February 2001 - Test - lists.nanog.org

Re: Reasons why BIND isn't being upgraded
by Paul A Vixie 04 Feb '01

04 Feb '01

> I'm a bit confused. ... Yes. > Will the ISC implement similar policies with its INN and DHCP software > in the foreseeable future, or is this something unique to BIND? I don't see INN or DHCP as critical to the internet's infrastructure, so, no. > CERT has NEVER been the source of early warnings. By the time they release > information it has already been dissimenated in a variety of other forums. Nevertheless CERT is the mechanism ISC has always used to get critical bug notifications out to the industry, and there are no plans to change that. If you think CERT's methods are unsuitable, please take it up with them directly.

10 11

Re: Preferential notice of new versions
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

On Sat, Feb 03, 2001 at 07:10:23PM -0800, Sean Donelan typed: > As far as I can tell, ISC did not say they would stop distributing patches > through the same methods used now. If you don't want to pay, you will > get the exact same patches, through the exact same methods you get them > now. I think the issue some of us have is ISC won't *let* you pay. It's not an issue of wanting to. They're playing favorites, which just doesn't seem right. Jeff

4 3

FBI InfraGuard program
by Roeland Meyer 04 Feb '01

04 Feb '01

Has anyone here heard of it or is working with it? -- ROELAND M.J. MEYER Managing Director Morgan Hill Software Company, Inc. TEL: +001 925 373 3954 FAX: +001 925 373 9781 http://www.mhsc.com mailto: rmeyer(a)mhsc.com

3 2

Re: Preferential notice of new versions
by Sean Donelan 04 Feb '01

04 Feb '01

On Sat, 03 February 2001, Adam Rothschild wrote: > On Sat, Feb 03, 2001 at 10:00:51PM -0800, Joe Rhett wrote: > > Sure they do! Try reading the website once or twice. Then you can > > take your foot out of your mouth. > > I did. Seems pretty clear that, unless you're a TLD server operator > or large and respected OS vendor, they don't want to provide you with > early advisories, paid or otherwise. It seems pretty clear if you don't pay, you receive exactly the same advisories you receive now. No more, no less, no sooner, no later. CERT has always told a few other groups about vulnerabilities prior to their public release of advisories (vendors, some affected parties, etc). If anything, ISC's comments seem directed at CERT's procedures. Instead of trying to pass the information back and forth through CERT, ISC is adding a direct mechanism for the same groups to communicate. It doesn't affect any of the other existing communication channels. CERT issues a public alert about a vulnerability on its schedule. BUGTRAQ users continue to post exploits when and how they choose. And as always, the source code for all ISC released versions of BIND are available, so you can find all the flaws yourself. I will, and have, flogged Paul for doing stuff; but I'm afraid I don't understand the uproar about this one. I suspect there is another way to get yourself on the "list." Find and fix some significant bugs in BIND.

3 2

RE: Reasons why BIND isn't being upgraded
by Roeland Meyer 04 Feb '01

04 Feb '01

> How many of you use BIND in a commercial environment? > How many of you actually contribute money back to the authors of BIND? Commercial environment AND over 60% of my servers are Caldera Linux (<unabashed plug> VAR inside! </unabashed plug>). 100% of all binaries on those boxen are compiled in place and then the compilers are uninstalled. > Its all fine and good saying "When there's a security problem in BIND, > I want to know and I want to know now!" but guys, if you want > this wonderful level of support, either cough up some money to your software > providers, or write it yourself. I might not agree with how Paul is > going about it, but I understand his problems. So do I, <yea, Paul!>. Managing an OpenSource project, with volunteer programmers, that can take off to smell different roses, anytime, is a royal PITA! It's much worse when you can't pay for it. The OpenSource model makes ALL of its money from service and support, while giving the code away for free. This is almost the exact opposite of the traditional model. If you want support, you should pay for it. If, that is, you want BIND to continue to exist. BTW, I've seen some folks denigrate BIND as not being properly OpenSource, but not all the world is GPL and GPL isn't the sole arbiter of OpenSource. BIND is one of the pioneering OpenSource projects and Paul, for leading that effort, is to be very much commended for it. If you want support, you should pay for it. In fact, even if you don't need support, you should pay for it anyway!

2 1

Re: Preferential notice of new versions
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

On Sat, Feb 03, 2001 at 10:00:51PM -0800, Joe Rhett typed: > Sure they do! Try reading the website once or twice. Then you can take your > foot out of your mouth. Um, Do you have a URL? I belive this whole thing started by Paul Vixie stating that ISC will issue first reporting of issues to OS Vendors and Root Nameservers. Neither category do you, or I, fall under. Yes, on the ISC's website it does state that Nominum, Inc. will support bind. Great. So will I. Not nearly the same as what Vixie is now offering to OS Vendors and Root Nameservers. Is ISC stating that Nominum, Inc. customers will receive up to the minute security updates? IE, is Nominum to ISC-Bind what sendmail.com, inc. is to The Sendmail Consortium? If so, OK. But, I'm taking it as Nominum offers support services, similar to what Harker Systems, and others, does for sendmail. -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

