- NANOG - lists.nanog.org

Speakers circuit, upcoming Internet security confabs
by Sean Donelan 04 Feb '01

04 Feb '01

Everyone wants to get into the Internet security business. Cybercrime Summit 2001 http://www.asisonline.org/pdf/cybercrime.pdf $815 New Technologies to Strengthen Internet Security http://www.srinstitute.com/pdf/cs163.pdf $1395

1 0

BIND 9 vs djbdns
by Dave 'Duke of URL' Weiner 04 Feb '01

04 Feb '01

Long time reader, first time poster :) I've been following the recent thread about BIND. I have upgraded to the latest version, and I am not considering either an upgrade to BIND 9 or switching to djbdns. For those of you who have upgraded from 8.2.3 to 9.x, how difficult was it for you? Did you see a marked improvement in performance? For those of you who have switched from BIND 8.x to djbdns, how difficult was it for you? Are there any how-to's or detailed step-by-step walk through's that describe a reasonably sane way to upgrade? I've read all the docs on djbdns, and once the conversion is done, it looks pretty simple to administer, and work it into some of my automated setup tools. I'm more concerned with the conversion from BIND 8. I've been using DJB's qmail for 3 or 4 years now, so I'm very comfortable with his coding and restrictions, but I don't want to switch just because it's djb. I want to make an informed decision. So, please limit your comments to technical merit, ease of use, etc. This whole hub-bub about the security notifications, etc. is very low on my list as a factor in upgrading or changing. Thanks, Dave Weiner CTO, WebMasters, Inc. 800-472-9203 http://www.webmast.com

3 2

RE: Reasons why BIND isn't being upgraded
by Roeland Meyer 04 Feb '01

04 Feb '01

> From: Paul A Vixie [mailto:vixie@mfnx.net] > Sent: Saturday, February 03, 2001 3:03 PM > > The category "OS vendors" gets a little fishy... Do Linus > Torvalds and > > Alan Cox get on the list if they sign the NDA? How about Patrick > > Volkerding? > > If they're mature trustworthy people (I know Linus but not > those other guys) > and if they need some time to get patches ready for large > user bases, then I > feel sure that they'd be welcomed gladly. The catagory "OS vendors" may be a canard. MHSC is a Caldera VAR, but we also have live servers and so do our clients. We had already deployed BIND-8.2.3 before Caldera even made it available. That channel takes too long. I'm not a direct Sun customer, but I'll wager that Sun has yet to make it available to their customers. The same goes for HP and IBM.

1 0

RE: Reasons why BIND isn't being upgraded
by Mathew Butler 04 Feb '01

04 Feb '01

Paul, please pardon me while I guffaw, and then blame you (as representative for the ISC) for "passing the buck". "It's not our fault that the mechanism we use for notification is completely inadequate for the needs of the global community." Please think about the ramifications (PR, marketing, and sales) of that statement if a major corporation (such as Microsoft, Sun, Compaq, Dell, or any of the others) tried to state that. And then, please attempt to defend your position. Cordially, -Mat Butler -----Original Message----- From: Paul A Vixie [mailto:vixie@mfnx.net] Sent: Saturday, February 03, 2001 12:52 PM To: nanog(a)merit.edu Subject: Re: Reasons why BIND isn't being upgraded > I'm a bit confused. ... Yes. > Will the ISC implement similar policies with its INN and DHCP software > in the foreseeable future, or is this something unique to BIND? I don't see INN or DHCP as critical to the internet's infrastructure, so, no. > CERT has NEVER been the source of early warnings. By the time they release > information it has already been dissimenated in a variety of other forums. Nevertheless CERT is the mechanism ISC has always used to get critical bug notifications out to the industry, and there are no plans to change that. If you think CERT's methods are unsuitable, please take it up with them directly.

1 0

Re: BIND, djbdns, commercialization
by Jeffrey Meltzer 03 Feb '01

03 Feb '01

> I fail to see the point of discussing or arguing partial commercialization > of premium services -- I haven't seen one valid point yet. Point is, knowing how many organizations rely on their software, and outright saying that they will NOT let people know about bugs as soon as they do, even if they are willing to pay for it, just doesn't seem right. What makes Sun having this information more important than me? I'd have no problem if Vixie went the Allman route, saying "OK, we're going to start charging for support. If you want to know about bugs soon after we do, pay us $X. If not, use at your own risk." But, they're saying "We're only going to let people who we want to know about the bugs know about them. The rest of you can hear about it on the evening news." Even after they started sendmail.com, Allman and his crew have been very good about releasing new sendmail patches themselves, not making you wait for CERT Advisories, etc. Maybe The Sendmail Consortium just realizes that if it wasn't for the people using, breaking, and making suggestions about code updates for 10+ years, they wouldn't have the business they have now. Maybe ISC is forgetting that. Jeff -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

