I'm reading articles saying procmail is dangerous and unmaintained (https://anarc.at/blog/2022-03-02-procmail-considered-harmful/). I get why a setuid root:mail binary is potentially dangerous, but procmail has been in use for decades and I don't think I've ever heard of it being used for an exploit except for waaaaay back in 2017 and 2014 ( https://www.cvedetails.com/vulnerability-list/vendor_id-225/Procmail.h tml). Anyone got any recommendations? I've used procmail for decades. I'm pretty familiar with it. I *can* migrate to sieve, but procmail Just Works(TM), so I'm hesitant. Is the risk overblown? We're using Postfix and procmail and it seems to be really solid. I am not really looking forward to migrating to sieve, so I'd rather just stick with what I know, you know? What are your thoughts?

On 1/26/24 10:10, Patrick O'Callaghan wrote: > I used procmail for years and never had an issue with it. However I > don't like unmaintained software so removed it when support was > dropped. The problem with Sieve (and several other options) is that > they're server-side, so if your server doesn't support them, and you > don't want to run your own local server (plus e.g. fetchmail) you're > dependent on what your mail provider allows. I run the servers, so I can install whatever I want, but... I chatted with a couple of folks on IRC, including someone who knows the guy who wrote that article. Turns out that procmail really IS still being maintained, both by vendors like Red Hat, Canonical, Suse, etc., and independent developers. There's even talk about forming a new mailing list for those developers. It's definitely being maintained. After digging in a bit, I'm going to stick with procmail since I already know it. If anyone has any opinions to the contrary, I'm happy to be educated, though!

On 1/26/24 09:07, Jon Ingason via users wrote: > Did following: > > $ dnf search procmail > Fedora 39 - x86_64                              9.3 MB/s |  89 MB > > .... > ========================= Namn Exakt matchad: procmail > procmail.x86_64 : Mail processing program > =================== Namn & Sammanfattning Matchad: procmail > perl-Mail-Procmail.noarch : Procmail-like facility for creating easy mail >                            : filters > > So procmail indeed is still maintained. That just means it's still being packaged by someone for Fedora.  That doesn't provide any information about whether the program's source code is being maintained upstream.

> I'm reading articles saying procmail is dangerous and unmaintained > (https://anarc.at/blog/2022-03-02-procmail-considered-harmful/).

Quote from the page above - seems to be old and, to put it mildly, wrong: "procmail is unmaintained. The "Final release", according to Wikipedia, dates back to September 10, 2001 (3.22)" Status today according to https://en.wikipedia.org/wiki/Procmail Excerpt: "The software remained unmaintained for several years, and was believed to be defunct.[3] In 2020 May, Stephen van den Berg resumed maintenance again.[4] The program has since seen multiple releases and bug-fixes."