RE: qmail or postfix?

["Karen Ellrick" <k-ellrick sctech co jp>]

>  Though I am wondering what the people at RedHat have to say about this:
> http://cr.yp.to/maildisasters/postfix.html

Hmm, it looks like Dan and Wietse are having quite an argument - I hadn't
seen that before.  I am not skilled enough at the internals of Linux to
determine who is right... :(  I must agree that Wietse can have a somewhat
abrupt communication style - I have corresponded with him myself.  But that
doesn't necessarily mean he's trying to deny or hide something he knows is
true - it's just his personality, perhaps aggrevated by false bug
accusations he regularly gets on the Postfix mailing list from newbies who
have their system misconfigured or something.  Anyway, I would be interested
to see more on this issue from others - perhaps CERT, SANS, or another third
party that can check it out thoroughly.

In my case, although I am concerned about all levels of security, at our
little company I am more concerned about external hacks than what internal
users can do.  Other than two network administrators, the employees here
don't even know how to log onto the Linux servers, let alone create hard
links.  Yes, I know, if someone outside were to get access to a user
account...  But I keep my perimeter and host security and password policy as
tight as I can, and was attracted to the simplicity of Postfix for security
from external hackers.  People are regularly having to patch security holes
in Sendmail, due to its sheer complexity.  I'll be honest - I never really
checked out Qmail, because dealing with mail in Japanese, it was important
to get a credible endorsement from Japanese organizations using the MTA,
something I found for Postfix but not for Qmail (I suspect Qmail also
handles Japanese mail just fine, but my opinion alone won't convince my
bosses).

I just now sent a test message to a bogus user at redhat.com just to get a
bounce message, and from its header, it looks like Redhat is still (or
again) using Sendmail, so I take back my statement about Redhat.

Karen