Matthew S. Hallacy writes: > I'm well versed in the ways of SMTP, there are multiple ways it could > lose a message due to rlimits. Really? How? qmail-smtpd does not crash when it runs out of memory. It gracefully recovers and returns the proper 4xx error code: $ dd if=/dev/zero of=foo count=1 bs=2M 1+0 records in 1+0 records out 2097152 bytes transferred in 0.032621 seconds (64288324 bytes/sec) $ softlimit -m 1500000 /var/qmail/bin/qmail-smtpd < foo 220 david.maridia.com ESMTP 421 out of memory (#4.3.0) > My point is that when possible, things should do their best to limit > their exposure to possibly denial of service attacks. qmail (and any other > mail daemon) could easily do this, yet djb chooses not to. So you think that every program should do extra work to artificially limit resource utilization when it is already built into the kernel? > If it were perfect, everyone would be using it. No, there would still be people like you that would refuse to use it for whatever reason. > qmail without patches would > not have satisfied the original posters needs. Not necessarily. He required authentication for SMTP relaying. POP-before-SMTP likely would have met his needs. But this is a moot point, considering we don't know the real problem he was trying to solve. > This whole thread started because someone needed SMTP AUTH, that > functionality requires third party add-ons to qmail that are insecure. No, he needed authenticated relaying. SMTP AUTH is only one solution to that problem. Don't assume every problem only has one solution. > You recommended an insecure product while putting down all other > mail daemons because they're "insecure". It's interesting to see you resort to lying when you can't make a logical point. > So qmail never had bugs from day one, I find that hard to believe. No one has ever claimed it doesn't have bugs. It does not have security holes. > So, it's okay unless djb has written something. Your reasoning is > flawed, just because some piece of software has had a bug in it, it > should be scrapped and completely rewritten? Dan is one of the few people that truely understands how to write reliable and secure software. So, yes, I trust his software. In most cases, a single security bug is an indication of an even bigger problem. When you have a cut and it gets infected, you don't simply put a bandaid over it and pretend everything is fine. You have to fix the source of the problem. Software is the same way. > See above, you seem to be okay with shoddy software (MSOE, for > example) unless the deity djb has written something to perform that > service. Perhaps you should let people know that you're a djb follower > before trolling mailing lists. If I had a good way to export four years of mail into maildir or similiar, perhaps I would switch to Mutt. But instead of resorting to bringing up unrelated issues, perhaps you could educate yourself as to why qmail is secure and other MTAs aren't? -- David Phillips <david at acz.org> http://david.acz.org/ _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list