Wietse Venema: Building TCP Wrapper, SATAN and Postfix

Wietse Venema is a nuclear physicist who got annoyed at a hacker, and the internet has been safer for it ever since.

The tool he wrote to catch that hacker, TCP Wrapper, guarded Unix machines for decades. The scanner he built with Dan Farmer, SATAN, caused a global panic. And the mail server he wrote at IBM, Postfix, has been quietly delivering email since 1998 and still ships a new release most months.

He insists security was never the point. "My interest is with building systems that work," he says, "with building systems that create fewer problems than they solve." It's a modest way to describe one of the most useful careers in computing.

Wietse Venema at a Glance

• Venema earned a PhD in physics at the University of Groningen in 1984 with a thesis on nuclear beta decay, then spent twelve years as a systems architect at Eindhoven University of Technology.
• Around 1990 a Dutch cracker kept breaking into Eindhoven's systems and wiping them. Venema wrote TCP Wrapper to watch, block and trap him. The tool spread worldwide.
• With Dan Farmer he wrote "Improving the Security of Your Site by Breaking Into It" in 1993 and released SATAN, the network scanner that terrified the press, in 1995.
• He moved to IBM's Thomas J. Watson Research Center, where his VMailer was released at the end of 1998 as the IBM Secure Mailer and lived on as Postfix.
• With Farmer he built The Coroner's Toolkit in 2000 and wrote Forensic Discovery in 2004. He chaired FIRST, the global association of incident response teams.
• Richard Stallman handed him the Free Software Foundation's award in 2009; ISSA inducted him into its hall of fame in 2012.
• After 18 years at IBM he joined Google's security team in 2015, retired in 2023, and still maintains Postfix. Release 3.11.7 shipped on September 7, 2026.

The Life of Wietse Venema

Venema's Early Years

Wietse Zweitze Venema studied physics at the University of Groningen in the Netherlands and finished his doctorate in 1984 with a thesis titled "Left-right symmetry in nuclear beta decay," based on experiments at the university's nuclear accelerator institute.

Then he changed careers, as IBM later put it, "and never looked back." He joined the Mathematics and Computing Science department at Eindhoven University of Technology as a systems architect and stayed twelve years, spending part of that time writing tools that translated electronic business documents, software that lives on today inside a commercial product.

Our Pet

In 1992 Venema published a paper whose first section was titled "Our pet." It began: "The story begins about two years ago. Our university was under heavy attack by a Dutch computer cracker who again and again managed to acquire root privilege."

Getting root was only an annoyance. The problem was what the intruder did with it: he "was very skilled at typing the following command sequence: rm -rf /," the Unix incantation that erases everything.

Venema's answer was a small program that sat in front of every network service, logged who was connecting, and could refuse them based on where they came from. He called it TCP Wrapper.

Then he added automatic reverse fingers that looked back at the attacker's machine, and finally "booby traps," hooks that could run any command when a trap was tripped. The logs from January 1991 show connections pouring in from a machine at Stanford, and Venema fingering back to see who was sitting at it.

"Unfortunately, the cracker was never arrested," he wrote. "He should have waited just one year. Instead, the honor was given to two much less harmful Dutch youngsters, at the end of February, 1992."

TCP Wrapper went out over Usenet and was installed on Unix systems worldwide without a single source code change. "Dutch crackers seem to think that the systems at Eindhoven University are reasonably protected," he added.

Breaking In With Farmer

Venema's partner for the next decade was an American with a similar contrarian streak. In 1993 he and Dan Farmer wrote "Improving the Security of Your Site by Breaking Into It," the paper that argued an administrator should attack his own systems before someone else did.

Then they built a program to do it. SATAN, the Security Administrator Tool for Analyzing Networks, scanned a network for weak services and explained each one through a web browser, a novelty in 1995.

Years of anticipation preceded its release in April 1995, and the press reaction was ferocious; Farmer lost his job at Silicon Graphics over it. Venema, from the Netherlands, kept his, and the internet carried on.

Looking back in 2004, he was unsentimental: tools like SATAN "have served their purpose, and now have historical value only." The method they introduced became the vulnerability scanning industry.

Postfix

In the late 1990s Venema crossed the Atlantic to IBM's Thomas J. Watson Research Center in New York, where he'd spend 18 years as a security researcher. His first big project there was a mail server.

Sendmail, the program that moved most of the internet's email, was a notorious source of security holes, and Venema set out to replace it from scratch rather than patch it.

"Why would anyone spend so much time writing yet another UNIX-based mail system, when Sendmail and qmail already existed?" he asked later. Because, he said, neither was what he wanted.

Built from scratch rather than retrofitted, his design split the mailer into a family of small cooperating daemons instead of one all-powerful program.

The software was called VMailer, then released at the end of 1998 as the IBM Secure Mailer, and from then on it's lived on as Postfix. "The outside has a definite Sendmail-ish flavor, but the inside is completely different," the project says. It attempts "to be fast, easy to administer, and secure," and it's been in continuous development ever since.

The Coroner's Toolkit

Farmer and Venema reunited in 2000 for The Coroner's Toolkit, a set of programs for examining a Unix system after a break-in: reconstructing timelines from file access times, recovering deleted data, and reading evidence straight off the disk. It was the first toolkit of its kind, and DFRWS, the field's research conference, still counts Venema among its organizers.

The pair's columns on forensic computing became a book, Forensic Discovery, published in December 2004. Venema also served a two-year term as chair of FIRST, the international association of computer security incident response teams.

Awards for a Man Who Doesn't Care About Security

The honors accumulated: a Security Summit Hall of Fame award in 1998, the SAGE Outstanding Achievement award in 1999, the Dutch NLUUG award in 2000, a Sendmail innovation award in 2006, and an IBM technical accomplishment award in 2007.

In March 2009, at Harvard, Richard Stallman presented him with the Free Software Foundation's Award for the Advancement of Free Software for "significant and wide-ranging technical contributions to network security, and his creation of the Postfix email server." Venema's response was characteristic: "free software presents a tremendous opportunity for individuals and organizations" to contribute. ISSA put him in its hall of fame in October 2012.

He keeps a page listing the awards, with a disclaimer at the top. "The irony of all this," it says, "is that my primary interest is not with computer security at all."

Goodbye IBM, Hello Google

On March 24, 2015, Venema posted to the Postfix users list under the subject "Goodbye IBM, Hello Google." "After 18 years, including the best of my career, I decided that it was time to move on," he wrote. "I'll be working on security at Google NY."

He added a request that nobody say anything negative about his old employer or his new one, and a promise: "Needless to say, I will continue to support Postfix."

He kept it. After eight years at Google he retired, and his home page now describes him as "an Emeritus software engineer/researcher (i.e. retired but still very active)." Postfix 3.11.7 shipped on September 7, 2026, alongside updates to five older release lines, all of them still maintained by the man who started the project at IBM.

He lives in Amawalk, New York, and, weather permitting, he and his wife Annita take weekly breaks to cycle or walk the hills of the Hudson Valley.

Wietse Venema: Systems That Work

Venema never chased a headline, never founded a company and never wrote a manifesto. He wrote programs that did one job carefully and then gave them away, and three of them became infrastructure.

The cracker who kept typing rm -rf / in 1990 did the world a favor. He annoyed the right physicist.

Every email delivered through Postfix tonight is a small, quiet thank-you.