4 ms·

Can you elaborate on this? I have never thought of "atrocious" when someone mentioned the history of vulnerabilities in djb's software. Depending on how egregio

by dfc 10y ago

Can you elaborate on this? I have never thought of "atrocious" when someone mentioned the history of vulnerabilities in djb's software. Depending on how egregious these security practices are there could be a $500 check in it for you.

dozzie 10y ago
> I have never thought of "atrocious" when someone mentioned the history of vulnerabilities in djb's software. You mean when DJB denied Qmail has bugs? http://www.dt.e-technik.tu-dortmund.de/~ma/qmail-bugs.html http://www.dt.e-technik.tu-dortmund.de/~ma/qmail-bugs.html Unfortunately, 404 at the moment, but Internet Archive has a copy: https://web.archive.org/web/20160409054053/http://www.dt.e-technik.tu-dortmund.de/~ma/qmail-bugs.html https://web.archive.org/web/20160409054053/http://www.dt.e-t...
- dfc 10y ago
  Yes, "atrocious security" is not my reaction to a 15 year old MTA with two DoS and two RCEs.
  - dozzie 10y ago
    Oh yes, because denying that your code has a vulnerability counts as a good security practice. You know why this MTA has that low count of published bugs? Because nobody uses it anymore, so nobody looks at its code (and now factor in the ugliness of the code itself, which lowers the eagerness to look at the code even more). It's not because the code is (magically?) better.