Curing the BIND pain

todd glassey todd.glassey at worldnet.att.net
Tue Apr 1 16:06:48 UTC 2003


Might I suggest that you put together a group of you - four
or five should do fine, and draw up a list of all the things
that you want changed in "super BIND" or whatever you want
to call it, pass it through the group for a public airing
and then send it to the IETF's DNS WG's as a request. If you
are not getting what you need to operate your networks, then
a commitment to proactive responses requires this, or
something like it.

Tell them what you need to accomplish and not how to do it,
and they will build a protocol to satisfy this request
whether they redesign or morph BIND. It will also do wonders
for both organizations politically.

Just a thought.

Todd

-----Original Message-----
From: owner-nanog at merit.edu [mailto:owner-nanog at merit.edu]On
Behalf Of
Nathan J. Mehl
Sent: Thursday, March 27, 2003 6:25 AM
To: nanog at merit.edu
Subject: Re: Curing the BIND pain



In the immortal words of Michael.Dillon at radianz.com
(Michael.Dillon at radianz.com):
>
> I suggest that an appropriate technique would be for the
BIND server to
> originate traffic on it's local subnet that would look
suspicious and
> possibly trigger intrusion alarms.

Good lord.

I'm a little stuck for a proper analogy for this.  A car
that
"helpfully" starts emitting noxious smoke to let you know
that it's
time for a tune-up?  A refridgerator that drips bleach into
your
vegetable drawers to remind you to replace the coolant?  An
answering
machine that replaces the outgoing message with a stream of
profanities to alert callers that the incoming message tape
is full?

If people are so concerned about BIND's security that
they're willing
to seriously consider implementing ideas like this, why are
they not
willing to either consider replacing BIND with DNS software
that is
secure by design (*cough* *cough*), or paying the ISC to
produce a
properly secured BIND?

The solution to the Ford Pinto problem was not to recommend
that
people duct-tape sofa cushions and homemade warning lights
to the back
bumper.

-n

------------------------------------------------------------
<memory at blank.org>
"Thus do `Snuff Movies' take their place with
`Political-Correctness,' `Sex
Addiction,' and `Postmodernism' as Godzillas of bogus moral
panic, always
threatening to crush the nation in their jaws, but never
quite willing to take
the final step of biting down.
(--www.suck.com)
<http://blank.org/memory/>----------------------------------
------------------




More information about the NANOG mailing list