4 ms·
Ok now do postfix
by aftbit 5mo ago
Ok now do postfix
- kees99 5mo agoNah, go straight for qmail. Give it your best try.
- rs_rs_rs_rs_rs 5mo agoThe usable qmail got owned by AI already, the unusable one not yet!
- tptacek 5mo agoNot by AI, but by humans awhile ago. I think Qualys weaponized a wontfix LP64 integer overflow in it just a couple years ago?
- rs_rs_rs_rs_rs 5mo agoThe Calif people found a nice bug in a qmail fork(what I consider usable qmail) some weeks ago.
- tptacek 5mo agoRight, and that fork is the only version of qmail people still run, and the bug they found was extremely funny given Bernstein's original qmail design (it was, if I remember right, a popen(3) vulnerability --- something that never would have showed up in Bernstein's code, but that's what happens when code gets abandoned, it gets picked up by people who don't really understand it). But it's hard to charge that vulnerability against the original qmail design. (I don't think anyone should run qmail.)
- adrian_b 5mo agoActually the original qmail still works fine. However it has some compatibility problems with modern practices, the most significant being that it does not know TLS. Having to use TLS is the main reason for running a qmail fork instead of the original.
- eqvinox 5mo ago"works fine" and "has some compatibility problems" is a little bit of an oxymoron... I understand what you're trying to say, but that does mean it's essentially unusable, despite "working fine".
- sys42590 5mo agoMany years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I learned that switching to Postfix massively improved my sleep quality.
- tptacek 5mo agoThere's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.
- deleted 5mo ago[deleted]
- loloquwowndueo 5mo agoWhich one would you suggest using? I’ve been looking at Stalwart to replace my old exim setup, wondering if it’s a reasonable choice.
- tptacek 5mo agoIf security is your concern, Stalwart seems like a fine option, almost certainly better than Postfix.
- comex 5mo agoAnother memory-safe option is Haraka, which I’ve been using for several years now. I recommend it but only for people who need extreme customizability. For everyone else, the customizability is a bit of a footgun, since you can easily end up with accidental open relays and other misconfigurations (as I learned the hard way).
- aftbit 5mo agoI run postfix in a receive-only mode to power inbound email processing. I'm very very glad there's no database requirement. It just passes the processing of inbound emails to a filter over stdin, which can do whatever it wants with databases or whatever it needs.