Hacker News Reader

Comment by aftbit | Hacker News Reader

Ok now do postfix

Many years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I learned that switching to Postfix massively improved my sleep quality.

There's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.

I run postfix in a receive-only mode to power inbound email processing. I'm very very glad there's no database requirement. It just passes the processing of inbound emails to a filter over stdin, which can do whatever it wants with databases or whatever it needs.

The problem with qmail is, everybody use a fork. No body use the real thing.

The official release is not standard compliance. It does not support anything modern spam filter need. It don't get new updates or features. It have funny license.

You can use a fork... but I need to ask: which fork?

Which one would you suggest using?

I’ve been looking at Stalwart to replace my old exim setup, wondering if it’s a reasonable choice.

Another memory-safe option is Haraka, which I’ve been using for several years now. I recommend it but only for people who need extreme customizability. For everyone else, the customizability is a bit of a footgun, since you can easily end up with accidental open relays and other misconfigurations (as I learned the hard way).

If security is your concern, Stalwart seems like a fine option, almost certainly better than Postfix.

> for that matter, an MTA that isn't backed by a real database.

I use Postfix with MySQL, what is the issue with that?

Nah, go straight for qmail. Give it your best try.

The usable qmail got owned by AI already, the unusable one not yet!

Not by AI, but by humans awhile ago. I think Qualys weaponized a wontfix LP64 integer overflow in it just a couple years ago?

The Calif people found a nice bug in a qmail fork(what I consider usable qmail) some weeks ago.

Right, and that fork is the only version of qmail people still run, and the bug they found was extremely funny given Bernstein's original qmail design (it was, if I remember right, a popen(3) vulnerability --- something that never would have showed up in Bernstein's code, but that's what happens when code gets abandoned, it gets picked up by people who don't really understand it). But it's hard to charge that vulnerability against the original qmail design.

(I don't think anyone should run qmail.)

Actually the original qmail still works fine.

However it has some compatibility problems with modern practices, the most significant being that it does not know TLS.

Having to use TLS is the main reason for running a qmail fork instead of the original.

"works fine" and "has some compatibility problems" is a little bit of an oxymoron... I understand what you're trying to say, but that does mean it's essentially unusable, despite "working fine".

Reply on news.ycombinator.com