Hacker News Reader

So it's not secure by default.

It is in the sense that the author did specify AFAIK the bounds within it should run, no?

Where and when? If I had installed qmail on a 64 bit machine in 2004, how would I have known that it was remotely exploitable?