TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

How to Write Software with Zero bugs – 25 years after qmail 1.0 – D. Bernstein [pdf]

34 点作者 bykhun将近 2 年前

9 条评论

hdmoore将近 2 年前
Erm, qmail had lots of bugs[1], when compiled for 64-bit processors (lots of integer overflows), but djb pushed back and said 64-bit wasn&#x27;t supported. If anything, qmail is known as the most annoying MTA to package, since no modifications to the source are permitted, and the application has to be built using a massive patch tree instead. The quirky management daemons required to run qmail were also obnoxious and at odds with everything else on the system.<p>Salient quote below:<p>&gt;In May 2005, Georgi Guninski published &quot;64 bit qmail fun&quot;, three vulnerabilities in qmail (CVE-2005-1513, CVE-2005-1514, CVE-2005-1515):<p>[snip]<p>&gt;Surprisingly, we re-discovered these vulnerabilities during a recent qmail audit; they have never been fixed because, as stated by qmail&#x27;s author Daniel J. Bernstein (in <a href="https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;guarantee.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;cr.yp.to&#x2F;qmail&#x2F;guarantee.html</a>):<p>&gt;&gt;&quot;This claim is denied. Nobody gives gigabytes of memory to each qmail-smtpd process, so there is no problem with qmail&#x27;s assumption that allocated array lengths fit comfortably into 32 bits.&quot;<p>1. <a href="https:&#x2F;&#x2F;www.qualys.com&#x2F;2020&#x2F;05&#x2F;19&#x2F;cve-2005-1513&#x2F;remote-code-execution-qmail.txt" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.qualys.com&#x2F;2020&#x2F;05&#x2F;19&#x2F;cve-2005-1513&#x2F;remote-code-...</a><p>edit: added quote from referenced url
评论 #37229678 未加载
评论 #37229828 未加载
评论 #37229622 未加载
评论 #37229899 未加载
kens将近 2 年前
The title of the actual paper is &quot;Some thoughts on security after ten years of qmail 1.0&quot;. The post currently has the made-up title &quot;How to Write Software with Zero bugs – 25 years after qmail 1.0 – D. Bernstein [pdf]&quot;.
评论 #37229808 未加载
评论 #37231198 未加载
评论 #37269401 未加载
jongjong将近 2 年前
I agree with the argument about reducing lines of code. Whenever I write code, I spend quite a bit of time thinking about different ways of implementing it before I start coding and the most important characteristic I look for in a solution is succinctness.<p>Correct code is easy to read because it&#x27;s close to its theoretical minimum size. It reminds me of the quote &quot;Perfection is achieved, not when there is nothing more to add, but when there is nothing left to take away.&quot;
gerdesj将近 2 年前
I ran several Qmail systems. Daemontools worked rather well. They had a habit of delivering email reliably. &quot;Life with Qmail&quot; was a very decent primer.<p>I also ran several other mail systems at the same time (and still do). Exchange&#x27;s smtpd is still a bit of a pain and I never put it on the internet directly.<p>Nowadays (last 15 years) I use Exim for a MTA&#x2F;proxy - at home and at work.
评论 #37230206 未加载
评论 #37229963 未加载
lockhouse将近 2 年前
Why is this flagged? This is one of the few posts that are actually on topic for HN.
latenightcoding将近 2 年前
Classic paper but what the hell is this title .
daneel_w将近 2 年前
Does anyone know how qmail has fared since this PDF was written in 2007? Did it make it to 2023 without any bugs surfacing?
评论 #37229464 未加载
评论 #37229478 未加载
technick将近 2 年前
I have PTSD from listening to my friends complain about qmail back in the early 2000&#x27;s.
johnea将近 2 年前
Good to see the DJBway here.<p>So much could be learned in modern *nix distributions from this philosophy...