Ubuntu is under attack

[Derek Broughton]

Anders Karlsson wrote:

> On 12/21/05, Adam Fabian <awfabian at gmail.com> wrote:
> 
>> Nothing wrong with simplifying and streamlining, and creating
>> something that's easy-to-use, but an MTA should be listening on the
>> localhost for the day when the user discovers, unfortunately, that
>> some program has decided to use it as a (valid) channel of
>> communication with the user.

That's why we have package management.  Any program that will "decide to
use" an MTA as a channel of communication must define an MTA (preferably
generic) as a dependency.  My principle objection at this point is that
there are packages that _will_ do that (like cron) but do not make the MTA
mandatory.

> In the default install of Ubuntu (the desktop variant) the way your
> average non-expert user would go about it, the only message you would
> get from cron is about a dangling symlink. 

I don't know how you can be sure of that.  Is logrotate not there by
default?  What does it do when run by cron, and there's no space for logs?
(admittedly, in such a case, there's likely no room for mail spool either).  

> To be frank, the package 
> that contains the dangling symlink should probably be fixed, and then
> you would get nothing.

Of course it should.  And when apps stop trying to send mail, remove the
MTA.
> 
> Perhaps Ubuntu should look into commissioning a small perl script that
> handles local delivery to the user set up in the install process? That
> would require no configuration during the install, and if
> /usr/bin/sendmail points to /etc/alternatives/sendmail which points to
> the script, when a full MTA is installed, it can change the
> /etc/alternatives symlink.

Except Matthew's saying that we can't trust the Ubuntu user to be able to
read "local" mail.  And if you do have something that does local delivery
to any particular user, wouldn't it be just as easy to install one of the
small MTAs configured for local delivery only?

> It neatly shuts up the people complaining about missing out on a
> single useless warning about dangling symlink

Nobody is complaining about that.  That is a _symptom_ of another problem. 
The problem is that we have an existing notification system and programs
take advantage of it without forcing a dependency on an MTA.
-- 
derek