40 ms·
> You don't find that vulnerability in qmail because qmail doesn't have that feature. But being selective about what features to add is itself a valid strategy
by sigil 7y ago
> You don't find that vulnerability in qmail because qmail doesn't have that feature.
But being selective about what features to add is itself a valid strategy for writing secure software — perhaps even the most effective one!
- deleted 7y ago[deleted]
- pilif 7y agoI agree. But if the software is lacking essential features so that everybody patches them back in it's a very ineffective strategy because anybody's home-grown patches are worse than properly maintained features. I can put a machine on the net with a closed port 25. That's the most minimal implementation of an MTA and it's entirely secure. Guaranteed. The thing is that qmail was severely lacking features back in the 90ies and it has received zero feature additions by its original author since then, so it's safe to assume that it's now lacking even more features to the point where anybody running qmail these days is nearly guaranteed to be running franken-qmail full of third-party patches which are surely less well maintained than proper Postfix. That was my point.