2 ms·

I think that qmail's design is based off of being super modular. So much that most people don't actually run the qmail-smtpd because it had some security issue

I think that qmail's design is based off of being super modular. So much that most people don't actually run the qmail-smtpd because it had some security issues (It's been a while but this was around the time they started work on the OpenSMTPd). I assume 5 years later it's much improved but at the time forking the code of an SMTPd that had security vulnerabilities didn't seem like a worthwile investment and everything else has a OpenBSD prohibitive license. Edit: It was all pretty thoroughly discussed on various mailing lists and whatnot if you're curious

nickpsecurity 11y ago
Qmail's security advantage came from a number of design decisions detailed here and easy to copy in even clean-slate programs: http://cr.yp.to/qmail/qmailsec-20071101.pdf http://cr.yp.to/qmail/qmailsec-20071101.pdf Far as their decision, that makes sense. I still think they should've leveraged proven design principles or tactics in the other software. I've just seen enough of these situations where I believe what you say about how their evaluation and decision process went. I figured licensing would factor into it, too.