getmail

Posted Feb 22, 2007 0:09 UTC (Thu) by DonDiego (guest, #24141)
In reply to: getmail by rfunk
Parent article: ESR's goodbye note

I'm too lazy to look up the details but fetchmail made regular appearances in the LWN security section back when I still used it. Whether current versions are any better I don't care at all - I've found a better replacement.

getmail

Posted Feb 22, 2007 10:30 UTC (Thu) by DonDiego (guest, #24141) [Link] (4 responses)

Read this week's security page, fetchmail makes a double appearance ...

fetchmail security

Posted Feb 22, 2007 12:58 UTC (Thu) by rfunk (subscriber, #4054) [Link] (3 responses)

Yes, on exactly the issues I mentioned.

Let me know when you figure out the difference between "New
Vulnerabilities" and "Updated Vulnerabilities".

fetchmail security

Posted Feb 22, 2007 15:03 UTC (Thu) by ofeeley (guest, #36105) [Link] (1 responses)

Besides which, programs with unreported vulnerabilities are probably just programs not receiving scrutiny and patching from a good maintainer ;)

fetchmail security

Posted Feb 23, 2007 6:03 UTC (Fri) by DonDiego (guest, #24141) [Link]

No. Although the examples are admittedly few there are securely designed and implemented programs that don't reveal vulnerabilities even under close scrutiny. vsftpd comes to mind.

fetchmail security

Posted Feb 23, 2007 6:16 UTC (Fri) by DonDiego (guest, #24141) [Link]

I'm apparently not making myself clear here .. I don't give a damn about new versions ever since I found a replacement that I consider superior in every respect (and no, I don't care about supporting obscure broken servers). I had grown discontent with the size of fetchmail and its man page for some time already. What then finally made me look for a replacement was fetchmail showing up on the security page every other week...

You may or may not have made fetchmail secure (BTW, ever tried fuzzing it?). If you did, congratulations. I'm quite confident you didn't reduce its size considerably, though.