On Mon, 7 Apr 1997, Greg A. Woods wrote:
> I'd put that a different way. No doubt there are people who would claim
> that EXPN might give away information that may be considered to be
> private or some sort of security risk. Personally I say "Phooey!" to
> them. (Public e-mail networks are not a good place to hide either!)
I would certainly claim that EXPN on a mailing list server would be a
wonderful way for spammers to harvest addresses for their lists.
> (One of the most helpful features of some
> implementations of EXPN is that it provides the full name of the user
> associated with a mailbox where possible. Unfortunately smail-3 doesn't
> offer this feature.)
Neither would Exim, if I were to implement EXPN.
Looks to me as if your arguments for EXPN are all for its use as a poor
man's email directory. I'd far rather people put up proper directories
on the Web, where the information you want to give out (names,
addresses, office numbers, whatever) can be divorced from the mechanics
of delivering mail.
I also suspect more and more sites are using firewalls and other
indirections, which make EXPN less useful, even if you ignore the
security aspects. For example, one of my email addresses is
ph10@???. If EXPN were implemented on the servers for the cam
domain, all it would tell you is that ph10@??? maps to
ph10@???. My real name isn't even available on that system. As
it happens, you can talk directly to cus.cam.ac.uk, but in firewall
situations that may not be so.
The existence of Exim filter files makes EXPN for individual users
hard to implement, other than to say "is deliverable", which is what
VRFY gives you.
--
Philip Hazel University Computing Service,
ph10@??? New Museums Site, Cambridge CB2 3QG,
P.Hazel@??? England. Phone: +44 1223 334714
