BIND: Intentional Security Compromise ..

BIND: Intentional Security Compromise ..

[terry white]

... for them what care:

    remotely exploitable vulnerabilities have been found in bind 4 and 8.
from my reading, it appears this known by 10-23-2002 at the 'latest'.
the announcement maybe a week ago, and a fix showed up (publicly)
yesterday.

    on another list, i complained that isc's paying customers got
preferential security fixes.  in response to that complaint, i told
the practice documented in their (isc's) archives.
    for those of us with an interest in 'system security', being told
that it depends on a willingness to pay, is one thing.  having to search
for that information another.  isc's unwillingness to make the
association between 'security and money' obvious, seems unscrupulous.

    from a security standpoint, djbdns sets a dns standard.  by
implication, bind sub-standard.  given the above, users of bind have to
pay to get the "very best" sub-standard dns.  the only problem with
djbdns is their attitude about 'having' to deal with users.  unless
you've read all the documentation, you can 'eat shit and die'.  isc on
the other hand offers user friendly list support, much like this one.

    i've never had a problem with having to build bind when security
problems required it, shit happens.  and my confidence not all that
assaulted.  but there is something 'wrong' about the way isc has handled
this latest, and i think it may well hurt them in the long run.

    the long and the short of it is this:

    global dns security is not isc's primary interest ...


-- 
... i'm a man, but i can change,
    if i have to , i guess ...

Re: BIND: Intentional Security Compromise ..

[Milan P. Stanic]

On Fri, Nov 15, 2002 at 02:14:05PM -0800, terry white wrote:
[...]
>     for those of us with an interest in 'system security', being told
> that it depends on a willingness to pay, is one thing.  having to search
> for that information another.  isc's unwillingness to make the
> association between 'security and money' obvious, seems unscrupulous.
[...]
>     global dns security is not isc's primary interest ...
 
If software works flawlessly and doesn't have security holes who will
pay for "support" (or anything like that) ;-)

BIND = remote shell for years

Milan