Re: [gentoo-user] netqmail and qmail

[Alexander Skwar <listen@alexander.skwar.name>]

Michael Crute wrote:
> On 7/31/06, Alexander Skwar <listen@alexander.skwar.name> wrote:
>> Suranga Kasthuriarachchi wrote:

>> > Which is the best for organization mail server.
>>
>> NOT qmail - too many holes and not good performancewise.

> I would beg to differ with the statement about security. Qmail is
> arguably THE MOST secure mail server
> (http://cr.yp.to/qmail/guarantee.html).

Actually, it is NOT. DJB made this statement but he doesn't
stand to it. See http://home.pages.de/~mandree/qmail-bugs.html
for a quite big collection of bugs and RFC violations of qmail.

To quote from that page:

| The security guarantee is a smoke ball. Several people, among
| them Wietse Venema and Georgi Guninski, have documented exploitable
| qmail security bugs, yet the USD 500 have never been paid to either
| of them.

Bye,

Alexander Skwar
-- 
"I'm in Pittsburgh.  Why am I here?"
		-- Harold Urey, Nobel Laureate
-- 
gentoo-user@gentoo.org mailing list