[niv]

But the author mentioned qmail, which is an application that was built "secure by design", is non-trivial, and hasn't had many bugs. This is a little paper by the author of qmail: http://cr.yp.to/qmail/qmailsec-20071101.pdf

[Semiapies]

And yet there are still qmail exploits and fixes to those.

Not many people build insecure by design, but the simple truth is that security is both hard and always surmountable in some way.