revjim.net

Before "the merger", the company I worked for, and the company we merged with transmitted documents back and forth to one another over 1200 baud modems. Now that the companies have merged, they are looking at better ways to do things, which I think is a great idea. For this process in particular, the suggestion has been made to deliver the documents via email, which I do not object to. However, during the planning phases, I mentioned that we should check to ensure that mail being sent from their network to our network will NOT cross onto the public Internet and that, if it does, we will need to use encryption to protect sensitive customer data. One of my employees is heading up our side of the project.

I received an email today from their developer today. It including screenshots of his traceroute program. According to him, since tracing a route from his email server, to our web server did not produce any hops that went outside of our network, then we are okay. Ha!

It amazes me that people with little to no knowledge of the technologies at hand are left in charge of implementing such a huge, and potentially dangerous system. Does he know anything about SMTP at all? Doesn't he realize that mail doesn't follow the same routing rules as TCP/IP? Doesn't he understand that even if it did, tracing a route to our webserver would only prove that SOME packets don't route out of our network, but not that packets to our mailserver (which is not even built at this time) would follow that same path? Doesn't he understand that mail servers and networks can have very different setups, and that they can change routes automatically to ensure the best delivery times and the fastest transmissions?

I sent him a long detailed response and told him, even though I told him once before when I first announced the possible problem, that the only way to be sure would be to statically route the mail by IP address to our host, or to contact the owner of the server at the IP address for the MX record of our ends domain to ensure that those packets do not travel out of the network, and that the administrator of that server takes precautions to ensure that mail routed to it doesn't go outside of our network either.

Ugh.