Some thoughts on security after ten years of Qmail 1.0
Something to keep in mind with regards to qmail is that it&#x27;s extremely feature-poor and it never got features beyond its initial design goal.<p>This makes it much easier to keep the bugs out, to the point that making software under such constraints is much more similar to traditional construction projects.<p>I mean: Nobody ever tells you after you have built a bridge that they are now going to upgrade gravity to gravity 2.0 with 100% more pull. And nobody will ever tell you that your bridge will now get a shopping mall in the middle of it where people can purchase products of their favorite brands.<p>Software starts to break down when it has to be taken above initial design constraints and when there is not enough time to rewrite subsystems (or all of it) but instead when you have to make the abstractions leaky and compromise.<p>But back to qmail:<p>qmail itself is so feature-poor that traditionally, nobody was and is actually running qmail. Instead everybody is running &quot;qmail&quot; which is qmail plus some patches. Sometimes home-grown, sometimes taken from third parties.<p>But more often than not they are unmaintained and very far removed from the high quality standards of the underlying software.<p>This is the downside. Yes. You have a bug-free core that totally meets its designers (limited) use-case, but in reality nobody is actually running that.