>I disagree. It is a fair mark against postfix if (as I claim) most users really don't need it.if they don't need it, they won't be affected by that vulnerability because it won't be active.
>Meanwhile on the enterprise, pretty much every machine in every enterprise environment I've ever worked in has been set up for local relay.
In every enterprise setup I have seen, local relay was still protected using SMTP-AUTH for accounting purposes.
Plus in case of end-users, many ISPs still provide SMTP for mail delivery, all of whom need to support SMTP auth. That includes Fastmail and Gmail.
>but I can't believe you gain nothing by starting from a solid foundation.
Of course you do. But saying "Postfix is worse because it had a security vulnerability in a component that qmail doesn't even support" is unfair to postfix.
If you are running qmail with a custom patch then that custom patch will for sure have been exposed to less scrutiny than Postfix proper. It's not valid to extend the scrutiny given to vanilla qmail to all of the custom patches.
if they don't need it, they won't be affected by that vulnerability because it won't be active.
>Meanwhile on the enterprise, pretty much every machine in every enterprise environment I've ever worked in has been set up for local relay.
In every enterprise setup I have seen, local relay was still protected using SMTP-AUTH for accounting purposes.
Plus in case of end-users, many ISPs still provide SMTP for mail delivery, all of whom need to support SMTP auth. That includes Fastmail and Gmail.
>but I can't believe you gain nothing by starting from a solid foundation.
Of course you do. But saying "Postfix is worse because it had a security vulnerability in a component that qmail doesn't even support" is unfair to postfix.
If you are running qmail with a custom patch then that custom patch will for sure have been exposed to less scrutiny than Postfix proper. It's not valid to extend the scrutiny given to vanilla qmail to all of the custom patches.