Thought-provoking paper [PDF] from Daniel J Bernstein, the author of qmail, covering software security and addressing topics such as premature optimization and bug reduction along the way.
In March 1997, I took the unusual step of publicly offering $500 to the first person to publish a verifiable security hole in the latest version of qmail: for example, a way for a user to exploit qmail to take over another account. My offer still stands. Nobody has found any security holes in qmail. I hereby increase the offer to $1000.
He attributes his success to minimizing the amount of trusted code, in contrast to running code with least privilege which he says is ineffective.
(from Schneier on Security).
Technorati tags: security, software development, qmail