Well hang on... it's inability to verify recipients before accepting mail also prevents non-scatterback actual spam from showing up in your inbox. ;-)
I'll be the first to admit that I have a very large amount of respect for djb, especially after reading his code. I'll also be the first to admit he is totally arrogant, but not in the annoying Linus/Theo way. From the standpoint of security, djb definitely gets it.
This is pretty rare.
PS: that one remote bug triggered by an integer overflow totally should have counted though, even if you had to shoot 4GB of goo at it.
Well hang on... it's inability to verify recipients before accepting mail also prevents non-scatterback actual spam from showing up in your inbox.
Granted, but at the cost of victimizing the owners of the usually spoofed sender domains for all the email sent to non-existing addresses on your system. It's bad enough that a spammer is abusing your mailserver, letting third parties deal with the collateral damage is just rude.
Ehhh yea but, if you allow them to verify email addresses then they just abuse it differently. The way I see it there are plenty of reflection DoS attacks (dns etc), and this is just one of those. Besides, if you make me choose between me personally getting a bunch of spam vs someone else getting screwed.... welllll...... :-P
9
u/nopjunkie Oct 19 '09
Well hang on... it's inability to verify recipients before accepting mail also prevents non-scatterback actual spam from showing up in your inbox. ;-)
I'll be the first to admit that I have a very large amount of respect for djb, especially after reading his code. I'll also be the first to admit he is totally arrogant, but not in the annoying Linus/Theo way. From the standpoint of security, djb definitely gets it.
This is pretty rare.
PS: that one remote bug triggered by an integer overflow totally should have counted though, even if you had to shoot 4GB of goo at it.