Hacker News new | past | comments | ask | show | jobs | submit login

Indeed it appears to be a long running broader bug [1] of 7 years. Perhaps someone could increase log and header verbosity or enable some form of debugging to see what behavior WhatsApp is invoking. It appears this [2] is how to enable debugging in OpenSMTPD. Once enabled one could trigger an email through WhatsApp to see specifically what it doing. I am nosy and curious enough that I hope someone posts the debug output here after sensitive stuff is redacted. I do not have a WhatsApp account.

[1] - https://unix.stackexchange.com/questions/392729/opensmtpd-pi...

[2] - https://wiki.archlinux.org/title/OpenSMTPD#Subsystem_tracing






I'll see your 7 and raise you 10.

* https://github.com/OpenSMTPD/OpenSMTPD/issues/451


And more evidence to add to the server-does-negotiated-SSL-but-client-is-doing-implicit-SSL pile is this:

* https://marc.info/?l=opensmtpd-misc&m=141543622103232&w=2

Coincidentally, I was just talking about the mess that SMTP got into with all this.

* https://news.ycombinator.com/item?id=44285357


Excellent. That shows debugging will not be enough and one should at least enable tracing [1] probably on both the ZuckMail and OpenSMTPD side. FB's security team should be able to replicate this on the Zuck side if someone has a current contact. I know that a few of them lurk here. I think it's the least they can do after trying to abuse my liver and luring away an amazing coworker with the beautiful blue-haired girl.

[1] - https://wiki.archlinux.org/title/OpenSMTPD#Subsystem_tracing


There’s no evidence it’s a bug in opensmtpd, rather it’s that other SMTP clients such as WhatsApp’s mail servers are assuming support for the (non-mandatory) PIPELINING extension instead of respecting the EHLO-advertised (lack of) support.

There’s no evidence

That is exactly why I would enable debugging or tracing and see who is sending what and whom is responding or waiting on something expected with timestamps so that nobody is guessing. The tracing should occur on both the sending and receiving side.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: