> saying "Postfix is worse because it had a security vulnerability in a component that qmail doesn't even support" is unfair to postfix.
Ok, well that's your opinion, and hopefully now you at least know why I have mine.
I can't imagine forgiving Microsoft for all those AD/SMB and explorer CVE just because Linux doesn't support those things, but it's not really that important to me.
> In every enterprise setup I have seen, local relay was still protected using SMTP-AUTH for accounting purposes.
I have no idea what you mean by "accounting purposes" -- it sounds like you're talking about users relaying and not machines relaying.
There is no way you'd get a SOC2 (or SSAE/SOC1) if you used SMTP auth to protect local relays, so perhaps we are talking about different things when we say "enterprise".
> If you are running qmail with a custom patch then that custom patch will for sure have been exposed to less scrutiny than Postfix proper.
I'm still not sure you can have it both ways. Why is it when Debian patches postfix that it's still (in your mind) "postfix proper" but when I download a well-distributed and discussed patch from a mailing list, and read it myself, that you somehow think I'm at higher risk?
Ok, well that's your opinion, and hopefully now you at least know why I have mine.
I can't imagine forgiving Microsoft for all those AD/SMB and explorer CVE just because Linux doesn't support those things, but it's not really that important to me.
> In every enterprise setup I have seen, local relay was still protected using SMTP-AUTH for accounting purposes.
I have no idea what you mean by "accounting purposes" -- it sounds like you're talking about users relaying and not machines relaying.
There is no way you'd get a SOC2 (or SSAE/SOC1) if you used SMTP auth to protect local relays, so perhaps we are talking about different things when we say "enterprise".
> If you are running qmail with a custom patch then that custom patch will for sure have been exposed to less scrutiny than Postfix proper.
I'm still not sure you can have it both ways. Why is it when Debian patches postfix that it's still (in your mind) "postfix proper" but when I download a well-distributed and discussed patch from a mailing list, and read it myself, that you somehow think I'm at higher risk?