1 00:00:00,000 --> 00:00:01,660 You know, whenever you sit down on your laptop, 2 00:00:01,660 --> 00:00:04,880 type out a quick message, and hit send on an email, 3 00:00:04,880 --> 00:00:08,840 there is this immediate expectation of magic. 4 00:00:08,840 --> 00:00:09,760 Oh, absolutely. 5 00:00:09,760 --> 00:00:12,200 You click the button, there's that little swoosh sound, 6 00:00:12,200 --> 00:00:15,600 and instantly, someone halfway across the world 7 00:00:15,600 --> 00:00:17,360 gets a notification on their phone. 8 00:00:17,360 --> 00:00:18,480 We don't even think about it. 9 00:00:18,480 --> 00:00:20,760 Right, it feels completely frictionless, 10 00:00:20,760 --> 00:00:22,600 like instant teleportation of your thoughts. 11 00:00:22,600 --> 00:00:26,000 Exactly, but beneath that frictionless surface, 12 00:00:26,000 --> 00:00:29,820 there is this massive industrial scale machinery 13 00:00:29,820 --> 00:00:31,160 working frantically. 14 00:00:31,160 --> 00:00:32,520 Yeah, I mean, it has to figure out 15 00:00:32,520 --> 00:00:34,320 where that message actually needs to go, 16 00:00:34,320 --> 00:00:36,920 how it's going to get there, and whether it's 17 00:00:36,920 --> 00:00:38,520 safe to deliver at all. 18 00:00:38,520 --> 00:00:41,040 And the most fascinating part of that machinery 19 00:00:41,040 --> 00:00:43,880 is who actually owns it, because it isn't usually 20 00:00:43,880 --> 00:00:46,520 the big tech companies whose logos are on your screen. 21 00:00:46,520 --> 00:00:47,640 No, not at all. 22 00:00:47,640 --> 00:00:50,480 The invisible infrastructure running our daily communications 23 00:00:50,480 --> 00:00:53,060 is often built, maintained, and fiercely protected 24 00:00:53,060 --> 00:00:54,920 by independent volunteer communities. 25 00:00:54,920 --> 00:00:57,380 Right, and recently, some of those communities 26 00:00:57,380 --> 00:00:59,840 have been making drastic moves to guarantee 27 00:00:59,840 --> 00:01:02,280 they don't get swallowed up by tech monopolies. 28 00:01:02,280 --> 00:01:05,440 They are actively migrating away from corporate platforms 29 00:01:05,440 --> 00:01:07,980 to ensure the internet's core infrastructure remains 30 00:01:07,980 --> 00:01:09,080 independent. 31 00:01:09,080 --> 00:01:10,820 Which is actually the perfect entry point 32 00:01:10,820 --> 00:01:14,160 to talk about the supporter of today's deep dive safe server. 33 00:01:14,160 --> 00:01:16,360 Because just like we take the routing of our email 34 00:01:16,360 --> 00:01:18,280 for granted, a lot of organizations 35 00:01:18,280 --> 00:01:21,560 take their expensive proprietary software for granted. 36 00:01:21,560 --> 00:01:22,480 Oh, definitely. 37 00:01:22,480 --> 00:01:24,960 They just accept the massive licensing fees 38 00:01:24,960 --> 00:01:27,800 for things like Microsoft Exchange or Google Workspace 39 00:01:27,800 --> 00:01:31,220 as an unavoidable cost of doing business. 40 00:01:31,220 --> 00:01:31,720 Right. 41 00:01:31,720 --> 00:01:33,360 But safe server steps in and says, 42 00:01:33,360 --> 00:01:35,760 you actually have much better options. 43 00:01:35,760 --> 00:01:38,720 They help organizations replace those expensive proprietary 44 00:01:38,720 --> 00:01:42,320 email and workspace tools with incredibly powerful open source 45 00:01:42,320 --> 00:01:43,000 solutions. 46 00:01:43,000 --> 00:01:45,240 And we are talking massive cost savings here. 47 00:01:45,240 --> 00:01:46,240 Huge savings. 48 00:01:46,240 --> 00:01:49,640 But beyond the budget, it really comes down to data sovereignty. 49 00:01:49,640 --> 00:01:51,480 If your business or association deals 50 00:01:51,480 --> 00:01:54,760 with legal, regulatory, or compliance requirements, 51 00:01:54,760 --> 00:01:58,640 think strict email retention policies, data protection laws, 52 00:01:58,640 --> 00:02:01,640 financial records, or rock solid audit trails, 53 00:02:01,640 --> 00:02:04,200 you cannot afford to lose control of your information. 54 00:02:04,200 --> 00:02:06,300 You need to know exactly where your data lives 55 00:02:06,300 --> 00:02:07,800 and who holds the keys. 56 00:02:07,800 --> 00:02:08,880 Exactly. 57 00:02:08,880 --> 00:02:11,760 And safe server guides you from the very first consulting 58 00:02:11,760 --> 00:02:14,020 meeting all the way through to full operation 59 00:02:14,020 --> 00:02:16,920 on highly secure German servers. 60 00:02:16,920 --> 00:02:20,160 So to take back control of your digital infrastructure, 61 00:02:20,160 --> 00:02:25,960 head over to safeserver.de, that's www.safeserver.de. 62 00:02:25,960 --> 00:02:28,160 Taking control of the underlying infrastructure 63 00:02:28,160 --> 00:02:30,320 is exactly what we are dissecting today. 64 00:02:30,320 --> 00:02:32,600 Yes, welcome to the deep dive. 65 00:02:32,600 --> 00:02:34,560 Today we are exploring a piece of software 66 00:02:34,560 --> 00:02:36,360 that practically runs the internet, 67 00:02:36,360 --> 00:02:38,160 even if you've never heard its name. 68 00:02:38,160 --> 00:02:40,480 It's called the Exum Internet Mailer. 69 00:02:40,480 --> 00:02:42,200 It's a true hidden giant. 