2 1

Re: Preferential notice of new versions
by J Bacher 04 Feb '01

04 Feb '01

On Sun, 4 Feb 2001, Dan Busarow wrote: > On Feb 4, J Bacher wrote: > >1) Noone has suggested that the current public distribution would go > >away. What has been a point of concern is that the public may have to > >wait [too long?] for vendors to get their act together and publish patches > >before the new release hits the general distribution. A good many > >companies don't rely on vendor patches. > > And since I have the source I am limited in what way? > Paul has't changed anything the I can see aside from formalizing > deals with the root operators. That's a good thing Well, that's exactly my thought. From what I gather, the concern seems to be that there would be a delay in releasing the source to the general public until the vendors got their patches. My take is that the pre-release to the vendors afforded time for testing compatibility issues -- not that there would be a delay in releasing the source to the general public once ISC was satisfied that the code would behave as expected. That's why I called for a clarification. I think that the panic may be uncalled for. However, I also haven't seen anyone provide clarification to dissuade any concern.

1 0

Re: Reasons why BIND isn't being upgraded
by Paul Vixie 04 Feb '01

04 Feb '01

patrick(a)cybernothing.org (Patrick Greenwell) writes: > > hiding it DOES however make it harder for people (including network owners) > > to do surveys. > > By the same token one might argue that atempting to hide vunerabilities > to those paying you for "early warnings" doesn't help at all. Wrt the bind-members forum being discussed to death elsewhere, nobody can pay for early warnings. CERT will still be the source of early earnings. What people can pay for (bind-members participation) is the legal fees associated with NDA-level access to early fixes, if and only if they provide part of the internet's basic infrastructure (e.g., OS vendors and TLD server operators). > Just something to consider. I promise that ISC considered everything which was relevant, which your claim above is emphatically not. (Thanks for the FUD though.)

10 11

Re: Reasons why BIND isn't being upgraded
by Jeffrey Meltzer 04 Feb '01

04 Feb '01

> Wrt the bind-members forum being discussed to death elsewhere, nobody can pay > for early warnings. CERT will still be the source of early earnings. What > people can pay for (bind-members participation) is the legal fees associated > with NDA-level access to early fixes, if and only if they provide part of the > internet's basic infrastructure (e.g., OS vendors and TLD server operators). I'm confused. I get the TLD server operators part. But you're saying that you'd only give OS vendors access to this information. How long does it take, say, Sun, to issue a patch update? Wouldn't it be much more efficient, and useful, to issue the information directly to the people using the software? How many people actually use the default vendor binaries anyways? You're now playing favorites with your software, which many people have been using, and relying on, and helped you improve, for years. "Sorry, you're not important enough to get any security notifications fast. Good luck getting it when you get it". You stated "part of the internet's basic infrastructure". Explain how ISP's are not part of "the internet's basic infrastructure"? I mean, if you're going to charge for it, and have NDA's, why not allow anyone to pay for it? Depending on the price, if you're giving the info to "selected people", I know i'd pay for it (well, depending on the price). How do I know there's not going to be some script kiddie at Sun or somewhere that gets a hold of the information before I do, and doesn't care about an NDA? Why not just go the sendmail.com route, if you're going to start charging, and make it much clearer. "If you want support, etc, then pay us. Otherwise, it's just Open Source, use at your own risk". IE, *let* people make their own decision whether or not they feel it's worth the money. Think what's bothering me is that you're playing favorites, which, after so many people have been relying on bind for so long, just doesn't seem fair. But, I know, life isn't fair. All of a sudden this djbdns is starting to sound like an idea... Jeff -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. SolarisGuide: http://www.solarisguide.com

7 9

Preferential notice of new versions
by Sean Donelan 04 Feb '01

04 Feb '01

On Sat, 03 February 2001, Joe Rhett wrote: > Just about every very large company that I've ever worked with. Also, > having spent numerous years working the NAVSEA and other Pentagon systems, > you are explicitly not permitted to install anything other than a > vendor-provided patch. This may explain why Pentagon systems got hit with 250,000+ (depending on whose numbers you believe) intrusions last year, almost all through "known" vulnerabilities which had not been patched. Perhaps the Pentagon would have fewer intrusions if they fixed their systems instead of waiting for vendor-provided $700 toilet seat patches. As far as I can tell, ISC did not say they would stop distributing patches through the same methods used now. If you don't want to pay, you will get the exact same patches, through the exact same methods you get them now. Which is pretty good for "free" software. If you get BIND via a vendor distribution, such as AIX, Solaris, OSF/1, Redhat, etc; your support channels will not change. I suspect the reality will be those companies paying ISC for "advanced notice" will get some warm fuzzy feelings, and let management feel they've done something. But it doesn't alter the fact the software had a vulnerability, and someone else could have found the hole long before any advanced notice is issued by ISC. How many folks will now query the root-name servers CHAOS version numbers looking for a change. If you are a clever programmer, I'm sure you can fix all the flaws in the BIND code yourself, and you never need to pay ISC a penny.

3 2