Hacker News Reader

>Postfix is written in C, and none of us should be comfortable with that

qmail is written in C, and it has never had a serious security hole that I am aware of. Not all C code is unsafe.

64-bit qmail was remotely exploitable. The author believes a small address space (below 4 GB) was an adequate mitigation, but the code was confused and trying to do something unsafe.

https://lwn.net/Articles/820969/

One thing you can say for both Postfix and qmail is that they're written to avoid the problems of the C standard library. Exim is not.

Reply on news.ycombinator.com