3 ms·

Tom, what on earth is a nth generation MTA? SMTP has largely remained static as a standard (when did that EHLO thing arrive?) for decades. OK, there are a lot

Tom, what on earth is a nth generation MTA? SMTP has largely remained static as a standard (when did that EHLO thing arrive?) for decades. OK, there are a lot of add ons such as SPF, DKIM and DMARC. I'm also not sure what UX means either in this context - its an MTA. I'll take your comment on the quality of the code as stated - I respect your judgement on that but bear in mind that Exim is continuously developed. I lurk on their mailing lists and Jeremy and Co are continuously refining it. It is a single binary and that single binary is written in C but whenever CVEs come up, they seem to be handled with professionalism and alacrity. So, perhaps you might like to give it another go. It is rather powerful in what you can do with it. For example you can update exim.conf and then run exim -bhc w.x.y.z and run through a SMTP session to test it as though you are coming from the IP address w.x.y.z. Anyway, I suspect I have way worse binaries from a purist's perspective doing stuff on my systems than Exim. However, I do know I've shifted many, many millions and perhaps billions of emails with it without any snags.

tptacek 4y ago
Thomas. :) Nobody I'm aware of has formalized the "generations" of MTAs, but they clearly exist. There may have been a generation preceding them, but SMail and Sendmail are the first generation: highly featureful, no security design (they were often designed to simply shell out to pipelines to get things done!), with C foundations written --- I know this is hard for people in 2022 to grok --- before there was any common understanding of memory safety, not even overflows, let alone memory lifecycle issues like UAF. People forget that the first published stack overflow exploit (after the idiosyncratic Morris Worm) wasn't until 1995. The next generation --- I'll call it the "second" generation --- improved both the performance (which was abysmal) and the security of the first; security was the motivation for them. qmail and Postfix are the big two designs here, and they share a bunch of architectural features. And, my claim is, for like the last 10-15 years, nobody sane would have implemented an MTA in a memory-unsafe language (there's just no need), nor would they have used Unix Programming 101 techniques for storing data. The UX of an MTA refers to how it's configured. As I wrote it, I thought maybe people would get hung up on that; after all, we'd refer to the "DX" of a development platform, so maybe I want to say "AX" for "admin experience". But then I thought, nah, that's silly. The point of modern secure software designs is not to have the CVEs in the first place. Your operating assumption needs to be that your adversary knows about the "CVE" before you do.

tptacek 4y ago

Thomas. :) Nobody I'm aware of has formalized the "generations" of MTAs, but they clearly exist. There may have been a generation preceding them, but SMail and Sendmail are the first generation: highly featureful, no security design (they were often designed to simply shell out to pipelines to get things done!), with C foundations written --- I know this is hard for people in 2022 to grok --- before there was any common understanding of memory safety, not even overflows, let alone memory lifecycle issues like UAF. People forget that the first published stack overflow exploit (after the idiosyncratic Morris Worm) wasn't until 1995. The next generation --- I'll call it the "second" generation --- improved both the performance (which was abysmal) and the security of the first; security was the motivation for them. qmail and Postfix are the big two designs here, and they share a bunch of architectural features. And, my claim is, for like the last 10-15 years, nobody sane would have implemented an MTA in a memory-unsafe language (there's just no need), nor would they have used Unix Programming 101 techniques for storing data. The UX of an MTA refers to how it's configured. As I wrote it, I thought maybe people would get hung up on that; after all, we'd refer to the "DX" of a development platform, so maybe I want to say "AX" for "admin experience". But then I thought, nah, that's silly. The point of modern secure software designs is not to have the CVEs in the first place. Your operating assumption needs to be that your adversary knows about the "CVE" before you do.