Re: Suggestion: add security/cy2-plain as a dependency of mail/postfix sasl option

[Joerg Sonnenberger <joerg%bec.de@localhost>]

On Mon, Dec 20, 2021 at 02:47:03PM -0500, Greg Troxel wrote:
> Generally, we try to have dependencies be minimal, as everyone ends up
> with all listed dependencies.  In this case, the mechanisms are
> plugins, which is a scheme to keep that part of the code from having to
> be a dependency or option, and simply work when installed.

There are also real security concerns here. For example, if you expect
CRAM or other modern exchanges to be used that don't involve transfering
the password to the remote side, falling back to PLAIN would be a major
issue.

Joerg