I am saying all this as someone who has had significant enough issues with DJB’s software, I ended …

People here don't know that MaraDNS was already popular on extremely critical security mailing lists that basically hated anything but qmail and postfix. If you introduce more bugs and blog about them, it will probably gain in popularity. :)

> It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. Can you back that claim up with at least some sort of theory? Because it doesn't match my perception of the real world, nor does it match my mental model of how CVEs happen.

I never used Qmail, so I won't comment on it, but I will say djbdns was absolutely narrow in scope as well (before accounting the Unix approach to properly break that narrow scope down into many smaller separate tools in that narrow focus further). I held, and continue to hold, a soltuion containing e.g. authoritative DNS server which lacks native TCP or DNSSEC support falls squarely into the "narrowly scoped" bucket and I'd appreciate if you'd allow me to make my own declarations about which option I think applies to a specific project in the future.