4 3

Re: Reasons why BIND isn't being upgraded
by Paul A Vixie 03 Feb '01

03 Feb '01

> > Will these 141 organizations many of whose business relies on BIND be > > eligible for your fee-based list? Do they consitute providers > > of "critical infrastructure" in your eyes? No. 90% of the name servers on the Internet fit that classification. "Restricted notification" is not practical on that scale. > Considering that they have a positive revenue model (vs TLD registries that > don't, or have negative revenue models) I would suggest that they pay for it > and help support ISC/BIND. Of course, everyone should support ISC. And the Sierra Club for that matter. But "should they support ISC?" is a completely different question than "if we don't get them upgraded before the whole world knows about it, are we doomed?"

1 0

Re:BIND, djbdns, commercialization
by rkuhljr＠uol.com.br 03 Feb '01

03 Feb '01

>While the idea of another program to serve DNS isn't all that bad, >I think jumping ship just because of one new policy isn't necessarily >the most prudent thing to do. The new policy may not be the only reason; the bugs in BIND 4/BIND 8 are making everyone consider what to use as replacement: BIND 9, djbdns or something else. Both BIND 9 and djbdns have non-technical issues; BIND 9 licensing is good, but ISC sticks to security notification methods that are not. Licensing is a djbdns weakness. >WRT djbdns: I've had a moderate level of experience with it, and, >while it seems interesting to an extent, operationally I've had several >annoying encounters with it. >When challenged, I seem to get the reply of "maybe some time later >it will have that" or "that is insecure, djb doesn't support that". What operational issues are annoying and in what daemons (dnscache, tiny-dns, axfr-dns, wall-dns) ? Needs like authoritative servers and recursive resolvers are different, and may be a djbdns/BIND9 mix can perform better. >djbdns is also very infant - it's probably not popular enough for all >the skr1pt k1dd13s to have an interest in hacking at, because finding >a vulnerability in djbdns is about as useful to the "wreaker or havoc" >as finding a master door and ignition key to a '58 pinto -- there's >about 17 of them on the planet :-) djb himself seems not to be very popular; I bet that are many people out there trying to find bugs in his software just to make him look silly. Rubens Kuhl Jr.

2 1

Re: Reasons why BIND isn't being upgraded
by Paul Vixie 03 Feb '01

03 Feb '01

meltzer(a)villageworld.com (Jeffrey Meltzer) writes: > I'm confused. I get the TLD server operators part. But you're saying > that you'd only give OS vendors access to this information. How long does > it take, say, Sun, to issue a patch update? Wouldn't it be much more > efficient, and useful, to issue the information directly to the people > using the software? How many people actually use the default vendor > binaries anyways? CERT handles notification. The bind-members forum is for people who receive such notifications to coordinate with ISC on actual patch details. Check your paranoia at the door.

1 0

RE: Reasons why BIND isn't being upgraded
by Roeland Meyer 03 Feb '01

03 Feb '01

> From: Adam Rothschild [mailto:asr@latency.net] > Sent: Saturday, February 03, 2001 1:20 PM > Why not just notify everyone at once? That way, when vulnerabilities > are discovered, people can take whatever action they deem appropriate > to protect their infrastructure (write/release their own set of BIND > patches? upgrade to djbdns? decide DNS is too daunting to manage > in-house, and outsource to Nominum or UltraDNS instead?), rather than > remain vulnerable, pending an official announcement from the > appropriate sources. Perhaps I'm missing something, isn't that what ISC does on the web-site already?

1 0

RE: nanog nazi-ism
by Roeland Meyer 03 Feb '01

03 Feb '01

I haven't had a problem and I certainly published some unpopular views. > -----Original Message----- > From: jamie rishaw [mailto:jamie@arpa.com] > Sent: Saturday, February 03, 2001 12:12 PM > To: nanog(a)merit.edu > Subject: nanog nazi-ism > > > > Okay, > > I've had to resubscribe to nanog-post 3 times in the past week. > > Who is trying to censor nanog? What's going on here? Who controls > nanog-post? > > Am I the only one experiencing this? > > -- > i am jamie at arpa dot com .. and this is my .sig. > > core1.dns.microsoft.com# sho access-list 101 > Extended IP access list 101 > deny udp any any eq domain (874572345872345 matches) >

1 0