From owner-freebsd-arch@freebsd.org Thu Dec 7 22:07:56 2017 Return-Path: Delivered-To: freebsd-arch@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C66E1E9295F for ; Thu, 7 Dec 2017 22:07:56 +0000 (UTC) (envelope-from delphij@gmail.com) Received: from mailman.ysv.freebsd.org (unknown [127.0.1.3]) by mx1.freebsd.org (Postfix) with ESMTP id A235678B2E for ; Thu, 7 Dec 2017 22:07:56 +0000 (UTC) (envelope-from delphij@gmail.com) Received: by mailman.ysv.freebsd.org (Postfix) id 9EB9AE9295E; Thu, 7 Dec 2017 22:07:56 +0000 (UTC) Delivered-To: arch@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9E610E9295D for ; Thu, 7 Dec 2017 22:07:56 +0000 (UTC) (envelope-from delphij@gmail.com) Received: from mail-it0-x234.google.com (mail-it0-x234.google.com [IPv6:2607:f8b0:4001:c0b::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 6531578B2D; Thu, 7 Dec 2017 22:07:56 +0000 (UTC) (envelope-from delphij@gmail.com) Received: by mail-it0-x234.google.com with SMTP id t1so626393ite.5; Thu, 07 Dec 2017 14:07:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=VOAQQ4IluOeJKLRFioy6eF5CzAWT3/XzY55f/Ua7cV8=; b=WltKe3MeWWhQU1ug73q8TwzkdcsbSWlW0XxsAX4BCZqXT0vVWWASpJ1lGfeN0JWIpW D+/3JpyQXBYM3Njr8npaj8umme2RCZlHrFeBXZlCPU4aSkAg/Ko7e6mH5wF6rTsj/0Cj h0z+O3QplWGOMZ8eh1JtOWFRExICrYtvanplB2sQ7VaCS/AkFDie9WFI0rJC5T9mn9JF m7vhiPg2jmgdm14HY+6ovNPOp+UHUDQMLttTzSjMus5OTL4istLJ/cyhl9v8dZdw745W 5DjFMKAJVCaKuO8HMoWOvslc0ZDmAzP5ln93SDbth0snGLOGDPtFoXIJIxDf3Bg19OMI lB7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=VOAQQ4IluOeJKLRFioy6eF5CzAWT3/XzY55f/Ua7cV8=; b=H3JtG7LMGl0XuBFKpTUcAlb4J6e9D2rZcWyYs1leGbf2pO8+v3+eicKJO4hg/X6bbP ylhiK99EQQBi7SKwGGDvLV2bgrc0ajPBAAFF2OVnfqNqkYNO1i2QyGxllOA8jFsHdy7J BA4i0cYQua2tjE/dJ6bOkBeikElz7iK7MSbi1l5ZrqlgRs35V5rGYFlEYbk7cRTmaW76 astZNuZK3lYFL/etIybntNUk5lDWFYAoGG+WjZ6nQMeanJ667kdPj+ofFE1hlYPaTX2b NyHBqaFf6GTMVI8RKovI1ayoJ2vswXPKIyAWsoJxj4LnEDcdbgcDnIEi1VO9mf4hFl0j dE2g== X-Gm-Message-State: AKGB3mI+sDBgDh4GF3lxDU08PNe8mzR9+0vhqrilQBLJP8SwGRPZ6gLt daO4jkZNsASqb8TWz9Q01RxCCsirf5X13QntA2w= X-Google-Smtp-Source: AGs4zMbXCMgTzvtsPATHZMctF25TqB3HwK5RFA/68437tEUBLAlkf8IWaU20LUz5Kk6ITru001jm/Oi1V6wBng/2Hdc= X-Received: by 10.107.8.42 with SMTP id 42mr17977004ioi.206.1512684475479; Thu, 07 Dec 2017 14:07:55 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.36.10 with HTTP; Thu, 7 Dec 2017 14:07:54 -0800 (PST) In-Reply-To: References: <20171206223341.iz3vj4zz2igqczy7@ivaldir.net> <201712071605.vB7G58ek062860@pdx.rh.CN85.dnsmgr.net> From: Xin LI Date: Thu, 7 Dec 2017 14:07:54 -0800 Message-ID: Subject: Re: RFC: Sendmail deprecation ? To: Warner Losh Cc: "Rodney W. Grimes" , "freebsd-arch@freebsd.org" , Baptiste Daroussin , gshapiro@freebsd.org Content-Type: text/plain; charset="UTF-8" X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Dec 2017 22:07:56 -0000 Just picking a random message from the thread. On Thu, Dec 7, 2017 at 8:49 AM, Warner Losh wrote: > It's bad that sendmail is such a security nightmare too. We should likely I don't think there is fact that backs this claim (I don't personally have strong opinion on Sendmail removal though). Sendmail might well be a nightmare a decade ago but not anymore. The last security advisory for sendmail was in 2014 for a CVSS 1.9 issue, and before that the last major issue was in 2010. Also count me in the "no dma" campaign too: it worked poorly for the cluster during our dogfood and there were multiple RFC violations the last time we tried it. I might be wrong, but I think it also does not support SSL/TLS properly (e.g. no validation of server certificate, etc.), by the way, and I don't think it have implemented proper queue either. Cheers,