News for hackers. Stuff that matters.
Re:Comcast Shot Themselves in the Foot with MTA-STS by zokier on Wednesday January 19, 2022 @06:03PM (#30001732)
if the server does not have tls then mta-sts does not help much either?

edit: I actually read the spec, and apparently the listing of allowed servers is a side aspect of the spec, the main meat is opting in to tls overall; that was not immediately obvious from the article. In that context your question makes more sense. To answer more comprehensively, I don't see why similar mechanism that functions well with HTTP would not work here; that the server would send STS policy to the client after connection which the client then caches and consults on subsequent connections. This is how HSTS works.

Re:Comcast Shot Themselves in the Foot with MTA-STS by tedunangst on Wednesday January 19, 2022 @06:58PM (#30002280)
I agree they could have added HAVESTS to the EHLO reply.