From owner-freebsd-questions@FreeBSD.ORG Wed Jun 16 19:28:58 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 69BE716A4CF for ; Wed, 16 Jun 2004 19:28:58 +0000 (GMT) Received: from out012.verizon.net (out012pub.verizon.net [206.46.170.137]) by mx1.FreeBSD.org (Postfix) with ESMTP id 09AC643D1F for ; Wed, 16 Jun 2004 19:28:58 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from [192.168.1.3] ([68.161.84.3]) by out012.verizon.net (InterMail vM.5.01.06.06 201-253-122-130-106-20030910) with ESMTP id <20040616192851.RENC2198.out012.verizon.net@[192.168.1.3]>; Wed, 16 Jun 2004 14:28:51 -0500 Message-ID: <40D09F6A.4030407@mac.com> Date: Wed, 16 Jun 2004 15:28:42 -0400 From: Chuck Swiger Organization: The Courts of Chaos User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040608 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Robert Huff References: <40D023A1.8090009@cs.uiowa.edu> <20040616140305.GD32001@millerlite.local.mark-and-erika.com> <20040616145305.GB15913@ei.bzerk.org> <40D081D1.1060606@mac.com> <16592.38955.399680.399710@jerusalem.litteratus.org> In-Reply-To: <16592.38955.399680.399710@jerusalem.litteratus.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Authentication-Info: Submitted using SMTP AUTH at out012.verizon.net from [68.161.84.3] at Wed, 16 Jun 2004 14:28:51 -0500 cc: freebsd-questions@freebsd.org Subject: Re: Mail X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Jun 2004 19:28:58 -0000 Robert Huff wrote: > Chuck Swiger writes: [ ... ] > Would you care to nominate an inherently network-accessible > program with such a track record? For example: 5.2.1 was released > in late February; there are currently 12 security advisories*, of > which I would consider at least 5 to be part of the core system. > (As opposed to things in the base system, like BIND.) http://cr.yp.to/qmail/guarantee.html: "In March 1997, I offered $500 to the first person to publish a verifiable security hole in the latest version of qmail: for example, a way for a user to exploit qmail to take over another account. My offer still stands. Nobody has found any security holes in qmail." Note that the author has chosen to view this guarantee as applicable to remotely exploitable holes resulting in being able to run programs as some user, rather than denial-of-service exploits (say, filling up the drive due to a mailbomb), and that there have been security issues with commonly used patches to qmail. Then again, anything which uses SSL (ie, qmail+TLS) has been vulnerable to the horde of OpenSSL issues... People who think that installing qmail today are likely to not be hacked due to a security hole in qmail over the next two years do indeed have some reason for their belief. -- -Chuck