[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 2 Feb 2024 07:35:26 -0800
From: Kurt H Maier <khm@...ops.net>
To: oss-security@...ts.openwall.com
Subject: Re: Python standard library defaults to insecure TLS
for mail protocols
On Thu, Feb 01, 2024 at 10:56:34PM +0100, Steffen Nurpmeso wrote:
>
> This protocol is much too complicated, and totally
> over-engineered. How many different approaches to get that job
> actually done do you want? How much more configuration effort
> burden shall be put onto administrators? Even more -- how many
> small business administrators there still exist.
>
> Having DNS announce something is good now that there is DNSSEC
> getting widespread use, and over transported channels of all sorts
> (i only like two of those, but i cannot help it anyway).
I raised these objections on some IETF list or another, and was
rebuffed. According to the MTA-STS project, DNS is too hard or people
are too stupid, so MTA-STS ignores DNSSEC and relies on HTTPS and
well-known urls. I would like it to be on the record, at least, that
someone tried to talk them out of this. I did point out that requring
an entire additional stack of protocols just to look up a port number
was not as clever as just specifying the port number, but that idea was
also rejected.
khm
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
