5 ms·
My guess is that he'd never accept it. He originally didn't allow people to distribute qmail with changes; this is squarely a Debian issue.
by kick 6y ago
My guess is that he'd never accept it. He originally didn't allow people to distribute qmail with changes; this is squarely a Debian issue.
- tedunangst 6y agoWhat did Debian change to introduce this vulnerability?
- dsr_ 6y agoNothing, per se. But they don't set up softlimits or message size limits by default, both of which you should definitely do... it's just that the values you put in are specific to your situation.
- tom_mellior 6y agoIf you have DJB's ego yelling at you that the default configuration is safe, why would you bother setting limits to fix it?
- jacquesm 6y agoBecause you care more about the users than about DJB's ego.
- haroldp 6y agoThen you should be running Postfix.
- dependenttypes 6y agoDJB has been telling people to run it with the memory limits since 2005.
- im3w1l 6y agoIf he takes that stance than it will cast doubt on everything else he has done. If there is a footgun on the wall, by the end it must go off, and chaining "non-exploitable" bugs together is routine stuff for hackers.
- liveoneggs 6y agothe grown-ups moved to postfix a long time ago
- gowld 6y agoIt's been 20 years; I don't think he's concerned.
- deleted 6y ago[deleted]
- im3w1l 6y agoAhhh I see now that "qmail last had an official release in the late 90's". That changes everything, obviously.
- loup-vaillant 6y agoIn case it wasn't sarcasm: I would say it does not. What would, would be a note on the website explicitly mentioning that Qmail is unmaintained, and people should either take over maintenance or use something else. Seeing no such disclaimer at https://cr.yp.to/qmail.html https://cr.yp.to/qmail.html means DJB is (possibly unintentionally) still vouching for it. Right now in 2020.
- allover 6y agoWhen you say "this is squarely a Debian issue", do you mean "in his opinion", or that you agree?