4 ms·

Maybe I'm mistaken, but wasn't exim created as a more secure alternative to sendmail? Edit: on a second thought, "more secure than sendmail" means nothing. It

Maybe I'm mistaken, but wasn't exim created as a more secure alternative to sendmail? Edit: on a second thought, "more secure than sendmail" means nothing. It is probably impossible to be _less_ secure than sendmail.

whalesalad 6y ago
Pretty much everything after sendmail was designed as a more secure or otherwise improved version of sendmail. No piece of software is 100% flawless.
tyingq 6y ago
You're probably thinking of postfix, as it had a security theme from the outset. The original name was "Secure Mailer": https://archive.nytimes.com/www.nytimes.com/library/tech/98/12/biztech/articles/14blue.html https://archive.nytimes.com/www.nytimes.com/library/tech/98/... The "Ex" in exim stood for experimental, and while it had some security goals, that was less up front. Unrelated, but interesting, the Exim author (Philip Hazel) also wrote the PCRE library.
whoopdedo 6y ago
My recollection it was billed as easier to setup than Sendmail. During the vote to make it default[1] it was also helped by being smaller than Postfix (at a time when Debian was still supporting floppy disks for installation). There may have been some (with hindsight naive) justification that the easier configuration would make systems more secure by avoiding common Sendmail pitfalls. But I don't think we were thinking about security 20 years ago the same as we do now. It was mostly a "if you can put it in a chroot you'll be fine" attitude. [1] https://wiki.debian.org/Debate/DefaultMTA https://wiki.debian.org/Debate/DefaultMTA
pjc50 6y ago
Some history of Exim is available in Phil Hazel's technical autobiography; https://drive.google.com/file/d/10TAOEgIL--CmzqOl0fkdP-cagjSLBM4J/view https://drive.google.com/file/d/10TAOEgIL--CmzqOl0fkdP-cagjS... ; it was started in 1995 to provide a mailer for the University of Cambridge as a replacement for "smail". (When I joined the university in 1997 it was fully deployed there; most people accessed their mail by telnet to a single large Sun server which ran PINE.)

whalesalad 6y ago

Pretty much everything after sendmail was designed as a more secure or otherwise improved version of sendmail. No piece of software is 100% flawless.

tyingq 6y ago

You're probably thinking of postfix, as it had a security theme from the outset. The original name was "Secure Mailer": https://archive.nytimes.com/www.nytimes.com/library/tech/98/12/biztech/articles/14blue.html https://archive.nytimes.com/www.nytimes.com/library/tech/98/... The "Ex" in exim stood for experimental, and while it had some security goals, that was less up front. Unrelated, but interesting, the Exim author (Philip Hazel) also wrote the PCRE library.

whoopdedo 6y ago

My recollection it was billed as easier to setup than Sendmail. During the vote to make it default[1] it was also helped by being smaller than Postfix (at a time when Debian was still supporting floppy disks for installation). There may have been some (with hindsight naive) justification that the easier configuration would make systems more secure by avoiding common Sendmail pitfalls. But I don't think we were thinking about security 20 years ago the same as we do now. It was mostly a "if you can put it in a chroot you'll be fine" attitude. [1] https://wiki.debian.org/Debate/DefaultMTA https://wiki.debian.org/Debate/DefaultMTA

pjc50 6y ago

Some history of Exim is available in Phil Hazel's technical autobiography; https://drive.google.com/file/d/10TAOEgIL--CmzqOl0fkdP-cagjSLBM4J/view https://drive.google.com/file/d/10TAOEgIL--CmzqOl0fkdP-cagjS... ; it was started in 1995 to provide a mailer for the University of Cambridge as a replacement for "smail". (When I joined the university in 1997 it was fully deployed there; most people accessed their mail by telnet to a single large Sun server which ran PINE.)