"Lessons learned" overlooked the Morris worm, which exploited not only the unpardonable gets interface, but also the unpardonable back door that Allman built into sendmail. This reminds me of how I agonized over Mike Lesk's refusal to remove remote execution from uucp. (Like Eric, Mike created the feature to help fix the myriad trouble reports these communication facilities stimulated.) It seemed irresponsible to distribute v7 with the feature present, yet the rest of uucp provided an almost indispensable service. The fig leaf for allowing uucp in the distribution was that remote execution was described in the manual. If you didn't like it you could delete or fix uucp. (Sendmail's Trojan horse was undocumented, though visible in the code.) Doug