Postfix has had 9 CVEs in 20 years, a few of them quite bad. [0]
qmail has had 1 CVE in 20 years, a local DoS. [1]
I trust djb to write correct code more than almost any other human on the planet. That includes all the non-crypto code found in qmail, daemontools, dnscache, ucspi-tcp, etc. If you’ve read it, you know how almost supernaturally careful and minimal it is.
Your points about mere mortals writing C are well taken though!
qmail has had 1 CVE in 20 years, a local DoS. [1]
I trust djb to write correct code more than almost any other human on the planet. That includes all the non-crypto code found in qmail, daemontools, dnscache, ucspi-tcp, etc. If you’ve read it, you know how almost supernaturally careful and minimal it is.
Your points about mere mortals writing C are well taken though!
[0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
[1] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...