There are always CVE reports on popular code eventually. The question you have to ask is: "are you better off not knowing?" Minimizing attack surfaces often m

There are always CVE reports on popular code eventually. The question you have to ask is: "are you better off not knowing?" Minimizing attack surfaces often means role specific servers, and some sort of proprietary virtualization/sandbox. There are some good arguments to rotate and burn mail server instances every 3 months like clockwork, and expire your keys. i.e. makes sure permission rot, deleted user files, and failed binary sums are auto-deleted or captured in a peer forensic log. https://www.youtube.com/watch?v=eGOtZDk6wRc https://www.youtube.com/watch?v=eGOtZDk6wRc