70 00:02:42,200 --> 00:02:43,080 It really is. 71 00:02:43,080 --> 00:02:44,960 And we've got a fascinating stack of sources 72 00:02:44,960 --> 00:02:48,160 today pulling directly from Exum's official website 73 00:02:48,160 --> 00:02:50,240 and their master source code repository. 74 00:02:50,240 --> 00:02:51,400 There's a lot to unpack there. 75 00:02:51,400 --> 00:02:52,400 Definitely. 76 00:02:52,400 --> 00:02:53,880 Our mission for this deep dive is 77 00:02:53,880 --> 00:02:55,880 to give you, especially if you're a beginner, 78 00:02:55,880 --> 00:02:58,500 the network architecture a clear, easy entry 79 00:02:58,500 --> 00:03:00,720 point into what this foundational piece of software 80 00:03:00,720 --> 00:03:02,880 is, how it actually works under the hood, 81 00:03:02,880 --> 00:03:05,480 and why it just recently made a massive rebellious shift 82 00:03:05,480 --> 00:03:06,360 in how it's developed. 83 00:03:06,360 --> 00:03:08,440 So to understand what Exum is, we first 84 00:03:08,440 --> 00:03:10,720 have to separate the program you use to write your email 85 00:03:10,720 --> 00:03:12,440 from the program that actually moves it. 86 00:03:12,440 --> 00:03:14,120 Right, the front end versus the back end. 87 00:03:14,120 --> 00:03:15,440 Exactly. 88 00:03:15,440 --> 00:03:19,480 The software on your phone or laptop, like Apple Mail 89 00:03:19,480 --> 00:03:23,880 or Outlook, that's called a Mail User Agent, or MUA. 90 00:03:23,880 --> 00:03:26,760 But Exum operates a layer deeper. 91 00:03:26,760 --> 00:03:31,960 The documentation defines Exum as a message transfer agent, 92 00:03:31,960 --> 00:03:33,380 or an MTA. 93 00:03:33,380 --> 00:03:35,880 It was originally developed at the University of Cambridge 94 00:03:35,880 --> 00:03:38,440 for use on Unix systems connected to the internet. 95 00:03:38,440 --> 00:03:40,600 So let me put a picture to this for you. 96 00:03:40,600 --> 00:03:44,120 Think of Exum as a massive digital postal sorting 97 00:03:44,120 --> 00:03:44,640 facility. 98 00:03:44,640 --> 00:03:45,840 OK, I like that analogy. 99 00:03:45,840 --> 00:03:47,720 Right, it doesn't write the letters for you. 100 00:03:47,720 --> 00:03:49,800 It certainly doesn't read them out loud to you. 101 00:03:49,800 --> 00:03:51,880 It's the invisible infrastructure. 102 00:03:51,880 --> 00:03:54,200 Yeah, you drop your envelope in the blue mailbox, 103 00:03:54,200 --> 00:03:56,120 and Exum is the facility that takes over. 104 00:03:56,120 --> 00:03:57,880 Exactly, it looks at the zip code, 105 00:03:57,880 --> 00:04:00,760 figures out if the package needs to go by truck or by plane, 106 00:04:00,760 --> 00:04:02,300 checks to make sure the envelope isn't 107 00:04:02,300 --> 00:04:04,960 leaking any hazardous materials, and routes it 108 00:04:04,960 --> 00:04:07,640 to the exact right local post office. 109 00:04:07,640 --> 00:04:10,760 That is the perfect way to visualize the logistics layer. 110 00:04:10,760 --> 00:04:13,480 You know, when Exum was created, there was another famous tool 111 00:04:13,480 --> 00:04:15,200 doing this job called SendMail. 112 00:04:15,200 --> 00:04:17,400 Right, SendMail was the big one back in the day. 113 00:04:17,400 --> 00:04:19,860 SendMail was the dominant force, yeah. 114 00:04:19,860 --> 00:04:22,440 But it was notoriously difficult to configure, 115 00:04:22,440 --> 00:04:24,840 so Exum was designed so it could be 116 00:04:24,840 --> 00:04:26,840 installed in place of SendMail. 117 00:04:26,840 --> 00:04:28,520 Ah, a drop-in replacement. 118 00:04:28,520 --> 00:04:29,440 Exactly. 119 00:04:29,440 --> 00:04:32,220 The documentation notes it's similar in style 120 00:04:32,220 --> 00:04:34,640 to an even older mailer called Smail3, 121 00:04:34,640 --> 00:04:36,600 but vastly more general. 122 00:04:36,600 --> 00:04:38,960 And the reason Exum became such a cornerstone 123 00:04:38,960 --> 00:04:42,240 of internet communication is its flexibility. 124 00:04:42,240 --> 00:04:44,080 Because it can handle complex routing. 125 00:04:44,080 --> 00:04:44,760 Yes. 126 00:04:44,760 --> 00:04:47,360 It offers incredibly flexible routing capabilities 127 00:04:47,360 --> 00:04:49,920 and extensive facilities for checking incoming mail. 128 00:04:49,920 --> 00:04:54,360 And given the sheer volume of spam, fishing attempts, 129 00:04:54,360 --> 00:04:56,880 and malicious traffic on the internet today, 130 00:04:56,880 --> 00:04:59,720 those incoming checks are totally non-negotiable. 131 00:04:59,720 --> 00:05:00,560 Oh, absolutely. 132 00:05:00,560 --> 00:05:02,920 You essentially need a highly-trained bouncer 133 00:05:02,920 --> 00:05:04,920 at the loading dock of your sorting facility. 134 00:05:04,920 --> 00:05:07,920 And the best part is this bouncer is completely free. 135 00:05:07,920 --> 00:05:11,040 Exum is available under the GNU general public license. 136 00:05:11,040 --> 00:05:13,320 Which is a huge deal in the open source world. 137 00:05:13,320 --> 00:05:13,840 It is. 138 00:05:13,840 --> 00:05:15,840 That specific license is important, 139 00:05:15,840 --> 00:05:18,360 because it doesn't just mean the software is free of charge. 