Theo de Raadt wrote: > > Sendmail is, as we know, the most used daemon for SMTP in the world. This > > is an International Infrastructure vulnerability and should have been > > treated that way. It wasn't. It was handled not only poorly, but > > irresponsibly. The documentation is distressingly vague. > Now, the same holds true with OpenSSH. I'll tell you what. If there > is ever a security problem (again :) in OpenSSH we will disclose it > exactly like we want, and in no other way, and quite frankly since > noone has ever paid a cent for it's development they have nothing they > can say about it. Theo, this is not about paying or not paying, it is not about owing somebody something, but about sensible disclosure of security problems to the world. Sendmail has been an important part of the Internet infrastructure and has gained a lot of honour and respect. Many people use this piece of software and a lot of distributors/vendors are proliferating this software. They do deserve better, as do the users who decide to trust this vendor. > Or run something else. Maybe this is indeed the way to go. There are several other feature-rich mail transport agents. Regards, Joey -- Open source is important from a technical angle. -- Linus Torvalds Please always Cc to me when replying to me on the lists.
