Some thoughts on security after ten years of Qmail 1.0

Something to keep in mind with regards to qmail is that it&#x27;s extremely feature-poor and it never got features beyond its initial design goal.<p>This makes it much easier to keep the bugs out, to the point that making software under such constraints is much more similar to traditional construction projects.<p>I mean: Nobody ever tells you after you have built a bridge that they are now going to upgrade gravity to gravity 2.0 with 100% more pull. And nobody will ever tell you that your bridge will now get a shopping mall in the middle of it where people can purchase products of their favorite brands.<p>Software starts to break down when it has to be taken above initial design constraints and when there is not enough time to rewrite subsystems (or all of it) but instead when you have to make the abstractions leaky and compromise.<p>But back to qmail:<p>qmail itself is so feature-poor that traditionally, nobody was and is actually running qmail. Instead everybody is running &quot;qmail&quot; which is qmail plus some patches. Sometimes home-grown, sometimes taken from third parties.<p>But more often than not they are unmaintained and very far removed from the high quality standards of the underlying software.<p>This is the downside. Yes. You have a bug-free core that totally meets its designers (limited) use-case, but in reality nobody is actually running that.

As we cast about trying to figure out ways to make software more secure or reliable, please remember that in other engineering fields (civil, chemical, mechanical, etc.) prioritizing safety and reliability is a _solved problem_.<p>(1996) <a href="https:&#x2F;&#x2F;www.fastcompany.com&#x2F;28121&#x2F;they-write-right-stuff" rel="nofollow">https:&#x2F;&#x2F;www.fastcompany.com&#x2F;28121&#x2F;they-write-right-stuff</a><p>&gt; It is perfect, as perfect as human beings have achieved. Consider these stats: the last three versions of the program — each 420,000 lines long-had just one error each. The last 11 versions of this software had a total of 17 errors. Commercial programs of equivalent complexity would have 5,000 errors.<p>&gt; The process isn’t even rocket science. Its standard practice in almost every engineering discipline except software engineering.<p>The problem is consequences. We had centuries of people dying in bridge collapses before we got our shit together and started prioritizing safety in civil engineering (i.e. engineers and managers going to prison if they don&#x27;t).<p>The same will be true for software. As more people get harmed by thrown together software (e.g. mass panic in Hawaii, state psychological exploitation on social media), we&#x27;ll start regulating it like other engineering fields.<p>As a former chemical engineer, I welcome this transition, but I realize it will likely also take centuries of hard lessons.

Damn, it&#x27;s been nearly 20 years since qmail 1.03 was released (June 1998)? It sure doesn&#x27;t seem like that long!<p>I recall setting up qmail &quot;toasters&quot; on FreeBSD to do virtual hosting. Maybe I was just too much of a &quot;n00b&quot; but I remember it being a big PITA to get all the services to play well together. There was this hip new outfit named Yahoo! that was using it for their new webmail service, though -- as opposed to sendmail, which pretty much every MTA on the Internet used at the time (and I was proficient enough with sendmail that I would edit my sendmail.cf by hand; pffft, who needs m4!?) -- so I assumed it was certainly capable of handling <i>my</i> volume of mail. (I wasn&#x27;t running authoritative DNS servers at the time or I probably would&#x27;ve used djbdns over BIND as well.)<p>qmail, unfortunately, never did become <i>too</i> popular (relatively speaking, of course) and that&#x27;s really a shame, because, as the quote in the article says:<p>&gt; &quot;We <i>need</i> invulnerable software systems, and we need them today, ...&quot;<p>While that was certainly true <i>then</i>, it&#x27;s even more true now.<p>On a side note, I&#x27;m surprised that the &quot;qmail security guarantee&quot; [0,1] wasn&#x27;t mentioned in the article:<p>&gt; <i>&quot;In March 1997, I took the unusual step of publicly offering $500 to the first person to publish a verifiable security hole in the latest version of qmail: for example, a way for a user to exploit qmail to take over another account. My offer still stands. Nobody has found any security holes in qmail. I hereby increase the offer to $1000.&quot;</i><p>[0]: <a href="https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;guarantee.html" rel="nofollow">https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;guarantee.html</a><p>[1]: <a href="https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;qmailsec-20071101.pdf" rel="nofollow">https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;qmailsec-20071101.pdf</a> (PDF)

My biggest takeaway from qmail has nothing to do with security, but rather that excessively restrictive licensing, highly opinionanted&#x2F;unusual setup, and unwillingness to collaborate on its development squandered its potential.<p>If it wasn&#x27;t for all that, we might well all be using qmail-based mail servers today, as qmail was really ahead of its time in so many ways.<p>It was kind of like the Amiga of mail servers, back in the day. It could have easily dominated the market, but it wound up a mere historical curiosity.

I still don&#x27;t get djb&#x27;s distinction between untrusted and minimal privilege code. What he calls &quot;not violating security requirements&quot; is effectively a successful least privilege approach. Very few elements can become hacked without breaking security requirements. If you can&#x27;t gain anything from hacking a piece of software, then why is it even executed? - it obviously didn&#x27;t deal with anything the user wants.<p>In his example, yes, you could change the DNS responses, but you still could not escalate to a higher lever where you can potentially modify stored user data. That is a success in practice.

My favorite quote from that paper is &quot;I have discovered that there are two types of command interfaces in the world of computing: good interfaces and user interfaces.&quot;<p>As others have pointed out, one thing left out of the paper is not updating the software. qmail doesn&#x27;t support SPF or other security extensions, which makes it useless these days without patches.

Interesting article, the only thing I fail to see how this is related to Meltdown and Spectre. Those are not simple &#x27;bugs&#x27;, it&#x27;s multiple good features of modern processors combined to yield an attack vector. My opinion is that with any level of process problems like this will arise sooner or later just because the complexity is so high.

Nice summarizing article, with some programming concepts—explicit data flow, for example—that are even more generally applicable (though the topics of security and code volume&#x2F;quality be linked).