140 00:05:18,360 --> 00:05:20,640 It means the source can is completely open, 141 00:05:20,640 --> 00:05:24,000 and anyone is legally guaranteed the right to study it, modify it, 142 00:05:24,000 --> 00:05:24,960 and distribute it. 143 00:05:24,960 --> 00:05:27,620 So anyone can look at the blueprints of the sorting 144 00:05:27,620 --> 00:05:28,280 facility. 145 00:05:28,280 --> 00:05:29,400 Exactly. 146 00:05:29,400 --> 00:05:31,840 And for anyone who really wants to get into the weeds 147 00:05:31,840 --> 00:05:35,280 and master how it all connects, the original author, Philip 148 00:05:35,280 --> 00:05:37,520 Hazel, actually wrote a definitive book called 149 00:05:37,520 --> 00:05:40,400 The Exum SMTP Mail Server. 150 00:05:40,400 --> 00:05:43,200 But the sources do make a very clear recommendation 151 00:05:43,200 --> 00:05:44,560 for the average user, right? 152 00:05:44,560 --> 00:05:45,240 They do. 153 00:05:45,240 --> 00:05:49,320 If you are running a standard Linux or Unix system, 154 00:05:49,320 --> 00:05:51,080 you shouldn't try to download the raw code 155 00:05:51,080 --> 00:05:53,480 and build this thing from scratch like a giant Lego set. 156 00:05:53,480 --> 00:05:54,960 No, definitely not. 157 00:05:54,960 --> 00:05:57,480 Unless you have highly specialized requirements, 158 00:05:57,480 --> 00:06:00,680 they strongly advise using the prepackaged versions provided 159 00:06:00,680 --> 00:06:01,880 by your operating system. 160 00:06:01,880 --> 00:06:03,640 Yeah, let the package maintainers 161 00:06:03,640 --> 00:06:04,920 do the heavy lifting. 162 00:06:04,920 --> 00:06:07,680 I mean, compiling raw code into a functioning program 163 00:06:07,680 --> 00:06:10,080 requires configuring it for the exact quirks 164 00:06:10,080 --> 00:06:11,880 of your hardware and operating system. 165 00:06:11,880 --> 00:06:12,960 Which sounds like a headache. 166 00:06:12,960 --> 00:06:13,680 It is. 167 00:06:13,680 --> 00:06:15,880 The volunteers who maintain Linux distributions 168 00:06:15,880 --> 00:06:18,120 have already done that tuning for you. 169 00:06:18,120 --> 00:06:19,800 And when we look under the hood of Exum, 170 00:06:19,800 --> 00:06:22,380 you begin to understand why compiling and testing 171 00:06:22,380 --> 00:06:24,840 this software is such a monumental task. 172 00:06:24,840 --> 00:06:27,560 The scale of the project is just staggering. 173 00:06:27,560 --> 00:06:29,760 When you look at their source repository, 174 00:06:29,760 --> 00:06:33,700 there are 6,890 commits. 175 00:06:33,700 --> 00:06:35,720 That's a massive history of updates. 176 00:06:35,720 --> 00:06:39,520 Yeah, commit is basically a logged individual update 177 00:06:39,520 --> 00:06:43,720 or fixed to the code over time, almost 7,000 of those. 178 00:06:43,720 --> 00:06:46,120 But looking at the stats for how this is built, 179 00:06:46,120 --> 00:06:48,200 I have to stop you and push back on something. 180 00:06:48,200 --> 00:06:49,040 OK, what is it? 181 00:06:49,040 --> 00:06:51,240 We are talking about the backbone of internet 182 00:06:51,240 --> 00:06:52,080 communication, right? 183 00:06:52,080 --> 00:06:52,840 Right. 184 00:06:52,840 --> 00:06:55,120 And the code base is overwhelmingly written 185 00:06:55,120 --> 00:06:57,000 in the C programming language. 186 00:06:57,000 --> 00:06:59,480 Like, 92.3% of it is C. 187 00:06:59,480 --> 00:07:01,200 Yeah, it's heavily reliant on C. 188 00:07:01,200 --> 00:07:05,920 The rest is a mix, 4.4% Perl, 1.9% Shell, 189 00:07:05,920 --> 00:07:09,240 and a tiny 0.4% fraction of Elixir. 190 00:07:09,240 --> 00:07:12,360 But 92% C, that is a language from the 1970s. 191 00:07:12,360 --> 00:07:13,920 It is an older language, yes. 192 00:07:13,920 --> 00:07:16,040 And it requires the programmer to manually manage 193 00:07:16,040 --> 00:07:17,520 computer memory. 194 00:07:17,520 --> 00:07:20,820 Manual memory management is where so many catastrophic software 195 00:07:20,820 --> 00:07:22,200 bugs come from. 196 00:07:22,200 --> 00:07:24,480 So why hold on to this ancient architecture? 197 00:07:24,480 --> 00:07:25,600 It's a fair question. 198 00:07:25,600 --> 00:07:27,960 Why wouldn't a community-driven project 199 00:07:27,960 --> 00:07:31,360 just rewrite it in a safer, modern language like Rust? 200 00:07:31,360 --> 00:07:34,240 Well, that is the ultimate debate in system-level 201 00:07:34,240 --> 00:07:35,280 programming right now. 202 00:07:35,280 --> 00:07:37,240 Why stick with C? 203 00:07:37,240 --> 00:07:40,400 For one, you are dealing with a project that has been actively 204 00:07:40,400 --> 00:07:42,360 developed for decades. 205 00:07:42,360 --> 00:07:45,920 Rewriting millions of lines of foundational, tested logic 206 00:07:45,920 --> 00:07:48,540 from scratch is just an operational nightmare. 207 00:07:48,540 --> 00:07:49,880 OK, so it's a momentum thing. 208 00:07:49,880 --> 00:07:50,640 Partly. 209 00:07:50,640 --> 00:07:53,740 But more importantly, C is incredibly fast. 210 00:07:53,740 --> 00:07:56,560 It operates very close to the hardware at what developers 211 00:07:56,560 --> 00:07:57,880 call bare metal. 