Some thoughts on security after ten years of Qmail 1.0
As we cast about trying to figure out ways to make software more secure or reliable, please remember that in other engineering fields (civil, chemical, mechanical, etc.) prioritizing safety and reliability is a _solved problem_.<p>(1996) <a href="https:&#x2F;&#x2F;www.fastcompany.com&#x2F;28121&#x2F;they-write-right-stuff" rel="nofollow">https:&#x2F;&#x2F;www.fastcompany.com&#x2F;28121&#x2F;they-write-right-stuff</a><p>&gt; It is perfect, as perfect as human beings have achieved. Consider these stats: the last three versions of the program — each 420,000 lines long-had just one error each. The last 11 versions of this software had a total of 17 errors. Commercial programs of equivalent complexity would have 5,000 errors.<p>&gt; The process isn’t even rocket science. Its standard practice in almost every engineering discipline except software engineering.<p>The problem is consequences. We had centuries of people dying in bridge collapses before we got our shit together and started prioritizing safety in civil engineering (i.e. engineers and managers going to prison if they don&#x27;t).<p>The same will be true for software. As more people get harmed by thrown together software (e.g. mass panic in Hawaii, state psychological exploitation on social media), we&#x27;ll start regulating it like other engineering fields.<p>As a former chemical engineer, I welcome this transition, but I realize it will likely also take centuries of hard lessons.