Re: problem with Postfix port

["Evan Champion" <evanc@concer.to>]

>By me it is completely unacceptable, i would better have sgid (for
>example to some group `mail') well-written program rather, than program
>with various spinings to be non-sgid in anyway. What's wrong with
>s(uid|gid) programs, that they became some mysterious sign of danger?
>The idea of suid/sgid was cool, it gives flexibility to managing of
data
>and tryings to write non-set uid/gid programs anyways. The goal is not
>"removing all suid/sgid programs from system", but "make all programs
>work as much reliably, stabily and effectively as it's possible", and
any
>thing is acceptable to reach the goal, no matter is it siud/guid or it
>isn't.

It is pretty tough to come up with a system that doesn't need root for
anything.  However, you can minimise the number of suid programs and the
amount of time they need to spend setuid.

qmail takes this pretty much to the extreme.  Despite the offer of a
cash reward no one has ever been able to find a security hole in qmail.

I suspect having said this, this thread is going to degenerate in to an
MTA war as happens most every other time the merits of one MTA are
brought up over another.  I think it is fair to say that whatever you
choose to run instead of sendmail is almost guaranteed to be a major
improvement.  Personally I'd rather see people run qmail, but use
whatever turns your crank.  Please flame me directly.

Evan