In is terrible that this company bought sendmail:
It is irrelevant. As discussed in this thread, they bought the Sendmail Inc. company that had been owned by Eric and friends. They did not buy the source code, as it can not be bought, being under a freeware license. They are modifying and releasing the source code, and FreeBSD today uses one version of the source code modified by them. More about the license situation below.
Exactly. Ancient news. But not terribly newsworthy.
If a software does strange things may not always be admins' responsibility. There are bugs, backdoors, vulnerabilities, zero-days etc. which all is beyond admins' responsibility.
Yes, but given that Eric is involved, and the sendmail source code is not overly complex or long, the probability of that is near zero.
any "hard working newbie" just cannot do this: review millions of lines of source code from all software installed. Even if the required knowledge were available on the personal level by a hard working professional, that individual would not even have the time for doing anything else. ...
The possibility of reading OSS is not an argument that is valid in admin's life experience. Except for some few bug bounty hunters there is no systematic review done for multiple reasons.
Yes, for one amateur to do it is probably too hard. But in the case of sendmail, my educated guess it that the FreeBSD project has sufficient manpower to review all changes to sendmail (here, man = Eric). And even for large software projects (such as freeware databases or kernels), the large industrial users are capable of doing an in-depth review. I'm quite sure that the big users do perform these full reviews, using teams of dozens or hundreds of engineers.
You don't need millions of people which use a software and have zero knowledge of understanding the actual source code. What you need is group of code review developers with deep understanding of that particular program which can approve the code changes ...
Exactly. And that happens among big users.
Unfortunately sendmail has not anymore BSD license, but we fall again in the problem of alternatives.
However, if you read the license (it's the file LICENSE at the top of the source tree), it sort of contains the BSD license as a special sub-case for open source usage.
Another question that was discussed in this thread: Why does FreeBSD still ship sendmail as the default MTU, given that 99.99% of all machines on the planet do not need to run a full-feature MTU which pairs with the open internet? There are two answers to that. The first one is that it is low risk, and great convenience to those FreeBSD users that have existing sendmail configurations. And it is no hassle to those people who want to use an alternative (simpler) MTU, they can install many of those from ports, disable sendmail, and instead use the MTU of their choice. It is what I do on my FreeBSD server.
Second argument: Tradition. I think sendmail has been used on *BSD for ~40 years; the author of sendmail is deeply involved in the BSD community.