Eli Zaretskii wrote:
> Both patches, as proposed, are too drastic.  I could agree to the
> second one, provided that the default is changed to build and install
> our movemail -- this will let distributors decide whether to install
> it or not, while keeping backward compatibility.  (The NEWS part of
> your patch should then be changed accordingly.)

OK, I installed the second patch with modifications along the lines that you 
suggested, updated the documentation accordingly, and am closing this bug 
report. The patch that I installed is attached.

As the default Emacs configuration still has a significant security hole, this 
patch changes 'configure' to warn about the problem if present. Although many 
distributors and/or installers will no doubt ignore the warning, at least we can 
later say in our defense that 'configure' warned them.