OpenDKIM has so many safety issues and no updates in a long time (almost a decade?), that I do not understand why people use it on an internet-facing server.
Some months ago, there was a resurgence of interest from people with commit access to the repo, but as far as I can tell, it’s all still in the develop branch, with occasional mentions that a new release is planned.
For those who use it, what are your reasons? Do you think that I’m too skeptical about a C project that hasn’t been touched in many years and that AI shows has a load of issues?
Not to detract from the project – I did use it myself for a while until I started looking into it a bit more. I do hope that a good, new, maintained release will come, but it hasn’t yet. After a flurry of commits, it’s been quiet again for some 3 months or so. The people who pull(ed) that car are, of course, highly respected and very busy with other things. No blame there! Just wishful thinking :)
OpenDKIM has so many safety issues and no updates in a long time (almost a decade?), that I do not understand why people use it on an internet-facing server.
Some months ago, there was a resurgence of interest from people with commit access to the repo, but as far as I can tell, it’s all still in the
developbranch, with occasional mentions that a new release is planned.For those who use it, what are your reasons? Do you think that I’m too skeptical about a C project that hasn’t been touched in many years and that AI shows has a load of issues?
Not to detract from the project – I did use it myself for a while until I started looking into it a bit more. I do hope that a good, new, maintained release will come, but it hasn’t yet. After a flurry of commits, it’s been quiet again for some 3 months or so. The people who pull(ed) that car are, of course, highly respected and very busy with other things. No blame there! Just wishful thinking :)
score 1 · canonical
Because I only use it on outgoing traffic.
score 1 · canonical
I’m using it via Debian.
https://security-tracker.debian.org/tracker/source-package/opendkim
I generally don’t audit every piece of software I use. I rely on my Linux distribution for that.
Thanks for the heads up! It doesn’t look good. The CVEs were reported 7 days ago.
EDIT: migrated to dkimpy-milter!
score 1 · canonical