Re: Exmh releases, and a large bunch of small changes in the exmh tree...

On 26 July 2004 at 14:53, [email protected] wrote:

> 2b) the original mybogo.tcl talked about adding key bindings -
> anybody think that's a good/bad idea?  Easy enough to do, but
> consensus would be nice.

Spam related key bindings for things like "add sender to whitelist" 
would be wonderful.

> 3) I did a mass cleanup of a lot of places where we were doing
> things like 'exec chown' or 'exec rm', and changed them to
> equivalent native Tcl 'file' calls.  This was for 2 reasons:
> (a) just clean up and efficiency, and (b) (leading in to the
> next point...)

Great!

> 4) I did a fairly extensive security audit, and found some
> *nasty* bugs ...
>
> The security hole is pretty big - it can be triggered by a
> remote attacker with a specially crafted piece of malformed
> MIME.
>
> Given that the hole was a metamail-related one, maybe that's
> even more reason to find an alternate base64 {en,de}coder and
> heave all the Metamail code over the side.
>
> I think the hole is big enough to merit a 2.7.1 release at
> least - what do others think?

Yes, security problems are the best (sadly) reason to roll a
2.7.1 version.  I'd like to see the easy to implement security
fixes happen as fast as reasonable and release before the harder
to implement fixes, just to give us a bit more safety while
waiting for the remaining updates.

There are my thoughts.

Thanks Valdis!