4 ms·

Is this authless? You just send mail as the account configured and anyone can send mail?

• bjpbakker 9y ago
  I haven't tried it myself (and won't) but given this section "Passing Secrets" in the README [1] I dont think its authless. [1] https://github.com/dthree/mailit/blob/master/readme.md#passing-secrets https://github.com/dthree/mailit/blob/master/readme.md#passi...
  • icebraining 9y ago
    Those secrets are for Mailit itself to connect and authenticate against the email server.
    • bjpbakker 9y ago
      Ah you're right. So this is even worse than I thought..
      • brntn 9y ago
        It's not _worse_, it's just designed for a use case that expects it to only be available to services that are allowed to send email.
• carl_dr 9y ago
  > This service defaults to no authentication.
  • beefhash 9y ago
    That default really did not work out well for MongoDB[1]. Why are we perpetuating this mistake? [1] https://www.bleepingcomputer.com/news/security/mongodb-apocalypse-professional-ransomware-group-gets-involved-infections-reach-28k-servers/ https://www.bleepingcomputer.com/news/security/mongodb-apoca...
    • e12e 9y ago
      Perhaps, more importantly, that didn't work out very well for smtp either ; aka "open relay".
• fidbit 9y ago
  A service like this might only be exposed internally to trusted servers. Depends on the setup.
• deleted 9y ago
  [deleted]
• hashbangladesh 9y ago
  Everyone eventually learns about networking and firewalls, the easy way ore the hard way.