Hacker News Reader

Comment by kick | Hacker News Reader

My guess is that he'd never accept it. He originally didn't allow people to distribute qmail with changes; this is squarely a Debian issue.

View on HN

If he takes that stance than it will cast doubt on everything else he has done. If there is a footgun on the wall, by the end it must go off, and chaining "non-exploitable" bugs together is routine stuff for hackers.

the grown-ups moved to postfix a long time ago

It's been 20 years; I don't think he's concerned.

Ahhh I see now that "qmail last had an official release in the late 90's". That changes everything, obviously.

In case it wasn't sarcasm: I would say it does not. What would, would be a note on the website explicitly mentioning that Qmail is unmaintained, and people should either take over maintenance or use something else.

Seeing no such disclaimer at https://cr.yp.to/qmail.html means DJB is (possibly unintentionally) still vouching for it. Right now in 2020.

What did Debian change to introduce this vulnerability?

Nothing, per se. But they don't set up softlimits or message size limits by default, both of which you should definitely do... it's just that the values you put in are specific to your situation.

If you have DJB's ego yelling at you that the default configuration is safe, why would you bother setting limits to fix it?

Because you care more about the users than about DJB's ego.

Then you should be running Postfix.

DJB has been telling people to run it with the memory limits since 2005.

When you say "this is squarely a Debian issue", do you mean "in his opinion", or that you agree?

Reply on news.ycombinator.com