"Nobody should be running Exim in 2021."
Maybe, yet it still shuffles a lot of email around the place. It deals with a lot of corner cases. When I say corner cases I mean orthogonality that might put off a top class mathematician fresh from fiddling with spherical cows in n dimensions. Email is not simply a bit odd but downright pathologically weird.
We all know what email is and it's just so simple. You can use telnet and point it at a smtpd and send a message. HELO me ... mail from: .... rcpt to: .... data .... . (blah blah message_id:x)
Yet, for some reason an MTA is a massive edifice of oddities. You could make an MTA that simply shuffles a text stream from a to b but what sort of text stream? MIME encoded doesn't mean what you think it does in quite a lot of cases. MIME is nearly formally defined but as always the beauty is in the eye of the programmer.
As well as moving text around a bit, MTAs are asked to do a firewall's role and also integrate with AV and anti spam. Ideally they should also be capable of reading minds.
I could go on.
Exim is probably not the most beautiful example of modern security practice but it is actively developed by people who do give a shit and are trying to keep something that no one will ever allow to go away working, as best they can. RFC822 (etc, int al, ad nauseam) can never be considered a modern communication technique that will ever lend itself to secure programming practices. Email is never going to be "secure" by worrying about what language an MTA is written in and I think you might have forgotten the worst part of the security circus here: The end user.
You can call out the MTA as much as you like but your Go or Rust jobbie will still deliver an email that my Financial Controller clicks on and dumps my bank account.
Nobody should be using email in 2021 (discuss ... 8)
Maybe, yet it still shuffles a lot of email around the place. It deals with a lot of corner cases. When I say corner cases I mean orthogonality that might put off a top class mathematician fresh from fiddling with spherical cows in n dimensions. Email is not simply a bit odd but downright pathologically weird.
We all know what email is and it's just so simple. You can use telnet and point it at a smtpd and send a message. HELO me ... mail from: .... rcpt to: .... data .... . (blah blah message_id:x)
Yet, for some reason an MTA is a massive edifice of oddities. You could make an MTA that simply shuffles a text stream from a to b but what sort of text stream? MIME encoded doesn't mean what you think it does in quite a lot of cases. MIME is nearly formally defined but as always the beauty is in the eye of the programmer.
As well as moving text around a bit, MTAs are asked to do a firewall's role and also integrate with AV and anti spam. Ideally they should also be capable of reading minds.
I could go on.
Exim is probably not the most beautiful example of modern security practice but it is actively developed by people who do give a shit and are trying to keep something that no one will ever allow to go away working, as best they can. RFC822 (etc, int al, ad nauseam) can never be considered a modern communication technique that will ever lend itself to secure programming practices. Email is never going to be "secure" by worrying about what language an MTA is written in and I think you might have forgotten the worst part of the security circus here: The end user.
You can call out the MTA as much as you like but your Go or Rust jobbie will still deliver an email that my Financial Controller clicks on and dumps my bank account.
Nobody should be using email in 2021 (discuss ... 8)