The Unix Heritage Society mailing list
 help / color / mirror / Atom feed
* [TUHS] Re: Cool talk on Unix and Sendmail history, by Eric Allman
@ 2023-07-30 18:22 Norman Wilson
  2023-07-30 21:43 ` Rob Pike
  0 siblings, 1 reply; 92+ messages in thread
From: Norman Wilson @ 2023-07-30 18:22 UTC (permalink / raw)
  To: tuhs

Doug McIlroy:

  This reminds me of how I agonized over Mike Lesk's refusal to remove
  remote execution from uucp.

====

Uux, the remote-execution mechanism I remember from uucp, had
rather better utility than the famous Sendmail back-door: it
was how uucp carried mail, by sending a file to be handed to
mailer on the remote system.  It was clearly dangerous if
the remote site accepted any command, but as shipped in V7
only a short list of remote commands was allowed: mail rmail
lpr opr fsend fget.  (As uucp was used to carry other things
like netnews, the list was later extended by individual sites,
and eventually moved to a file so reconfiguration needn't
recapitulate compilation).

Not the safest of mechanisms, but at least in V7 it had a use
other than Mike fixing your system for you.

Is there some additional history here?  e.g. was the list of
permitted commands added after arguments about safety, or
some magic command that let Mike in removed?  Or was there a
different remote-execution back door I don't remember and don't
see in a quick look at uuxqt.c?

Norman Wilson
Toronto ON

^ permalink raw reply	[flat|nested] 92+ messages in thread
* [TUHS] Re: Cool talk on Unix and Sendmail history, by Eric Allman
@ 2023-07-30 17:33 Douglas McIlroy
  0 siblings, 0 replies; 92+ messages in thread
From: Douglas McIlroy @ 2023-07-30 17:33 UTC (permalink / raw)
  To: TUHS main list

"Lessons learned" overlooked the Morris worm, which exploited not only
the unpardonable gets interface, but also the unpardonable back door
that Allman built into sendmail.

This reminds me of how I agonized over Mike Lesk's refusal to remove
remote execution from uucp. (Like Eric, Mike created the feature to
help fix the myriad trouble reports these communication facilities
stimulated.) It seemed irresponsible to distribute v7 with the feature
present, yet the rest of uucp provided an almost indispensable
service. The fig leaf for allowing uucp in the distribution was that
remote execution was described in the manual. If you didn't like it
you could delete or fix uucp. (Sendmail's Trojan horse was
undocumented, though visible in the code.)

Doug

^ permalink raw reply	[flat|nested] 92+ messages in thread
* [TUHS] Cool talk on Unix and Sendmail history, by Eric Allman
@ 2023-07-21 18:53 Rich Morin
  2023-07-21 22:14 ` [TUHS] " Grant Taylor via TUHS
  2023-07-22 14:54 ` Rich Salz
  0 siblings, 2 replies; 92+ messages in thread
From: Rich Morin @ 2023-07-21 18:53 UTC (permalink / raw)
  To: The Eunuchs Hysterical Society

Lessons Learned from Sendmail
https://www.youtube.com/watch?v=Re1MAO6jOLE

-r


^ permalink raw reply	[flat|nested] 92+ messages in thread

end of thread, other threads:[~2023-08-05  5:41 UTC | newest]