212 00:07:57,880 --> 00:08:01,040 When your server is processing millions of emails an hour, 213 00:08:01,040 --> 00:08:02,760 tearing apart headers, checking them 214 00:08:02,760 --> 00:08:05,200 against global blacklists, and routing them 215 00:08:05,200 --> 00:08:07,880 down different network pipes, you cannot afford software 216 00:08:07,880 --> 00:08:09,200 bloat or translation layer. 217 00:08:09,200 --> 00:08:10,560 This just need pure speed. 218 00:08:10,560 --> 00:08:11,320 Exactly. 219 00:08:11,320 --> 00:08:14,840 You need raw, high-performance, low-level system interactions. 220 00:08:14,840 --> 00:08:17,460 Still, requiring volunteer programmers 221 00:08:17,460 --> 00:08:19,760 to manually allocate and free up memory 222 00:08:19,760 --> 00:08:22,520 for every single operation feels like walking 223 00:08:22,520 --> 00:08:23,840 a tightrope without a net. 224 00:08:23,840 --> 00:08:24,680 It can be risky, yeah. 225 00:08:24,680 --> 00:08:27,120 I mean, one wrong step, one forgotten line of code, 226 00:08:27,120 --> 00:08:28,680 and the program crashes. 227 00:08:28,680 --> 00:08:31,460 Or worse, it creates a massive security hole. 228 00:08:31,460 --> 00:08:35,000 Which brings us to how a project like this actually survives. 229 00:08:35,000 --> 00:08:38,760 Rigorous, continuous, automated testing. 230 00:08:38,760 --> 00:08:39,600 Ah, okay. 231 00:08:39,600 --> 00:08:41,680 You mentioned the other languages in the repository, 232 00:08:41,680 --> 00:08:44,440 the Perl, the Shell scripts, the Elixir. 233 00:08:44,440 --> 00:08:47,580 While C handles the heavy lifting of routing the mail, 234 00:08:47,580 --> 00:08:49,360 those other languages are largely used 235 00:08:49,360 --> 00:08:50,880 for scripting, tooling, 236 00:08:50,880 --> 00:08:52,920 and running the testing infrastructure. 237 00:08:52,920 --> 00:08:55,620 But a community project doesn't have a corporate mega-budget 238 00:08:55,620 --> 00:08:57,880 to buy warehouses full of servers 239 00:08:57,880 --> 00:08:59,080 for all this testing, right? 240 00:08:59,080 --> 00:09:00,120 No, they don't. 241 00:09:00,120 --> 00:09:02,040 They rely on organizational sponsors, 242 00:09:02,040 --> 00:09:03,920 and the sources explicitly highlight them. 243 00:09:03,920 --> 00:09:05,840 Yeah, a company called Mythic Beasts 244 00:09:05,840 --> 00:09:07,720 provides a virtual machine, 245 00:09:07,720 --> 00:09:10,440 which is essentially a simulated computer 246 00:09:10,440 --> 00:09:12,400 running on a larger server, 247 00:09:12,400 --> 00:09:15,480 specifically for their test suite build farm. 248 00:09:15,480 --> 00:09:17,960 Right, and a build farm is exactly what it sounds like. 249 00:09:17,960 --> 00:09:19,280 It's a dedicated environment 250 00:09:19,280 --> 00:09:21,540 whose only job is to automatically download 251 00:09:21,540 --> 00:09:23,840 the latest version of the code, compile it, 252 00:09:23,840 --> 00:09:26,320 and run thousands of simulated emails 253 00:09:26,320 --> 00:09:27,480 and scenarios through it. 254 00:09:27,480 --> 00:09:28,840 Just to see if anything breaks 255 00:09:28,840 --> 00:09:30,240 before it gets released to the public. 256 00:09:30,240 --> 00:09:31,080 Exactly. 257 00:09:31,080 --> 00:09:32,480 They also get help from McStadium, 258 00:09:32,480 --> 00:09:35,120 who provides a Mac mini for their build farm. 259 00:09:35,120 --> 00:09:37,560 And that is a crucial detail. 260 00:09:37,560 --> 00:09:40,720 Testing on a Mac mini ensures the code functions correctly 261 00:09:40,720 --> 00:09:43,380 across Apple specific Unix architecture, 262 00:09:43,380 --> 00:09:45,320 not just standard Linux servers. 263 00:09:45,320 --> 00:09:46,880 You need to know the code works everywhere. 264 00:09:46,880 --> 00:09:47,960 You do. 265 00:09:47,960 --> 00:09:50,360 Furthermore, an organization called Schlitterman 266 00:09:50,360 --> 00:09:52,240 handles the hosting and administration 267 00:09:52,240 --> 00:09:55,640 of the entire Exum.org infrastructure. 268 00:09:55,640 --> 00:09:57,720 And Mike Cardwell designed the website. 269 00:09:57,720 --> 00:09:58,560 Right. 270 00:09:58,560 --> 00:10:00,320 It really takes a village to run the internet. 271 00:10:00,320 --> 00:10:02,560 You have these separate independent companies 272 00:10:02,560 --> 00:10:05,680 donating server power and hardware 273 00:10:05,680 --> 00:10:08,720 just so the Exum developers can constantly run their code 274 00:10:08,720 --> 00:10:09,760 through the ringer. 275 00:10:09,760 --> 00:10:13,520 They have to be absolutely certain that 92% C code base 276 00:10:13,520 --> 00:10:16,280 doesn't have a typo that breaks global email. 277 00:10:16,280 --> 00:10:18,200 Because when a typo or a logic error 278 00:10:18,200 --> 00:10:21,880 does slip into a C program that sits on the open internet, 279 00:10:21,880 --> 00:10:23,840 the consequences are immediate and severe. 280 00:10:23,840 --> 00:10:24,600 Very severe. 281 00:10:24,600 --> 00:10:26,800 Which leads directly into the security documentation 282 00:10:26,800 --> 00:10:29,880 we reviewed and the very real danger of obsolescence. 283 00:10:29,880 --> 00:10:31,320 Yes, this is critical. 284 00:10:31,320 --> 00:10:33,840 According to the official site, the current version of XM 285 00:10:33,840 --> 00:10:36,200 is 4.99.1. 