What if you invent a file format that has comments but isn't human readable?
Like the old sendmail.cf files.
The evidence suggests that the reverse happens and everyone else spends well over a decade in the penalty box. (-:
The fun ones are where the comments are mere side effects of throwing away all lines that don't parse properly.
Like how invalid : labels became a way to do comments in scripts for Microsoft's COMMAND/CMD.
@ytc1 @DenOfEarth @aka_pugs I know.
And espechally in #ScientificComputing a lot of researchers loved working with #SunMicrosystems and when #Oracle took over that relationship got sour'd instantly due to #Oracle #CEO #LarryEllison...
-> https://infosec.space/@kkarhan/114682503920794745
One of the big successes of #Sun was that they basically declared a unilateral "ceasefire" in terms of #IP & #Patents re: #OpenSource. Whereas Oracle didn't seem willing to honour that.
Obviously #Linux with it's #GPLv2only-Kernel and most of it's Userland could not get 'closed-sourced' like #OpenSolaris which instantly got stomped out by Oracle as they wanted to sqeeze #Solaris for profits and milk their clients in typical Oracle fashion...
Now granted, I do know someone who for most of their life made their money dealing with the intricacies of setting up #postfix, #sendmail and #courier #MailServers on Solaris and if I ask said person about that they give me a kilometer stare, so OFC like a #SysV - #Unix systems Solaris and #SunOS really are one of the reasons #WindowsNT won the "#WorkstationWar" and why - if anyone - #Apple won the last "#UnixWar"...
@rl_dane @ShinjiLE if you or someone else wants to help argue, the thread is at https://community.letsencrypt.org/t/do-not-remove-tls-client-auth-eku/237427 (Discourse, so JS webbrowser), I’m exhausted.
My self-hosted API #CuckooPost for sending mails without storing SMTP credentials in my projects has got an update.
Thank you @risottobias for your input on the project. I implemented some of your ideas, and now there is a mail log and recipient whitelist in the admin panel.
Find out more about CuckooPost on GitHub, or try it and host it yourself.
I had to solve a problem where a PowerShell script would be distributed to clients that had to send mails. Putting email credentials in the script was not an option, so I put together a web-accessible API that allows me to send mail from a script without putting credentials at risk or relying on third-party mail libraries.
Sharing is caring, so here it is for you to self-host.
#php #api #sendmail #scripting #selfhosted #opensource #oss
https://github.com/soulflyman/CuckooPost
Eric Allman: A Comprehensive Biography
Eric Paul Allman was born on September 2, 1955, in El Cerrito, California, USA. From an early age, he exhibited a keen interest in technology and engineering. This fascination eventually led him to the University of California, Berkeley, where he pursued a degree in computer science.
Read More: https://machaddr.substack.com/p/eric-allman-a-comprehensive-biography
It's weird that you have to employ dirty stunts to make #Postfix log a message's subject...
To do it, you need to enable "header_checks" with an INFO action for the "Subject:" header.
Why, oh why, can it *not* be as simple as with #Exim, where you can enable dozens of additional fields to be logged?!
It feels like Postfix is a tool from the past... Not as old as #Sendmail maybe, which I also had the "pleasure" to work with many, many years ago, but still...
Regarding the #xz backdoor Jonathan Corbet from https://lwn.net/ thinks that #autoconf is part of the problem: "Why are we still using ancient build systems that almost nobody understands?"
So do I. I have not been using #sendmail for decades which used to have the same #m4 bullshit.
hello! love this calendar. i'm installing gancio for our Owncast community, and having a little trouble with docker + sendmail.
where is the best place to ask for help?
throwing it to the general #gancio #docker #sendmail communities too...
i've added the gancio docker container's IP address in postfix/main.cf ... but still get "Error: spawn sendmail ENOENT"
(also, sendmail is now working fine outside the container)
cr;lf: SMTP smuggling / email spoofing involving different MTAs possible
Details at #37c3 later today
https://events.ccc.de/congress/2023/hub/en/event/smtp_smuggling_spoofing_e-mails_worldwide/
SEC consult blog post here:
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
#Postfix comments and releases new versions
https://www.postfix.org/smtp-smuggling.html
https://www.postfix.org/announcements/postfix-3.5.23.html
https://www.postfix.org/announcements/postfix-3.6.13.html
https://www.postfix.org/announcements/postfix-3.7.9.html
https://www.postfix.org/announcements/postfix-3.8.4.html
#Sendmail has a Snapshot 8.18.0.2 with a new configuration option available for testing
https://groups.google.com/g/comp.mail.sendmail/c/zwJW9907Zgo
#Exim does some work behind the scenes:
https://lists.exim.org/lurker/thread/20231223.193645.5f50f60a.de.html
https://github.com/Exim/exim/commit/cf1376206284f2a4f11e32d931d4aade34c206c5
https://github.com/Exim/exim/commit/5bb786d5ad568a88d50d15452aacc8404047e5ca
oss-sec thread here:
https://seclists.org/oss-sec/2023/q4/306
I wanted to ditch #gmail / #hotmail long time ago.
Now seems to be a good time to do so.
Aw, I did my homework on #ProtonMail and found some rumors, so, I don’t wanna take my chances.
And since #tutanota is a proprietary, I don’t wanna bet on it.
I ended up with the idea of hosting my own #email server.
Has anyone done it before? How was it? Any advice? What to keep in mind? What was the server hardware specs?
Has anyone looked at whether the #DragonflyMTA (aka, DMA) is vulnerable to SMTP smuggling attacks?
With commit a67b925ff3e58b072a60b633e442ee1d33e47f7f back in November 2022, #FreeBSD switched from #sendmail to DMA as the default MTA.
Minor tweaks to mail (I run a mail server) during my week off last week. Sadly, I receive less spam/scam email on my nmrc.org mail than on the couple of gmail accounts I have. I mean, good for me, sad for those that use gmail.
Greylisting, blackholes, SPF, DKIM, DMARC, and even pi-hole/unbound in recursive mode (as the mail server's DNS server) are the secret.
Wenn du glaubst, du hättest mit #sendmail.cf und Rechenoperationen in #rrdtool alles an Kryptik gesehen, bist du beim Stromzähler-Parser von #Tasmota genau richtig. 
https://tasmota.github.io/docs/Smart-Meter-Interface/#special-commands
Greetings, time for my #introduction!
I’m a security and infrastructure technologist who lives in the Northern California Bay Area and works at #Proofpoint. Outside of work, I assist in maintaining open source #sendmail and am a #FreeBSD committer. For my fellow geeks, my favorite protocols are #DNS, #SMTP, and #XMPP.
When I'm not buried in my laptop, I like to travel and hang out with my partner and our two dogs.
