On Thu, Jul 26, 2007 at 11:40:55PM -0500, Gadi Evron wrote: > This is Paul Vixie's response on this, when I asked him for verification: > > ----- > this bug has been reported over and over again for a dozen years. it's > odd to have to keep fixing it-- i fixed it in bind4 and bind8 when theo > de raadt offered me his random number generator to use. bind9 should've > used that same one but apparently didn't. note that with this fix, the > difficulty in poisoning someone's cache rises from "a few tens of seconds" > to "a few minutes". it's a 16-bit field. not a lot of room for > randomness or unpredictability. only DNSSEC, a protocol change, fixes > this problem, which is fundamentally a protocol problem. but since folks > just won't leave it alone and keep on reporting it year after decade, we > will keep on improving our random number generator for this dinky little > 16-bit field. i just wish the reporters wouldn't be so smarmy and self > congradulatory about it. it's not like this hasn't been reported, and > fixed, many times by many others. > ----- Note that this conveniently ignores the option to use randomized port numbers... No, it is a pretty fix, but it sure does help. tim