286 00:10:36,200 --> 00:10:38,160 And this isn't a fun feature update 287 00:10:38,160 --> 00:10:39,240 with a fresh coat of paint. 288 00:10:39,240 --> 00:10:39,960 No, not at all. 289 00:10:39,960 --> 00:10:41,880 This is a strict security release. 290 00:10:41,880 --> 00:10:44,800 The release notes are highly specific about this. 291 00:10:44,800 --> 00:10:48,440 Version 4.99.1 was pushed out to address 292 00:10:48,440 --> 00:10:50,960 what is called a remote heap corruption vulnerability. 293 00:10:50,960 --> 00:10:51,440 Blikes. 294 00:10:51,440 --> 00:10:52,040 Yeah. 295 00:10:52,040 --> 00:10:53,880 The official tracking designation for this 296 00:10:53,880 --> 00:11:02,760 is CVE 202567896 or internally as XM security 202512-09.1. 297 00:11:02,760 --> 00:11:05,960 OK, remote heap corruption sounds highly technical. 298 00:11:05,960 --> 00:11:08,120 If we go back to our sorting facility analogy, 299 00:11:08,120 --> 00:11:10,080 how does this actually compromise the system? 300 00:11:10,080 --> 00:11:12,480 Well, the heap is the massive warehouse floor 301 00:11:12,480 --> 00:11:15,080 where workers temporarily place packages while they 302 00:11:15,080 --> 00:11:16,200 figure out where they go. 303 00:11:16,200 --> 00:11:17,680 OK, temporary storage. 304 00:11:17,680 --> 00:11:18,680 Exactly. 305 00:11:18,680 --> 00:11:21,160 In a C program, the heap is a pool of memory 306 00:11:21,160 --> 00:11:23,840 used for dynamic temporary storage. 307 00:11:23,840 --> 00:11:26,520 A remote vulnerability means a bad actor somewhere out 308 00:11:26,520 --> 00:11:28,400 on the internet can trigger this without needing 309 00:11:28,400 --> 00:11:30,120 a password or internal access. 310 00:11:30,120 --> 00:11:30,620 Wow. 311 00:11:30,620 --> 00:11:32,920 So they're just sending a bad package into the facility. 312 00:11:32,920 --> 00:11:33,420 Right. 313 00:11:33,420 --> 00:11:35,880 Imagine a bad actor sending a package through your facility. 314 00:11:35,880 --> 00:11:37,720 But instead of writing a normal destination, 315 00:11:37,720 --> 00:11:40,040 they write an address that is so overwhelmingly long, 316 00:11:40,040 --> 00:11:42,480 it physically spills off the edges of the envelope. 317 00:11:42,480 --> 00:11:43,200 Oh, I see. 318 00:11:43,200 --> 00:11:46,800 It spills over and literally covers the digital instruction 319 00:11:46,800 --> 00:11:49,280 manual of the sorting machine itself. 320 00:11:49,280 --> 00:11:51,440 Because the programmer didn't set a hard limit 321 00:11:51,440 --> 00:11:53,360 on how long that address could be in the memory. 322 00:11:53,360 --> 00:11:56,880 Exactly, that manual memory management issue we discussed. 323 00:11:56,880 --> 00:11:58,560 The machine gets confused. 324 00:11:58,560 --> 00:12:01,800 When the machine tries to read its next operational command, 325 00:12:01,800 --> 00:12:03,920 it's actually reading the malicious text 326 00:12:03,920 --> 00:12:05,880 the attacker wrote in the address line. 327 00:12:05,880 --> 00:12:06,800 That is wild. 328 00:12:06,800 --> 00:12:09,120 So they are tricking the mail server 329 00:12:09,120 --> 00:12:12,760 into running malicious code instead of just routing emails. 330 00:12:12,760 --> 00:12:13,480 Yes. 331 00:12:13,480 --> 00:12:15,640 They could potentially take over the entire program. 332 00:12:15,640 --> 00:12:17,360 It is one of the most critical types 333 00:12:17,360 --> 00:12:20,760 of vulnerabilities a network facing service can have. 334 00:12:20,760 --> 00:12:22,660 Once they control the sorting machine, 335 00:12:22,660 --> 00:12:24,960 they can intercept mail, use your server 336 00:12:24,960 --> 00:12:27,880 to blast out millions of spam messages, 337 00:12:27,880 --> 00:12:29,720 or pivot further into your network. 338 00:12:29,720 --> 00:12:31,880 And the Exim project takes an incredibly hard line 339 00:12:31,880 --> 00:12:33,160 on this in their documentation. 340 00:12:33,160 --> 00:12:34,060 They do. 341 00:12:34,060 --> 00:12:39,000 The sources state that all versions prior to 4.99.1 342 00:12:39,000 --> 00:12:41,800 are now completely obsolete, period. 343 00:12:41,800 --> 00:12:44,800 They even specifically call out the old 3.x releases, 344 00:12:44,800 --> 00:12:47,620 the last of which was 3.36. 345 00:12:47,620 --> 00:12:51,320 They point out the version 3.36 is 20 years obsolete 346 00:12:51,320 --> 00:12:53,760 and should absolutely not be used. 347 00:12:53,760 --> 00:12:57,360 It is rare to see official documentation be that blunt. 348 00:12:57,360 --> 00:12:59,880 Usually software developers use softer language 349 00:12:59,880 --> 00:13:02,000 like unsupported or deprecated. 350 00:13:02,000 --> 00:13:03,640 Right, they try to be polite about it. 351 00:13:03,640 --> 00:13:04,320 Exactly. 352 00:13:04,320 --> 00:13:08,760 But calling it 20 years obsolete is a blaring warning siren. 353 00:13:08,760 --> 00:13:11,840 If you are running version 3.36 today, 354 00:13:11,840 --> 00:13:13,440 you aren't just out of date. 355 00:13:13,440 --> 00:13:16,680 You are actively inviting attackers into your network. 