4 ms·

I'm curious why you would recommend qmail these days. The last official version was released in 1998, and it seemed like it was stuck in some weird licence lim

by AlexMax 16y ago

I'm curious why you would recommend qmail these days. The last official version was released in 1998, and it seemed like it was stuck in some weird licence limbo until 2007, making forks unable to be distributed with linux distributions.

tptacek 16y ago
I trust qmail more than I trust Postfix. I may be biased; I found a vulnerability in Postfix early on. qmail has one of the best security track records of any piece of Internet software ever written; so far as I know, the only bona fide major vulnerability ever found in qmail required a nonstandard 64 bit deployment, and an attacker writing gigabytes of data to the server. I think you kind of have to admire a piece of software that is still useful without changes more than a decade after it was released. You're entitled to think differently. The license stuff is totally irrelevant to me. Bernstein didn't want his code forked ("incompatibility is a bug"). Hordes of Linux people, most of whom had never published a line of C in their lives, swarmed him and the Internet with complaints about how qmail wasn't open source or (worse, and more misleadingly) was "proprietary". It's public domain now. Postfix is a perfectly acceptable alternative to qmail.
- JoachimSchipper 16y ago
  Didn't qmail's license require you to install it in /service/qmail or something similarly nonstandard? I admit that it might be better if things did work that way, but they don't and having one program work differently is just annoying. Of course, this is not a problem now that it's unambiguously public domain.
  - jrockway 16y ago
    The license didn't require you to do that. It required Linux distributors to install it there by default.
- AlexMax 16y ago
  Ah, I see. Thanks for the insightful reply.
ajays 16y ago
qmail may be old, but the author (DJB) wrote some _solid_ code. I believe there hasn't been a vulnerability in qmail in the last 10 years (someone can correct me if I'm wrong).
- tptacek 16y ago
  There was a 32/64 integer overflow.
jrockway 16y ago
qmail may have had weird license quirks and may not be as featureful as modern MTAs, but the code is very nicely designed. qmail did not achieve "commerical success", but that was due to the learning curve rather than its approach to not having remote root holes. I used it for many years until I got lazy and switched to exim and then postfix. I guess I am glad that I switched to postfix, but not so glad that I switched away from qmail. (Ironically, I still use sendmail on my OpenBSD boxes. It sure seems funny to be relieved that I'm running sendmail today!)

by AlexMax 16y ago

tptacek 16y ago

I trust qmail more than I trust Postfix. I may be biased; I found a vulnerability in Postfix early on. qmail has one of the best security track records of any piece of Internet software ever written; so far as I know, the only bona fide major vulnerability ever found in qmail required a nonstandard 64 bit deployment, and an attacker writing gigabytes of data to the server. I think you kind of have to admire a piece of software that is still useful without changes more than a decade after it was released. You're entitled to think differently. The license stuff is totally irrelevant to me. Bernstein didn't want his code forked ("incompatibility is a bug"). Hordes of Linux people, most of whom had never published a line of C in their lives, swarmed him and the Internet with complaints about how qmail wasn't open source or (worse, and more misleadingly) was "proprietary". It's public domain now. Postfix is a perfectly acceptable alternative to qmail.

JoachimSchipper 16y ago
Didn't qmail's license require you to install it in /service/qmail or something similarly nonstandard? I admit that it might be better if things did work that way, but they don't and having one program work differently is just annoying. Of course, this is not a problem now that it's unambiguously public domain.
- jrockway 16y ago
  The license didn't require you to do that. It required Linux distributors to install it there by default.
AlexMax 16y ago
Ah, I see. Thanks for the insightful reply.

ajays 16y ago

qmail may be old, but the author (DJB) wrote some _solid_ code. I believe there hasn't been a vulnerability in qmail in the last 10 years (someone can correct me if I'm wrong).

tptacek 16y ago
There was a 32/64 integer overflow.

jrockway 16y ago

qmail may have had weird license quirks and may not be as featureful as modern MTAs, but the code is very nicely designed. qmail did not achieve "commerical success", but that was due to the learning curve rather than its approach to not having remote root holes. I used it for many years until I got lazy and switched to exim and then postfix. I guess I am glad that I switched to postfix, but not so glad that I switched away from qmail. (Ironically, I still use sendmail on my OpenBSD boxes. It sure seems funny to be relieved that I'm running sendmail today!)