Hacker News Reader

Comment by tialaramex | Hacker News Reader

As far as I can tell this is a BIND bug. There are typically a dozen or so of these each year. The BIND 9 codebase (which is where this bug arose) dates back to when Bill Clinton was President of the US.

Rather than "Ooh, DNSSEC is bad" the correct take is that we need to wean ourselves off ISC BIND. Maybe ISRG can pay somebody to make a less awful DNS server implementation in Rust.

View on HN

dnsmasq and unbound are impacted to

https://github.com/NLnetLabs/unbound/releases/tag/release-1....

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/20...

As are any other DNSSEC validators that followed the specifications.

Bind9 has its problems but this is not its fault this time.

It MIGHT originated from ISC, but at the moment it's the behavior standard specifies and the fix all DNS software vendors have applied, breaks the standard.

IMO every operation should have a maximum time to execute, and rejecting an update / response for failure to process fast enough SHOULD be valid, even for a an otherwise well formed packet. A protocol must be resilient to valid communications failing for arbitrary reasons including operator error or cosmic bit-flips that corrupt the transmission.

The Linux codebase dates back to when George H. W. Bush was president.

Well... security vulnerabilities in Linux are a fairly common occurrence too!

How are Biden codebases doing?

Biden caused problems with both EXT4 and ZFS.

You might be interested in Hickory DNS (recently we rebranded it from Trust-DNS). The ISRG project is sponsoring work on this, announcement here: https://www.memorysafety.org/initiative/dns/

The specification is to blame this time, not memory safety.

This is one of those HALT problems that everyone likes to dismiss :)

Absolutely. DNSSEC validation is expensive.

It's a little weird to me that you're dating this back to a timeline associated to a presidency.

I think it just makes me feel old. Like, Bill Clinton's presidency wasn't that long ago. (was it?)

Depends on whether you think 24 years ago is a long time ago or not.

The researchers and other DNS server maintainers explicitly say this is a bug in the DNSSEC standard, and technically all patched servers are now standard-incompliant.

Real happy powerdns user sounding off. I've only ever run it for internal dev stuff but it's great.

PowerDNS got caught out too: https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6...

>The BIND 9 codebase (which is where this bug arose) dates back to when Bill Clinton was President of the US.

The fact that it's that old should mean it's extremely robust.

Age has nothing to do with vulnerability frequency, robustness or presidency. Popularity and investment do.

Reply on news.ycombinator.com