356 00:13:16,680 --> 00:13:18,760 And this brings up the core responsibility 357 00:13:18,760 --> 00:13:20,880 of running internet infrastructure. 358 00:13:20,880 --> 00:13:23,240 The EXIM developers offer maintenance releases 359 00:13:23,240 --> 00:13:25,000 primarily for those package maintainers 360 00:13:25,000 --> 00:13:26,120 we mentioned earlier. 361 00:13:26,120 --> 00:13:29,360 And they offer beta versions and a specific testing directory 362 00:13:29,360 --> 00:13:32,120 for administrators willing to test unreleased code 363 00:13:32,120 --> 00:13:33,480 at their own risk. 364 00:13:33,480 --> 00:13:36,000 But the developers cannot force you to update your server. 365 00:13:36,000 --> 00:13:38,800 They can't just remotely push a patch to your specific machine. 366 00:13:38,800 --> 00:13:39,480 No. 367 00:13:39,480 --> 00:13:41,760 If you set up an EXIM server five years ago, 368 00:13:41,760 --> 00:13:43,600 got it working, and just forgot about it. 369 00:13:43,600 --> 00:13:44,920 You are a sitting duck. 370 00:13:44,920 --> 00:13:47,320 You are a danger to your own organization 371 00:13:47,320 --> 00:13:49,280 and honestly to the rest of the network 372 00:13:49,280 --> 00:13:51,120 if your server gets hijacked. 373 00:13:51,120 --> 00:13:53,840 The hard line on obsolescence is a cultural marker. 374 00:13:53,840 --> 00:13:54,520 How so? 375 00:13:54,520 --> 00:13:56,600 It's the project declaring that they provide 376 00:13:56,600 --> 00:13:59,280 this incredibly powerful tool for free, 377 00:13:59,280 --> 00:14:02,440 but the cost of entry is your constant vigilance. 378 00:14:02,440 --> 00:14:03,220 I love that. 379 00:14:03,220 --> 00:14:05,760 And that strong sense of culture, boundary setting, 380 00:14:05,760 --> 00:14:08,800 and responsibility perfectly contextualizes 381 00:14:08,800 --> 00:14:11,520 the biggest piece of news we found in the source repository. 382 00:14:11,520 --> 00:14:12,360 The migration. 383 00:14:12,360 --> 00:14:13,640 Exactly. 384 00:14:13,640 --> 00:14:16,520 When you understand how fiercely independent this team 385 00:14:16,520 --> 00:14:19,040 has to be to maintain the software, 386 00:14:19,040 --> 00:14:21,720 their recent migration makes perfect sense. 387 00:14:21,720 --> 00:14:24,120 The Exum project is undertaking a massive move 388 00:14:24,120 --> 00:14:26,320 to gain total independence from big tech. 389 00:14:26,320 --> 00:14:27,880 And this is a profound shift that 390 00:14:27,880 --> 00:14:30,000 reflects a growing movement in how open source 391 00:14:30,000 --> 00:14:31,240 projects operate today. 392 00:14:31,240 --> 00:14:31,720 OK. 393 00:14:31,720 --> 00:14:33,920 So here are the facts directly from the repository's 394 00:14:33,920 --> 00:14:35,560 RiaDME file. 395 00:14:35,560 --> 00:14:39,040 As of December 26, 2025, the Exum project 396 00:14:39,040 --> 00:14:40,400 officially stopped using GitHub. 397 00:14:40,400 --> 00:14:41,400 Which is huge. 398 00:14:41,400 --> 00:14:43,000 They are no longer pushing any updates 399 00:14:43,000 --> 00:14:45,680 to the world's most popular code hosting platform. 400 00:14:45,680 --> 00:14:48,600 Instead, the master repository is now entirely 401 00:14:48,600 --> 00:14:49,360 self-hosted. 402 00:14:49,360 --> 00:14:50,960 Taking it all in-house. 403 00:14:50,960 --> 00:14:52,140 Yeah. 404 00:14:52,140 --> 00:14:53,760 It's running on their own instance 405 00:14:53,760 --> 00:14:58,240 of a platform called Forgejo, located at code.exum.org. 406 00:14:58,240 --> 00:15:00,920 You know, to understand the magnitude of this decision, 407 00:15:00,920 --> 00:15:02,680 you have to look at the landscape of software 408 00:15:02,680 --> 00:15:03,640 development. 409 00:15:03,640 --> 00:15:06,560 For the last decade, GitHub, which is owned by Microsoft, 410 00:15:06,560 --> 00:15:08,800 has been the absolute center of gravity 411 00:15:08,800 --> 00:15:10,500 for open source software. 412 00:15:10,500 --> 00:15:13,840 It's where almost everyone collaborates, tracks issues, 413 00:15:13,840 --> 00:15:14,960 and publishes code. 414 00:15:14,960 --> 00:15:17,600 I mean, when GitHub goes down, half the internet's 415 00:15:17,600 --> 00:15:19,120 developers suddenly can't work. 416 00:15:19,120 --> 00:15:20,080 Exactly. 417 00:15:20,080 --> 00:15:22,340 Leaving GitHub is not a casual decision. 418 00:15:22,340 --> 00:15:25,520 It is an enormous operational burden. 419 00:15:25,520 --> 00:15:26,960 So what is Forgeo, then? 420 00:15:26,960 --> 00:15:30,420 Forgeo is a lightweight, community-managed software 421 00:15:30,420 --> 00:15:31,360 forge. 422 00:15:31,360 --> 00:15:34,440 It does what GitHub does, hosting code, tracking changes, 423 00:15:34,440 --> 00:15:35,840 managing collaboration. 424 00:15:35,840 --> 00:15:37,800 But you can install it on your own server. 425 00:15:37,800 --> 00:15:41,800 So Exum's is taking the entire postal service infrastructure 426 00:15:41,800 --> 00:15:43,880 and moving it out of the corporate landlord's building 427 00:15:43,880 --> 00:15:46,160 into a facility they own themselves. 