On Wed, 3 Sep 1997, Nigel Metheringham wrote:
> I would not currently be willing to
> put up a bounty against exim security bugs.
Neither would I. I have put the following into the latest documentation
to state my position:
-----------------------------------------------------------------------------
46. SECURITY CONSIDERATIONS
This chapter discusses a number of issues concerned with security, some of
which are also covered in other parts of this manual.
For reasons that this author does not understand, some people have promoted
Exim as a 'particularly secure' mailer. Perhaps it is because of the
existence of this chapter in the documentation. However, the intent of the
chapter is simply to describe the way Exim works in relation to certain
security concerns, not to make any specific claims about the effectiveness
of its security as compared with other MTAs.
What follows is a description of the way Exim is supposed to be. Best
efforts have been made to try to ensure that the code agrees with the
theory, but a lack of bugs can never be guaranteed. Any that are reported
will get fixed as soon as possible.
-----------------------------------------------------------------------------
If I were starting again, I might do it differently. Actually, I'd
really like to have been able to do it in a programming language that
is more high level and offers more protection than C (e.g. array bound
checking; I liked Algol 68 when I used it, but it never got popular) but
C is, for better or worse, the common programming language of Unix.
> I do mean, as soon as I get round to it, to add a couple of things to exim
> which would mean us dropping the setuid root side of it, but my setup is
> rather unusual (no local users, no user modifiable stuff etc).
Piete Brooks, in a similar situation, already runs most of his Exims
non-setuid root.
--
Philip Hazel University Computing Service,
ph10@??? New Museums Site, Cambridge CB2 3QG,
P.Hazel@??? England. Phone: +44 1223 334714
--
* This is sent by the exim-users mailing list. To unsubscribe send a
mail with subject "unsubscribe" to exim-users-request@???
* Exim information can be found at http://www.exim.org/
