5 ms·

Many years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I lea

Many years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I learned that switching to Postfix massively improved my sleep quality.

tptacek 4mo ago
There's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.
- deleted 4mo ago
  [deleted]
- loloquwowndueo 4mo ago
  Which one would you suggest using? I’ve been looking at Stalwart to replace my old exim setup, wondering if it’s a reasonable choice.
  - tptacek 4mo ago
    If security is your concern, Stalwart seems like a fine option, almost certainly better than Postfix.
  - comex 4mo ago
    Another memory-safe option is Haraka, which I’ve been using for several years now. I recommend it but only for people who need extreme customizability. For everyone else, the customizability is a bit of a footgun, since you can easily end up with accidental open relays and other misconfigurations (as I learned the hard way).
- aftbit 4mo ago
  I run postfix in a receive-only mode to power inbound email processing. I'm very very glad there's no database requirement. It just passes the processing of inbound emails to a filter over stdin, which can do whatever it wants with databases or whatever it needs.
- j16sdiz 4mo ago
  The problem with qmail is, everybody use a fork. No body use the real thing. The official release is not standard compliance. It does not support anything modern spam filter need. It don't get new updates or features. It have funny license. You can use a fork... but I need to ask: which fork?
- 1718627440 4mo ago
  > for that matter, an MTA that isn't backed by a real database. I use Postfix with MySQL, what is the issue with that?

tptacek 4mo ago

There's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.

deleted 4mo ago
[deleted]
loloquwowndueo 4mo ago
Which one would you suggest using? I’ve been looking at Stalwart to replace my old exim setup, wondering if it’s a reasonable choice.
- tptacek 4mo ago
  If security is your concern, Stalwart seems like a fine option, almost certainly better than Postfix.
- comex 4mo ago
  Another memory-safe option is Haraka, which I’ve been using for several years now. I recommend it but only for people who need extreme customizability. For everyone else, the customizability is a bit of a footgun, since you can easily end up with accidental open relays and other misconfigurations (as I learned the hard way).
aftbit 4mo ago
I run postfix in a receive-only mode to power inbound email processing. I'm very very glad there's no database requirement. It just passes the processing of inbound emails to a filter over stdin, which can do whatever it wants with databases or whatever it needs.
j16sdiz 4mo ago
The problem with qmail is, everybody use a fork. No body use the real thing. The official release is not standard compliance. It does not support anything modern spam filter need. It don't get new updates or features. It have funny license. You can use a fork... but I need to ask: which fork?
1718627440 4mo ago
> for that matter, an MTA that isn't backed by a real database. I use Postfix with MySQL, what is the issue with that?