428 00:15:46,160 --> 00:15:47,280 That's exactly it. 429 00:15:47,280 --> 00:15:49,440 And if we connect this to the ethos of open source 430 00:15:49,440 --> 00:15:51,800 that we've been discussing, the GNU license, 431 00:15:51,800 --> 00:15:54,360 the volunteer community, the donated hardware 432 00:15:54,360 --> 00:15:56,520 for the build farm, it aligns perfectly. 433 00:15:56,520 --> 00:15:57,960 It's all about independence. 434 00:15:57,960 --> 00:15:58,600 Right. 435 00:15:58,600 --> 00:16:02,320 When you rely on a centralized, corporate-owned platform 436 00:16:02,320 --> 00:16:04,960 to host your code, you are fundamentally 437 00:16:04,960 --> 00:16:06,600 renting your digital home. 438 00:16:06,600 --> 00:16:08,760 You are subject to their changing terms of service, 439 00:16:08,760 --> 00:16:12,440 their algorithms, their AI data-scraping policies, 440 00:16:12,440 --> 00:16:13,880 and their potential downtime. 441 00:16:13,880 --> 00:16:15,920 For a project that literally acts 442 00:16:15,920 --> 00:16:17,880 as the foundational infrastructure 443 00:16:17,880 --> 00:16:20,360 of the open internet, being beholden 444 00:16:20,360 --> 00:16:24,160 to a single corporate entity is a massive vulnerability. 445 00:16:24,160 --> 00:16:25,320 It's a huge risk. 446 00:16:25,320 --> 00:16:27,640 They are treating reliance on Microsoft's GitHub 447 00:16:27,640 --> 00:16:30,440 the same way they treat a memory leak in their C code 448 00:16:30,440 --> 00:16:32,320 as a risk that needs to be mitigated. 449 00:16:32,320 --> 00:16:35,320 Total sovereignty over the tools that build the tool. 450 00:16:35,320 --> 00:16:37,240 By hosting their own code on Fortjose, 451 00:16:37,240 --> 00:16:39,720 they guarantee that no corporate entity can ever 452 00:16:39,720 --> 00:16:41,280 pull the plug on their repository 453 00:16:41,280 --> 00:16:42,840 or change the rules of access. 454 00:16:42,840 --> 00:16:43,680 Wow. 455 00:16:43,680 --> 00:16:45,560 Furthermore, the documentation outlines 456 00:16:45,560 --> 00:16:48,480 their entire decentralized workflow. 457 00:16:48,480 --> 00:16:50,360 Their bug tracking is currently handled 458 00:16:50,360 --> 00:16:53,360 through an independent instance of a tool called Bugzilla 459 00:16:53,360 --> 00:16:56,200 located at bugs.exim.org. 460 00:16:56,200 --> 00:16:58,040 Though the notes mentioned they will soon migrate 461 00:16:58,040 --> 00:17:00,080 that bug tracking directly into the new 462 00:17:00,080 --> 00:17:02,760 for JoJo repositories issues section, right? 463 00:17:02,760 --> 00:17:04,920 To centralize everything in their own system. 464 00:17:04,920 --> 00:17:05,800 And they aren't relying 465 00:17:05,800 --> 00:17:08,040 on corporate communication tools either. 466 00:17:08,040 --> 00:17:10,920 They aren't setting up a slap workspace or a discord server. 467 00:17:10,920 --> 00:17:11,820 No, not at all. 468 00:17:11,820 --> 00:17:13,720 Development discussions happen the old fashioned 469 00:17:13,720 --> 00:17:17,780 decentralized way on the EximDev mailing list. 470 00:17:17,780 --> 00:17:20,000 General help and community troubleshooting 471 00:17:20,000 --> 00:17:21,960 happen on the Exim user's mailing list. 472 00:17:21,960 --> 00:17:24,280 They're using email to build email. 473 00:17:24,280 --> 00:17:26,560 Right, it is a complete ecosystem 474 00:17:26,560 --> 00:17:29,600 built on the very email protocols they champion. 475 00:17:29,600 --> 00:17:31,600 They are literally eating their own cooking. 476 00:17:31,600 --> 00:17:34,860 It is a strong statement that the open web is still viable. 477 00:17:34,860 --> 00:17:36,860 You don't have to surrender your workflow, 478 00:17:36,860 --> 00:17:39,760 your data or your community to a tech giant 479 00:17:39,760 --> 00:17:41,600 just for the sake of convenience. 480 00:17:41,600 --> 00:17:43,480 But it takes a staggering amount of work 481 00:17:43,480 --> 00:17:45,160 to pack up your digital house 482 00:17:45,160 --> 00:17:48,280 and move your entire community to a self-hosted platform. 483 00:17:48,280 --> 00:17:50,200 It's exhausting just thinking about it. 484 00:17:50,200 --> 00:17:51,560 But the freedom on the other side 485 00:17:51,560 --> 00:17:54,000 is clearly worth it to this team. 486 00:17:54,000 --> 00:17:56,240 And this brings us to a crucial realization 487 00:17:56,240 --> 00:17:57,880 about the internet as a whole. 488 00:17:57,880 --> 00:18:00,200 We assume the internet just works. 489 00:18:00,200 --> 00:18:03,000 We assume emails arrive, websites load 490 00:18:03,000 --> 00:18:04,700 and data routes correctly. 491 00:18:04,700 --> 00:18:05,920 But it's actually held together 492 00:18:05,920 --> 00:18:08,400 by incredibly dedicated communities 493 00:18:08,400 --> 00:18:11,040 writing complex code and running test farms 494 00:18:11,040 --> 00:18:12,160 on donated servers. 495 00:18:12,160 --> 00:18:15,120 Exactly. Exim's move to self-host on Forgeo 496 00:18:15,120 --> 00:18:17,300 guarantees their independence for now. 497 00:18:17,300 --> 00:18:20,520 But it does introduce a new provocative question 498 00:18:20,520 --> 00:18:23,080 that every foundational open source project 499 00:18:23,080 --> 00:18:24,560 will eventually have to face. 500 00:18:24,560 --> 00:18:25,720 The succession problem. 