Qmail is less bad than most (and much less bad than Sendmail), but it&#x27;s worth noting the author dismissed a known remote attack involving array lengths overflowing 32 bits. He&#x27;s aware 64 bit machines exist yet assumes nobody would ever give his server enough RAM to allow exploiting this, which I find surprisingly reckless given his reputation.<p>Most of us know several languages in which this bug would have been impossible (using either bignums or bound-checked arrays), yet here we are.<p><a href="http:&#x2F;&#x2F;archives.neohapsis.com&#x2F;archives&#x2F;fulldisclosure&#x2F;2005-05&#x2F;0101.html" rel="nofollow">http:&#x2F;&#x2F;archives.neohapsis.com&#x2F;archives&#x2F;fulldisclosure&#x2F;2005-0...</a><p><a href="http:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;guarantee.html" rel="nofollow">http:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;guarantee.html</a>