bugtraq@artemas.reachin.com writes: > First of all, BIND 9 is a complete rewrite of BIND, which, so far, has > not had one security problem reported with it. I have two questions. First, why has ISC reported all the crash-BIND-8 bugs on its ``BIND security'' page and in CERT advisories, but none of the crash-BIND-9 bugs? (The primary ``security'' mechanism in BIND 9 is a fragility mechanism: BIND 9 commits suicide if it gets confused, or if you poke it sharply, or if you simply think bad thoughts in its general direction. The BIND 9 change log is full of reports of easily triggered crashes.) Second, how much money do I get from ISC if I look at the BIND 9 code and find, for example, a bug letting attackers take over the server? > This release has gone under months of testing by a volunteer crew, and > I belive that we have most of the bugs ironed out. I have three questions. First, what exactly do you mean by ``found some security problems'' in your change log for 0.8.99? Why doesn't the change log explain exactly what the problem is and what its impact is? Second, how much money do I get from you if I look at your code and find, for example, a bug letting attackers take over the server? Third, bottom line: How serious are you about security? I don't just mean chroot and stralloc. I don't just mean ``strive to be secure.'' And I certainly don't mean Microsoft's ``we'll try but we guarantee you that we'll fail.'' _Will_ your software be secure? ---Dan P.S. I also have a question for the bugtraq moderators. You regularly accept BIND 9 advertisements from the BIND authors, and you've accepted this MaraDNS advertisement from the MaraDNS author. Why did you reject http://cr.yp.to/djbdns/bugtraq/20010201072942-22539-qmail@cr-yp-to, specifically the final paragraph about djbdns, as ``marketing''?
