Comment by kelnos

2 days ago

I don't think we should set our expectations based on an extreme outlier. qmail is special, and we can't expect most software to get to its level of security/safety.

Put another way: if you have to rely on programmer skill or attention to detail in order to guarantee something, that will always be a losing bet, on average. The existence of a tiny percentage of programmers that can clear that high bar does not make it a valid strategy.

3 comments

kelnos

Reply
uecker  2 days ago

Splitting programs into mutually untrusting modules is a plausible alternative to memory safety in programming languages.

Also in a program similar to qmail, memory safety alone is not sufficient, a lot of bugs in sendmail were related to complexity issues.

  • pjmlp  2 days ago

    If only there was an OS design architecture that would follow such approach from the ground up....