501 00:18:25,720 --> 00:18:26,560 Right. 502 00:18:26,560 --> 00:18:27,520 Break that down for you, Yumi. 503 00:18:27,520 --> 00:18:30,080 What exactly is this succession problem? 504 00:18:30,080 --> 00:18:31,880 Well, consider the demographics. 505 00:18:31,880 --> 00:18:33,700 Many of these foundational protocols 506 00:18:33,700 --> 00:18:35,740 like the mail systems we rely on 507 00:18:35,740 --> 00:18:38,280 were built by volunteers decades ago. 508 00:18:38,280 --> 00:18:40,160 As the original architects and maintainers 509 00:18:40,160 --> 00:18:41,600 age out or retire, 510 00:18:41,600 --> 00:18:44,480 who inherits the keys to the internet's post office? 511 00:18:44,480 --> 00:18:45,540 That's a scary thought. 512 00:18:45,540 --> 00:18:46,720 It really is. 513 00:18:46,720 --> 00:18:48,680 Will the next generation of developers 514 00:18:48,680 --> 00:18:50,940 who are largely trained on modern languages 515 00:18:50,940 --> 00:18:52,960 and centralized corporate platforms 516 00:18:52,960 --> 00:18:55,980 be willing to learn manual memory management in C? 517 00:18:55,980 --> 00:18:58,320 Let alone maintain self-hosted bug trackers. 518 00:18:58,320 --> 00:18:59,360 Exactly. 519 00:18:59,360 --> 00:19:01,560 Achieving digital sovereignty from big tech 520 00:19:01,560 --> 00:19:03,000 is a massive victory today, 521 00:19:03,000 --> 00:19:05,120 but the true test is whether this independent, 522 00:19:05,120 --> 00:19:06,520 volunteer-driven model 523 00:19:06,520 --> 00:19:09,120 can survive a generational handover. 524 00:19:09,120 --> 00:19:11,640 That is a question every organization relying 525 00:19:11,640 --> 00:19:14,160 on digital infrastructure needs to ponder. 526 00:19:14,160 --> 00:19:16,920 Who holds the keys to your systems? 527 00:19:16,920 --> 00:19:19,040 It's the most important question you can ask. 528 00:19:19,040 --> 00:19:22,400 Which, frankly, brings us right back to our sponsor, 529 00:19:22,400 --> 00:19:23,800 Safe Server. 530 00:19:23,800 --> 00:19:26,300 Safe Server is entirely built around solving 531 00:19:26,300 --> 00:19:28,920 that exact problem for your organization. 532 00:19:28,920 --> 00:19:30,940 Because you really don't have to rent space 533 00:19:30,940 --> 00:19:32,320 in a corporate walled garden 534 00:19:32,320 --> 00:19:34,400 and just hope they don't change the rules 535 00:19:34,400 --> 00:19:35,480 or hike the prices. 536 00:19:35,480 --> 00:19:36,400 Exactly. 537 00:19:36,400 --> 00:19:38,440 By switching to open source solutions 538 00:19:38,440 --> 00:19:41,360 implemented by Safe Server, businesses, associations, 539 00:19:41,360 --> 00:19:44,600 and other groups, gain massive cost savings 540 00:19:44,600 --> 00:19:47,760 compared to those expensive proprietary software licenses 541 00:19:47,760 --> 00:19:49,520 from Google or Microsoft. 542 00:19:49,520 --> 00:19:52,640 And beyond the cost, just like the Exum project, 543 00:19:52,640 --> 00:19:54,360 you take back your data sovereignty. 544 00:19:54,360 --> 00:19:55,200 Yes. 545 00:19:55,200 --> 00:19:56,560 You control your infrastructure, 546 00:19:56,560 --> 00:19:59,160 which is vital for compliance, legal audits, 547 00:19:59,160 --> 00:20:00,960 and protecting your communications. 548 00:20:00,960 --> 00:20:02,380 Whether you need a direct replacement 549 00:20:02,380 --> 00:20:03,600 for your workspace tools, 550 00:20:03,600 --> 00:20:05,220 or you just need specialized consulting 551 00:20:05,220 --> 00:20:07,500 to figure out if a comparable alternative 552 00:20:07,500 --> 00:20:10,120 is the right fit for your specific organizational needs, 553 00:20:10,120 --> 00:20:11,720 Safe Server is there to help. 554 00:20:11,720 --> 00:20:13,440 They make the transition manageable. 555 00:20:13,440 --> 00:20:14,580 They really do. 556 00:20:14,580 --> 00:20:16,200 So reclaim your infrastructure 557 00:20:16,200 --> 00:20:19,480 by visiting www.safeserver.de. 558 00:20:19,480 --> 00:20:21,920 It's all about understanding how the machinery works 559 00:20:21,920 --> 00:20:24,920 so you can make it work for your specific needs 560 00:20:24,920 --> 00:20:26,240 on your own terms. 561 00:20:26,240 --> 00:20:27,240 Beautifully said. 562 00:20:27,240 --> 00:20:28,680 So next time you type out an email 563 00:20:28,680 --> 00:20:30,360 and click that send button, 564 00:20:30,360 --> 00:20:33,120 take a second before you assume it's just magic. 565 00:20:33,120 --> 00:20:35,240 Picture that massive digital sorting facility. 566 00:20:35,240 --> 00:20:37,160 Think of the 92% C code. 567 00:20:37,160 --> 00:20:40,760 The rigorous automated testing running on donated Mac minis 568 00:20:40,760 --> 00:20:42,560 and the fiercely independent community 569 00:20:42,560 --> 00:20:45,480 ensuring that your message finds its way through the dark. 570 00:20:45,480 --> 00:20:47,800 The magic isn't in the button you click. 571 00:20:47,800 --> 00:20:50,440 It's in the invisible open source infrastructure 572 00:20:50,440 --> 00:20:51,760 that catches it. 573 00:20:51,760 --> 00:20:53,460 Thanks for joining us on this deep dive. 574 00:20:53,460 --> 00:20:54,760 We'll catch you next time.