Paul, please pardon me while I guffaw, and then blame you (as representative for the ISC) for "passing the buck". "It's not our fault that the mechanism we use for notification is completely inadequate for the needs of the global community." Please think about the ramifications (PR, marketing, and sales) of that statement if a major corporation (such as Microsoft, Sun, Compaq, Dell, or any of the others) tried to state that. And then, please attempt to defend your position. Cordially, -Mat Butler -----Original Message----- From: Paul A Vixie [mailto:vixie@mfnx.net] Sent: Saturday, February 03, 2001 12:52 PM To: nanog@merit.edu Subject: Re: Reasons why BIND isn't being upgraded

I'm a bit confused. ...

Yes.

Will the ISC implement similar policies with its INN and DHCP software in the foreseeable future, or is this something unique to BIND?

I don't see INN or DHCP as critical to the internet's infrastructure, so, no.

CERT has NEVER been the source of early warnings. By the time they release information it has already been dissimenated in a variety of other forums.

Nevertheless CERT is the mechanism ISC has always used to get critical bug notifications out to the industry, and there are no plans to change that. If you think CERT's methods are unsuitable, please take it up with them directly.