Reasons why BIND isn't being upgraded

Fri Feb 2 19:13:56 UTC 2001

On Fri, 2 Feb 2001, Bill Woodcock wrote:

>       On Fri, 2 Feb 2001, Patrick Greenwell wrote:
>     > By the same token one might argue that atempting to hide vunerabilities 
>     > to those paying you for "early warnings" doesn't help at all.
> 
> Not at all...  If you're trying to hide a vulnerability by lying about
> your version number, that presupposes generally-held knowledge of an
> association between a vulnerability and a version number.
> 
> "Early warning" is specifically a means of delaying the general
> availability of knowledge of that association.  

Which leaves those that have not been informed of such vunerabilities
acutely vunerable. 

Script kiddies may be stupid, but the people writing the program that they
utilize generally aren't.

Without rehashing the whole "open-disclosure" vs. "non-disclosure" 
arguments related to security issues in software, or the historically
extreme inadequacies of CERT in offering timely notification of ANY 
security-related issues, it's very disappointing to see ISC resort to a
fee-based, non-public-disclosure-at-the-time-of-discovery, NDA'd and
"we'll update people via CERT" method of dealing with the community they
have served for so long.

I would have hoped by now that lists such as Bugtraq would have adequately 
exhibited the folly of such methodologies. 

Obviously that is not the case.