/usr/spool/mail

[utzoo!decvax!ucbvax!unix-wizards]

>From decvax!duke!unc!smb at Berkeley Thu Sep  3 08:25:35 1981
The Berkeley mail program comes with several different 'local.c' files,
all of which have a routine called 'demail'.  Several of these truncate
the file rather than remove it; this would be much more secure.

I assume that the 'standard' version deletes the file to keep the
directory small and the search time to a minimum; this is probably most
important to the shell's mail check.  But if you truncate the file
instead, the shell could keep it open and do fstats, which are much
quicker.  There are a few tricky points to that (remembering the
FIOCLEX, watching out for someone removing the mailbox, seeing if $MAIL
has changed, watching out for the permissions being changed by the real
owner even though you were clever enough to fool your shell, etc.  I
think that Dennis Rockwell (duke!phs!dennis) got this working right
once upon a time.)