On Mon, 23 Oct 2000, Steven M. Bellovin wrote:

> More to the point, the general thrust of the comment -- that any 
> program with that many uses of known-dangerous functions -- is unlikely 
> to be correct applies on any host.

  Further, warning only about a denial of service attack when there is a
known remote exploit is very misleading.  Pine builds should be disabled
until there is some reason to believe that it is safe to use (as the
comment says, not likely anytime soon). The security notice should say
"don't use pine" and refer to http://www.securityfocus.com/bid/1709 as
well as the comment.

  I'll confess that I'm writing this from pine, not having had the chance
to review alternatives yet.  Does anyone know of a mail client that is
close in feel to pine to refer those of us who like pine but don't really
want to give the world a key to our system? 

Matthew Orgass
darkstar@pgh.net