
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
258
|
Chapter 9: Securing Internet Email
Sendmail Pros and Cons
On the plus side, Sendmail has a huge user community; as a result, it’s easy to find
both free and commercial support for it, not to mention a wealth of electronic and
print publications. It’s also stable and predictable, one of the most mature network
applications of all time.
On the downside, Sendmail has acquired a certain amount of “cruft” (layers of old
code) over its long history, resulting in a reputation of it being insecure and bloated.
Both charges are open to debate, however.
While it’s true that Sendmail has had a number of significant vulnerabilities over the
years, these have been brought to light and fixed very rapidly. An argument can
therefore be made that Sendmail security is a glass half-empty/half-full situation.
Depending on your viewpoint, Sendmail’s various vulnerability reports and subse-
quent patches may prove that Sendmail is inherently insecure; or perhaps the fact
that they come to light and are fixed quickly proves that Sendmail’s development
team and user community are pretty much on top of things, or maybe you think the
truth is somewhere in between. (I’m in this last camp.)
A more useful criticism is that Sendmail is monolithic: a vulnerability in one portion
of its functionality results in ...