Viktor Dukhovni <postfix-us...@dukhovni.org> writes:
> On Wed, Dec 19, 2018 at 01:51:19PM -0500, Scott Kitterman wrote:
>
>> > So the real question is whether there is a non-trivial community
>> > of users who:
>> >
>> > * Have no explit "smtp_tls_security_level" setting in their main.cf
>> > file.
>> >
>> > * Would not mind to see TLS turned on as a side-effect of a future
>> > upgrade, but can't find the activation energy to do it explicitly.
>> >
>> > Or, whether there are Postfix package maintainers in the same boat:
>> > too busy to add code to enable opportunistic TLS in the client at
>> > package install time, but would be happy to see it happen upstream.
>>
>> I'm definitely in favor of it being enabled by default, but, in addition to
>> being busy, I've been trying to work towards less deviation from upstream in
>> Debian vice more. There is already plenty that is well baked into our
>> ecosystem that would be hard to cleanly remove without causing upgrade
>> problems.
>>
>> Bottom line, I'd love to see it upstream and am unlikely to do it myself.
>
> If there are no objections, I can change the default to "may" when
> TLS is compiled in.
I think this would be a good idea. It seems harmless to have it enabled
by default, with no negative effects and improves the overall
opportunistic landscape if it were enabled. Because STARTTLS was
designed to be enabled opportunistically, it is designed to fall back to
cleartext when it doesn't exist, so I do not see any problem with it
being the default.
I do not understand why anyone would complain about this. Anyone who
cannot handle this change to the defaults can explicitly set the config
option the way that the rest of the world has been explicitly setting
the config option all along anyway.
--
micah
