3 ms·
> I have never thought of "atrocious" when someone mentioned the history of vulnerabilities in djb's software. You mean when DJB denied Qmail has bugs? http:/
by dozzie 11y ago
> I have never thought of "atrocious" when someone mentioned the history of vulnerabilities in djb's software.
You mean when DJB denied Qmail has bugs?
http://www.dt.e-technik.tu-dortmund.de/~ma/qmail-bugs.html http://www.dt.e-technik.tu-dortmund.de/~ma/qmail-bugs.html
Unfortunately, 404 at the moment, but Internet Archive has a copy:
https://web.archive.org/web/20160409054053/http://www.dt.e-technik.tu-dortmund.de/~ma/qmail-bugs.html https://web.archive.org/web/20160409054053/http://www.dt.e-t...
- dfc 11y agoYes, "atrocious security" is not my reaction to a 15 year old MTA with two DoS and two RCEs.
- dozzie 11y agoOh yes, because denying that your code has a vulnerability counts as a good security practice. You know why this MTA has that low count of published bugs? Because nobody uses it anymore, so nobody looks at its code (and now factor in the ugliness of the code itself, which lowers the eagerness to look at the code even more). It's not because the code is (magically?) better.