On Fri, Dec 12, 2003 at 03:42:25PM -0500, Sanford Whiteman wrote: > > Hey, However, there is one message they have repeatedly ignored, to > > which I have never had an answer. There is one long outstanding DoS > > issue I have found with the server software, which they refuse to > > admit exists, even when I have decompiled the running software and > > see the algorithm before my very own eyes. > > Forget the reverse-engineering mumbo-jumbo.
I disagree. What I said was not meant to confuse anyone, as I see this group as a technical resource above and beyond Ipswitch's Support department. > If you have proven the DoS > vulnerability using real-world reproducible and deployment-appropriate > results (i.e. you can't imply that any Internet-based attack will > succeed if you are generating a load that could only be passed at LAN > speeds), and are saying that you have attempted to go the private > route and been unsuccessful, *and* you are not simply attempting to > slur a product that you've grown tired of, then by all means make the > whole thing public, rather than using innuendo. All of the above are true, but on my own systems. If this exercise proves that I'm wrong, then I will be most happy - I don't have to tell thousands of customers that their mail service is being changed. > Last I read in the archives, you said "[I]f I try to relay through the > IMail server from an IP that is not allowed to, then SMTPd32.exe takes > a little amount of time to respond. During the wait, it spikes up to > 100% CPU usage." I don't know if this is the core of your current > complaint, but the symptom you describe in that sentence is not one > that I can reproduce. Yes, you're right. You were certainly the most sensible person to contribute to that thread, and I took your advice and setup a duplicate test server. In fact, a few different test servers (Win2k Pro, Win2k AS, Win XP Pro). All of which exhibited the same behaviour, on the same hardware. There were two common factors: the configuration of IMail was the same, and the registry data used was the same. I even tried changing IMail itself, to use IMail v8.xx, but it exhibited the same behaviour. I really do believe the problem is related to a sequential scan of the IMail registry keys (particularly 'Domain', with 1 lookup (syscall) for the RCPT TO: domain + 3 lookups (syscalls) for each vhost alias), and it puzzles me that you cannot reproduce the issue. > > IMHO IMail is not a bad piece of software for the right ppl, but it > > is very resource hungry > > Fair comparison, please, including OS? > > > , expensive, > > Fair comparison, please, including OS? ... and even less professional discussing the details of potential alternatives to a product on the company's own mailing list, however fair? It is the w/e, and I'm going out for some fun with my spare time... I'll see if I can cobble something together for you and post it privately next week. By fair, I understand you to mean feature-for-feature? > > and there are better alternatives if you have the skills. > > And what skills would those be? IMHO, an objective, inquisitive mindset. Having enough patience and determination to assess all of the available information about a technology and make up one's (you(r) can be mis-interpreted) own mind about what is best for one's organisation. Sorry, I'll stop taking the piss now ;-) Those are IMHO, most important skills for many different disciplines. I also think that if you can use your crystalised (or innate :-P) knowledge of RFCs and experience with mail servers and OSs in an analytical manner, then it's not very difficult to come up with an alternative to IMail. > > If Ipswitch had any sense, they'd realise that they're on to a > > marketing winner and evaluate the differences between their software > > and the more advanced, difficult to use, but free, alternatives. > > I feel it's unprofessional to post negative rhetoric without backing > information; if you're saying you've done your own competitive > research and have no need to publish it, there's no reason to assume > that Ipswitch has not done the same. Yes, I agree here. The information I posted was not backed up with evidence, as my hands are somewhat tied. However, I cannot see what I posted as rhetoric of any kind. Unsubstantiated allegations, perhaps, for now. This may or may not seem ironic coming from someone who failed English, but I would perhaps look closer to home for the rhetorical remarks; against someone who is actually trying to help raise awareness of a potential problem. I apologise in advance for the rhetoric in _this_ e-mail, but as someone who actively uses many different platforms, I have to laugh at how religiously some ppl follow and defend their chosen mail software. It strikes me as very pretentious. Oops, now I'm the one being provocative. I'll leave it at that. Hasta luego, -- Jon Miles <[EMAIL PROTECTED]> Cybah on IRC(net) To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
