The qmail software package is a widely used Internet-mail
transfer agent that has been covered by a security guarantee
since 1997. In this paper, the qmail author reviews the history and security-relevant architecture of qmail; articulates
partitioning standards that qmail fails to meet; analyzes the
engineering that has allowed qmail to survive this failure;
and draws various conclusions regarding the future of secure
programming.

Is security too sexy to leave?