ralph wrote: > Hi Paul, > > > > - The generation and verification of Content-MD5 headers is no > > > longer performed. The -check and -nocheck switches to various nmh > > > programs that would control this functionality still exist, but > > > are non-functional and will be removed in the next release. > > > > > > That it not deprecation. The user who thinks the MD5 is being > > > checked is being fooled by them silently becoming a no-op. They > > > should be removed so the user instead suffers an error and learns > > > of the change. I'll try to get this done. > > > > Removing the options entirely doesn't seem like deprecation either. > > No, it's not. But it's better than the introduced security flaw. > > > Seems like they should maybe emit warnings for a release > > Yes, i.e. be deprecated. But that ship has sailed and I don't think Ken > would be pleased if I added them back in so they could be deprecated. >
Agreed. I can't think of a compelling argument against simply removing the options -- as long as the removal is well-noted in the release notes and man pages -- since the fix is simply removing the options from one's scripts. (Right?) (At the risk of overkill, could the removal also be noted in the "This is a new release of MH" message" that happens after an upgrade? It's been so long since I've seen it :-), I can't really remember how/when that works.) paul =---------------------- paul fox, p...@foxharp.boston.ma.us (arlington, ma, where it's 22.1 degrees)
