servers).

This one I can't rebuff because it's not totally clear to me. You want messages sent to a list distribution address to be deferred until you specifically release them from the queue? You can do that with postfix. If something else, I'm not sure. There's a delivery concurrency setting in postfix where you set the maximum number of simultaneous connections to individual remote servers, and there's now a daemon that limits the maximum number of incoming messages from any remote server (called "anvil" if you're looking for docs). In addition, you can limit the amount of CPU postfix takes.

...

Scan for viruses and spam with as little overhead as possible with Milter.

This used to be an advantage, as the "solution" under postfix was to run a pair of mail servers with one delivering to a script that then delivered to the second mail server. That's a kludge if I ever saw one. :) But the newer versions of Postfix do have arbitrary filter support, both through shells scripts or using some built-in parsers.

...

It lets me reject spam and viruses even before I accept them for delivery thanks to Milter. This prevents my mail server from having to deal with bouncing back messages to non-existant hosts.

But it slows down delivery and costs memory - and if something happens before the delivery stage the message is just lost. You also don't save any bandwidth, since you need to get the whole message in order to check it. Granted, I do this too, but it's not a perfect solution. BTW, I do it with postfix and spam assassin. :)

...

It lets me setup mail servers that deliver only in specific time frames to take advantage of lower Internet charges.

Again, you can do this with postfix (but I think you might also need cron to flush those messages - I don't remember off the top of my head).

...

Security problems are for the most part a problem of the past, and considering it's been around since the 80's, it obviously has a long "past". A number of security problems were the result of insecure setup more than anything. It's also actively maintained and has an excellent track record of promptly responding to all kinds of bugs.

Postfix was designed from the ground up to maximize security. That's one of the reasons behind having a bunch of small programs that just do one part of the delivery process each, rather than a huge process that does it all. Most of the sub-tasks don't require any elevated priviledges, so they run without them. Postfix is good about dropping privs as soon as it can. While modern sendmails are definately more secure than they used to be, the track recod left a bad taste in the mouths of many. It is also real easy to break a sendmail install in such a way as to make it insecure, whereas postfix is more resistant to that kind of thing. If you know what you're doing with sendmail, though, sendmail can handle a lot and can do a lot. It's a mature program with a huge installed base. Then again, so is bind, and it's constantly breaking - but I still run it. :)

I'm not arguing that sendmail should be abandoned, but if anyone is running it exclusively for the above reasons, they might go check out postfix.org and see how a more efficient, more secure MTA could be of help. Readable config files are reason enough, IMHO. :) The site is pretty well done, and the program's well documented with a very active mailing list.

--Danny