On Tue, 04 Aug 2009 13:32:42 EDT, Curtis Maurand said:
What does this have to do with Nanog, the guy found a critical security bug on DNS last year.
He didn't find it. He only publicized it. the guy who wrote djbdns fount it years ago. Powerdns was patched for the flaw a year and a half before Kaminsky published his article.
Yeah, and Robert Morris Sr wrote about a mostly-theoretical issue with TCP sequence numbers back in 1985. Then a decade later, some dude named Mitnick whacked the workstation of this whitehat Shimomura, and the industry collectively went "Oh ****, it isn't just theoretical" and Steve Bellovin got to write RFC1948. (Mitnick was the first *well known* attack using it that I know of - anybody got a citation for an earlier usage, either well-known or 0-day?)
"Wise people already saw this one coming 9 years ago, and had a fix in place."
Yes, but a wise man without a PR agent doesn't do the *rest* of the community much good. A Morris or Bernstein may *see* the problem a decade before, but it may take a Mitnick or Kaminsky to make the *rest* of us able to see it...