Thread overview: 92+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-30 18:22 [TUHS] Re: Cool talk on Unix and Sendmail history, by Eric Allman Norman Wilson
2023-07-30 21:43 ` Rob Pike
2023-07-30 23:34   ` George Michaelson
2023-07-30 23:59     ` Erik E. Fair
2023-07-31  0:26       ` Warner Losh
2023-07-31 22:57         ` Grant Taylor via TUHS
2023-07-31 23:05           ` Warner Losh
2023-08-01  2:45             ` Grant Taylor via TUHS
2023-08-01  1:51         ` Niklas Karlsson
2023-08-01  2:47           ` Grant Taylor via TUHS
2023-08-01  3:20           ` Theodore Ts'o
2023-07-31  0:41       ` segaloco via TUHS
2023-08-01  9:22       ` Marc Donner
2023-08-01 10:58         ` Erik E. Fair
2023-08-02  0:37           ` Dave Horsfall
2023-08-02 14:52             ` Ron Natalie
2023-08-02 21:14               ` Grant Taylor via TUHS
2023-08-02 22:20                 ` segaloco via TUHS
2023-08-02 22:37                   ` Warner Losh
2023-08-02 23:49                   ` Rich Salz
2023-08-03  0:51                     ` [TUHS] Re: python Larry McVoy
2023-08-03  1:20                       ` George Michaelson
2023-08-03  2:53                         ` Bakul Shah
2023-08-03  2:55                         ` segaloco via TUHS
2023-08-03  3:24                         ` George Michaelson
2023-08-03  3:32                           ` Warner Losh
2023-08-03  3:55                           ` Bakul Shah
2023-08-03  8:32                             ` Rob Pike
2023-08-03 14:19                               ` Bakul Shah
2023-08-03 14:56                                 ` Dan Halbert
2023-08-03 15:20                                   ` will.senn
2023-08-03 22:05                                     ` Dan Cross
2023-08-04  0:24                                       ` John Cowan
2023-08-04 15:17                                         ` Dan Cross
2023-08-05  4:44                                       ` Bakul Shah
2023-08-03 15:41                                 ` John Cowan
2023-08-03  2:07                       ` Clem Cole
2023-08-03  2:21                         ` Pete Wright via TUHS
2023-08-03  2:56                           ` Warner Losh
2023-08-03 12:36                         ` Mike Markowski
2023-08-03 13:29                           ` Rob Pike
2023-08-03 15:24                             ` emanuel stiebler
2023-08-03 15:39                               ` Steffen Nurpmeso
2023-08-04  1:01                             ` Larry McVoy
2023-08-04  1:28                               ` segaloco via TUHS
2023-08-04  1:58                                 ` Adam Thornton
2023-08-04 15:04                                   ` Dan Cross
2023-08-04 15:10                                     ` Larry McVoy
2023-08-03 16:57                         ` [TUHS] Re: [TULSA] " Phil Budne
2023-08-03 17:00                           ` Rich Salz
2023-08-03 20:35                             ` [TUHS] Split addressing (I/D) space (inspired by the death of the python... thread) Will Senn
2023-08-03 21:05                               ` [TUHS] " Kenneth Goodwin
2023-08-03 21:10                                 ` Ronald Natalie
2023-08-03 21:16                                   ` Warner Losh
2023-08-03 21:24                                     ` Ronald Natalie
2023-08-03 22:34                                   ` Kenneth Goodwin
2023-08-03 21:05                               ` Ronald Natalie
2023-08-03 21:44                               ` Clem Cole
2023-08-03 22:08                                 ` Will Senn
2023-08-03 22:54                                   ` Clem Cole
2023-08-03 23:08                                     ` Dave Horsfall
2023-08-03 23:15                                     ` Clem Cole
2023-08-04  0:38                                     ` John Cowan
2023-08-03 17:29                           ` [TUHS] Re: [TULSA] Re: python Alejandro Colomar
2023-08-03 17:51                             ` John Cowan
2023-08-03 18:05                               ` Alejandro Colomar
2023-08-03 21:29                                 ` Dan Cross
2023-08-03 23:55                                   ` [TUHS] printf (was: python) Alejandro Colomar
2023-08-04 16:06                                     ` [TUHS] " Dan Cross
2023-08-04 16:57                                       ` Alejandro Colomar
2023-08-04 21:16                                         ` Dan Cross
2023-08-03 21:02                           ` [TUHS] Re: [TULSA] Re: python Steffen Nurpmeso
2023-08-03 23:47                           ` Larry McVoy
2023-08-03 23:54                             ` Will Senn
2023-08-04 19:20                         ` [TUHS] " Ed Bradford
2023-08-04 19:47                           ` Larry McVoy
2023-08-05  5:40                             ` Ed Bradford
2023-08-02 23:33               ` [TUHS] Re: Cool talk on Unix and Sendmail history, by Eric Allman Dave Horsfall
  -- strict thread matches above, loose matches on Subject: below --
2023-07-30 17:33 Douglas McIlroy
2023-07-21 18:53 [TUHS] " Rich Morin
2023-07-21 22:14 ` [TUHS] " Grant Taylor via TUHS
2023-07-21 22:30   ` Larry McVoy
2023-07-21 22:33     ` Grant Taylor via TUHS
2023-07-21 22:39       ` Larry McVoy
2023-07-21 23:39     ` Steve Nickolas
2023-07-22  4:37       ` John Cowan
2023-07-22  1:48     ` segaloco via TUHS
2023-07-22  1:55     ` Jon Forrest
2023-07-22  6:45     ` Lars Brinkhoff
2023-07-22 14:54 ` Rich Salz
2023-07-22 15:24   ` Warner Losh
2023-07-22 16:12     ` Arrigo Triulzi via TUHS
2023-07-22 20:52   ` Dave Horsfall

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).