Re: [9front] patch smtp: ignore unrecognized certificates

[Steffen Nurpmeso <sdaoden@yandex.com>]

cinap_lenrek@felloff.net wrote in
<BC75BC74DEF132FCD6A0F1C7E3D9FCEC@felloff.net>:
 |
 |for servers like your isp's or your networks forwarding mailserver
 |(machines that you have direct relation or control over), it makes
 |sense to pin certificates or public key. this is where you use
 |smtps, instead of this insecure STARTTLS contraption.

In November 2019 they waved through RFC 8689:

                        SMTP Require TLS Option

  Abstract

   The SMTP STARTTLS option, used in negotiating transport-level
   encryption of SMTP connections, is not as useful from a security
   standpoint as it might be because of its opportunistic nature;
   message delivery is, by default, prioritized over security.  This
   document describes an SMTP service extension, REQUIRETLS, and a
   message header field, TLS-Required.  If the REQUIRETLS option or TLS-
   Required message header field is used when sending a message, it
   asserts a request on the part of the message sender to override the
   default negotiation of TLS, either by requiring that TLS be
   negotiated when the message is relayed or by requesting that
   recipient-side policy mechanisms such as MTA-STS and DNS-Based
   Authentication of Named Entities (DANE) be ignored when relaying a
   message for which security is unimportant.

P.S.: several times i tried to contact Stanley Lieber in the past,
but never got a response.  If this mail gets through (quite some
did not in the past), would you mind changing my address to
steffen@@sdaoden.eu, please?  Thank you!!

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)