I laughed at the description of `sendmail` as “... less a mail transfer agent and more a recurring CVE subscription.”

[angusm@mastodon.social]

I laughed at the description of `sendmail` as “... less a mail transfer agent and more a recurring CVE subscription.”

https://blog.calif.io/p/we-asked-claude-to-audit-sagredos

#qmail #security #risks #mail

[david_chisnall@infosec.exchange]

@angusm

Is that code really using popen invoking touch to do the equivalent of open?

[angusm@mastodon.social]

@david_chisnall Feels like the kind of vulnerability that you shouldn’t need 101 minutes of “AI” time to detect.

[david_chisnall@infosec.exchange]

@angusm

I don't know, you'd probably have to pay a human a lot to be willing to look at code like that...