- NANOG - lists.nanog.org

Re: Preferential notice of new versions
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

On Sat, Feb 03, 2001 at 10:00:51PM -0800, Joe Rhett typed: > Sure they do! Try reading the website once or twice. Then you can take your > foot out of your mouth. Um, Do you have a URL? I belive this whole thing started by Paul Vixie stating that ISC will issue first reporting of issues to OS Vendors and Root Nameservers. Neither category do you, or I, fall under. Yes, on the ISC's website it does state that Nominum, Inc. will support bind. Great. So will I. Not nearly the same as what Vixie is now offering to OS Vendors and Root Nameservers. Is ISC stating that Nominum, Inc. customers will receive up to the minute security updates? IE, is Nominum to ISC-Bind what sendmail.com, inc. is to The Sendmail Consortium? If so, OK. But, I'm taking it as Nominum offers support services, similar to what Harker Systems, and others, does for sendmail. -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

2 1

Re: Preferential notice of new versions
by J Bacher 04 Feb '01

04 Feb '01

On Sun, 4 Feb 2001, Dan Busarow wrote: > On Feb 4, J Bacher wrote: > >1) Noone has suggested that the current public distribution would go > >away. What has been a point of concern is that the public may have to > >wait [too long?] for vendors to get their act together and publish patches > >before the new release hits the general distribution. A good many > >companies don't rely on vendor patches. > > And since I have the source I am limited in what way? > Paul has't changed anything the I can see aside from formalizing > deals with the root operators. That's a good thing Well, that's exactly my thought. From what I gather, the concern seems to be that there would be a delay in releasing the source to the general public until the vendors got their patches. My take is that the pre-release to the vendors afforded time for testing compatibility issues -- not that there would be a delay in releasing the source to the general public once ISC was satisfied that the code would behave as expected. That's why I called for a clarification. I think that the panic may be uncalled for. However, I also haven't seen anyone provide clarification to dissuade any concern.

1 0

Re: Reasons why BIND isn't being upgraded
by Paul Vixie 04 Feb '01

04 Feb '01

patrick(a)cybernothing.org (Patrick Greenwell) writes: > > hiding it DOES however make it harder for people (including network owners) > > to do surveys. > > By the same token one might argue that atempting to hide vunerabilities > to those paying you for "early warnings" doesn't help at all. Wrt the bind-members forum being discussed to death elsewhere, nobody can pay for early warnings. CERT will still be the source of early earnings. What people can pay for (bind-members participation) is the legal fees associated with NDA-level access to early fixes, if and only if they provide part of the internet's basic infrastructure (e.g., OS vendors and TLD server operators). > Just something to consider. I promise that ISC considered everything which was relevant, which your claim above is emphatically not. (Thanks for the FUD though.)

10 11

Re: Reasons why BIND isn't being upgraded
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

> Wrt the bind-members forum being discussed to death elsewhere, nobody can pay > for early warnings. CERT will still be the source of early earnings. What > people can pay for (bind-members participation) is the legal fees associated > with NDA-level access to early fixes, if and only if they provide part of the > internet's basic infrastructure (e.g., OS vendors and TLD server operators). I'm confused. I get the TLD server operators part. But you're saying that you'd only give OS vendors access to this information. How long does it take, say, Sun, to issue a patch update? Wouldn't it be much more efficient, and useful, to issue the information directly to the people using the software? How many people actually use the default vendor binaries anyways? You're now playing favorites with your software, which many people have been using, and relying on, and helped you improve, for years. "Sorry, you're not important enough to get any security notifications fast. Good luck getting it when you get it". You stated "part of the internet's basic infrastructure". Explain how ISP's are not part of "the internet's basic infrastructure"? I mean, if you're going to charge for it, and have NDA's, why not allow anyone to pay for it? Depending on the price, if you're giving the info to "selected people", I know i'd pay for it (well, depending on the price). How do I know there's not going to be some script kiddie at Sun or somewhere that gets a hold of the information before I do, and doesn't care about an NDA? Why not just go the sendmail.com route, if you're going to start charging, and make it much clearer. "If you want support, etc, then pay us. Otherwise, it's just Open Source, use at your own risk". IE, *let* people make their own decision whether or not they feel it's worth the money. Think what's bothering me is that you're playing favorites, which, after so many people have been relying on bind for so long, just doesn't seem fair. But, I know, life isn't fair. All of a sudden this djbdns is starting to sound like an idea... Jeff -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

