[ On Mon, April 7, 1997 at 11:57:19 (+0100), Philip Hazel wrote: ]
> Subject: Re: EXPN on wishlist?
>
> EXPN wasn't on the wishlist, but I've made a conditional entry. I need a
> bit more convincing of its usefulness. (And I haven't looked at how easy
> or difficult it would be to implement.)
I use this feature constantly to verify mail addresses and I find it
extremely helpful in my duties as a postmaster for various domains.
What I in fact use is Eric Wassenaar's vrfy program which can utilize
various mechanisms such as VRFY, RCPT TO:, and EXPN to check out the
validity of an address, since it does all the mechanical things to
assist efforts in speaking to a remote mailer's SMTP port.
> It would obviously have to be
> restricted to certain hosts or networks.
I'd put that a different way. No doubt there are people who would claim
that EXPN might give away information that may be considered to be
private or some sort of security risk. Personally I say "Phooey!" to
them. (Public e-mail networks are not a good place to hide either!)
In that light it would be astute to offer the ability to restrict the
accessibility of EXPN based on various criteria, but I'd strongly
discourage folks from relying on such things.
Not to mention but there are better ways to hide the contents of mailing
lists anyway.
In general as I go about looking up addresses I find EXPN gives the most
complete and most accurate information where it is implemented, but I
find more and more sites that do not implement it. No doubt some of
these are like our own weird.com router that's surviving with an old
version of sendmail that's got a nasty security bug in EXPN and thus
must have it disabled. (One of the most helpful features of some
implementations of EXPN is that it provides the full name of the user
associated with a mailbox where possible. Unfortunately smail-3 doesn't
offer this feature.)
--
Greg A. Woods
+1 416 443-1734 VE3TCP robohack!woods
Planix, Inc. <woods@???>; Secrets of the Weird <woods@???>
