On Wed, Sep 06, 2006 at 06:22:59AM -0400, Sam Varshavchik wrote: > >>These options carry certain security implications that I am not > >>comfortable with. If you know what you're doing, you can easily patch > >>maildrop yourself, but I don't want to accept the onus of something like > >>this on my shoulders, and end up wearing egg on my face. > > > >I'm not saying you should enable -D always, I'm saying you could add -H > >which makes it chdir to the specified directory as $HOME. Maybe also > >setenv(). That and only that. Do you understand the request now? > > I understand exactly what you're saying. If this option becomes available, > people are going to use it. And they will use it without fully > understanding the security implications, and no amount of stern warnings in > the README is going to change that. I have experience to show that.
Well, right now there's people using -d and running into courier-authlib- -related trouble, which doesn't just make their maildrop confused, it makes it error out and fail to deliver. Witness one Marcus Frings' mails at http://bugs.debian.org/314847 If we had an option that just sets home and proceeds to read .mailfilter from there, without invoking courier*, that would be a fairly reasonable upgrade strategy. Right now we have either breakage, or a pile of excess dependencies. Neither of these is particularly desirable from my standpoint. -- 2. That which causes joy or happiness. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