7 9

Preferential notice of new versions
by Sean Donelan 04 Feb '01

04 Feb '01

On Sat, 03 February 2001, Joe Rhett wrote: > Just about every very large company that I've ever worked with. Also, > having spent numerous years working the NAVSEA and other Pentagon systems, > you are explicitly not permitted to install anything other than a > vendor-provided patch. This may explain why Pentagon systems got hit with 250,000+ (depending on whose numbers you believe) intrusions last year, almost all through "known" vulnerabilities which had not been patched. Perhaps the Pentagon would have fewer intrusions if they fixed their systems instead of waiting for vendor-provided $700 toilet seat patches. As far as I can tell, ISC did not say they would stop distributing patches through the same methods used now. If you don't want to pay, you will get the exact same patches, through the exact same methods you get them now. Which is pretty good for "free" software. If you get BIND via a vendor distribution, such as AIX, Solaris, OSF/1, Redhat, etc; your support channels will not change. I suspect the reality will be those companies paying ISC for "advanced notice" will get some warm fuzzy feelings, and let management feel they've done something. But it doesn't alter the fact the software had a vulnerability, and someone else could have found the hole long before any advanced notice is issued by ISC. How many folks will now query the root-name servers CHAOS version numbers looking for a change. If you are a clever programmer, I'm sure you can fix all the flaws in the BIND code yourself, and you never need to pay ISC a penny.

3 2

The Cidr Report
by Tony Bates 04 Feb '01

04 Feb '01

This is an auto-generated mail on Fri Feb 2 12:00:00 PST 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 02Feb01 0) General Status Table History ------------- Date Prefixes 260101 96902 270101 96353 280101 96304 290101 96277 300101 96520 310101 96571 010201 96527 020201 96787 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 91.16.23.0/24 from AS11770 AS Summary ---------- Number of ASes in routing system: 9790 Number of ASes announcing only one prefix: 5718 (3222 cidr, 2496 classful) Largest number of cidr routes: 957 announced by AS701 Largest number of classful routes: 1658 announced by AS701 1) Gains by aggregating at the origin AS level --- 02Feb01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

2 1

RE: Vixie doing his part to make people upgrade (was:Re: Reasons why BIND isn't being upgraded)
by Roeland Meyer 04 Feb '01

04 Feb '01

> Please go hassle UUNET for not filtering port 25 on their > dial pools or > something! <tsk, tsk> Not fair, invoking the dead.

1 0

BIND, djbdns, etc - ^Z. suspend. fini. kill -9.
by jamie rishaw 04 Feb '01

04 Feb '01

core1.nanog(config)# no ip pointless-debating Might I suggest that this whole BIND/djbdns/ISC thread is old, and should either 1) be taken privately, off list 2) be taken to a trashy mail list where people bicker about stupid things like this (no names mentioned but it sounds like "eyenet axis") or 3) be dropped alltogether. jamie -- i am jamie at arpa dot com .. and this is my .sig. core1.dns.microsoft.com# sho access-list 101 Extended IP access list 101 deny udp any any eq domain (874572345872345 matches)

1 0

Re: Reasons why BIND isn't being upgraded
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

On Sat, Feb 03, 2001 at 08:34:58PM -0800, Joe Rhett typed: > Yes, and I'm sure that everyone sitting on their heels dealing with those > environments thanks you as well. Let's be rude to anyone that doesn't meet > our personal design philosophy, why don't we? First of all, you were the one with the negativity first. Second, Anyone who is running stock daemon binaries deserves to have problems. Yes, This is a personal opinion. Never said it wasn't. But, at least 15 people mailed me privately agreeing with me. Another personal opinion: If there's someplace that won't let the admin's they hire use their judgement when installing such important services as dns, mail and www, sounds like they don't have alot of confidence in their admins. Scenario: Paul Vixie emails NANOG on a friday night that there's a security issue with bind. If it took Sun a week to come out with a patch, you're going to just sit idly by? In fact, I may have missed it, but I don't think i've seen a Sun patch yet. A search on Access1 shows the same. Are you still running bind previous to 8.2.3, as you'll only install a vendor patch? If ISC gave Sun the information prior to last Friday, they sure haven't done anything with it, that I can tell. So why should they get preferential treatment? I agree with Paul. This has gotten way to non-operational. > Hang out with Greg Woods much? OK, you just lost all credibility. Kthnx. -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

1 0

Re: Reasons why BIND isn't being upgraded
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

>Just about every very large company that I've ever worked with. Also, >having spent numerous years working the NAVSEA and other Pentagon systems, >you are explicitly not permitted to install anything other than a >vendor-provided patch. >My god, are there really this many idiots out there that don't grasp how >the world works? See, i'm sitting here thinking the same thing. Have you ever maintained a (bind|sendmail|etc) machine in a production, internet connected environment? I'm not talking about a corporate LAN, beind PIX's, etc. Jeez. If I waited for Sun to issue patches and upgrades, I would have been hacked a long time ago....And, I feel sorry for anyone that does wait for them. I cannot believe that there are people that are really using (and not to pick on Sun at all) Sun's bind and sendmail (and now apache). Apparently you live in a very straightforward world, and have no need for customization. Must have a real easy job. (Sorry for the negativity). I'm done with this thread. Paul, Keep up the good work. Whatever you people decide to do, the masses will apparently have no choice but to follow :)

2 1