Date: Wed, 16 Jun 2004 15:28:42 -0400 From: Chuck Swiger <cswiger@mac.com> To: Robert Huff <roberthuff@rcn.com> Cc: freebsd-questions@freebsd.org Subject: Re: Mail Message-ID: <40D09F6A.4030407@mac.com> In-Reply-To: <16592.38955.399680.399710@jerusalem.litteratus.org> References: <40D023A1.8090009@cs.uiowa.edu> <20040616140305.GD32001@millerlite.local.mark-and-erika.com> <20040616145305.GB15913@ei.bzerk.org> <40D081D1.1060606@mac.com> <16592.38955.399680.399710@jerusalem.litteratus.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Robert Huff wrote: > Chuck Swiger writes: [ ... ] > Would you care to nominate an inherently network-accessible > program with such a track record? For example: 5.2.1 was released > in late February; there are currently 12 security advisories*, of > which I would consider at least 5 to be part of the core system. > (As opposed to things in the base system, like BIND.) http://cr.yp.to/qmail/guarantee.html: "In March 1997, I offered $500 to the first person to publish a verifiable security hole in the latest version of qmail: for example, a way for a user to exploit qmail to take over another account. My offer still stands. Nobody has found any security holes in qmail." Note that the author has chosen to view this guarantee as applicable to remotely exploitable holes resulting in being able to run programs as some user, rather than denial-of-service exploits (say, filling up the drive due to a mailbomb), and that there have been security issues with commonly used patches to qmail. Then again, anything which uses SSL (ie, qmail+TLS) has been vulnerable to the horde of OpenSSL issues... People who think that installing qmail today are likely to not be hacked due to a security hole in qmail over the next two years do indeed have some reason for their belief. -- -Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?40D09F6A.4030407>