3 ms·

I am really surprised they did not mention when the Internet community got upset that ISC/BIND monetized their open source server by having a closed mailing lis

I am really surprised they did not mention when the Internet community got upset that ISC/BIND monetized their open source server by having a closed mailing list to discuss BIND security holes: https://old.lwn.net/2001/0208/security.php3 https://old.lwn.net/2001/0208/security.php3 This event made the Internet realize that there was, at the time (early 2001), no viable open source DNS server besides BIND out there: https://old.lwn.net/2001/0208/ https://old.lwn.net/2001/0208/ Since then, MaraDNS came out, then NSD and its sister resolver Unbound came out, djbdns finally became open source [1], and Knot DNS came out this decade. [1] As an aside, I don’t know of any currently maintained djbdns fork. N-DJBDNS has not had a formal release since 2014 ( http://pjp.dgplug.org/ndjbdns/ http://pjp.dgplug.org/ndjbdns/ ), and the maintainer has not closed a bug since 2017 ( https://github.com/pjps/ndjbdns/issues?q=is%3Aissue+is%3Aclosed https://github.com/pjps/ndjbdns/issues?q=is%3Aissue+is%3Aclo... ). Perhaps @tptacek is willing to step up to plate and make an actively maintained version of djbdns. But I get the feeling I will end up maintaining both my own MaraDNS and a fork of N-DJBDNS.

brightball 7y ago
Don’t forget PowerDNS and ErlDNS.
throw0101a 7y ago
I can understand why people got upset, and more variety is a good thing, but it should also be noted that ISC is a US non-profit, and they have to pay the bills as well: * https://en.wikipedia.org/wiki/Internet_Systems_Consortium https://en.wikipedia.org/wiki/Internet_Systems_Consortium I have no idea what the details were, but if you're going to make a buck off BIND by being a vendor of some kind, then paying for "early-access" is not crazy-unreasonable IMHO. As noted in the e-mail "Not-for-profit members can have their fees waived", so they're not trying to milk folks like the BSDs.
- tptacek 7y ago
  Requiring payment for vulnerability fixes isn't reasonable; it deliberately externalizes security problems BIND itself creates. If they couldn't provide software for free with vulnerability fixes, they shouldn't have provided it for free at all.
  - throw0101a 7y ago
    The fixes do not require payment (which would be hard to do with open source software). What required payment was a type of support contract or membership fee for early access. Vendors were free not to pay, but they'd only know about the issue when the public announcement went out with no advanced warning.
    - tptacek 7y ago
      I'm familiar with the "support contract" we're discussing, and it was for "early" access to vulnerability details.

brightball 7y ago

Don’t forget PowerDNS and ErlDNS.

throw0101a 7y ago

I can understand why people got upset, and more variety is a good thing, but it should also be noted that ISC is a US non-profit, and they have to pay the bills as well: * https://en.wikipedia.org/wiki/Internet_Systems_Consortium https://en.wikipedia.org/wiki/Internet_Systems_Consortium I have no idea what the details were, but if you're going to make a buck off BIND by being a vendor of some kind, then paying for "early-access" is not crazy-unreasonable IMHO. As noted in the e-mail "Not-for-profit members can have their fees waived", so they're not trying to milk folks like the BSDs.

tptacek 7y ago
Requiring payment for vulnerability fixes isn't reasonable; it deliberately externalizes security problems BIND itself creates. If they couldn't provide software for free with vulnerability fixes, they shouldn't have provided it for free at all.
- throw0101a 7y ago
  The fixes do not require payment (which would be hard to do with open source software). What required payment was a type of support contract or membership fee for early access. Vendors were free not to pay, but they'd only know about the issue when the public announcement went out with no advanced warning.
  - tptacek 7y ago
    I'm familiar with the "support contract" we're discussing, and it was for "early" access to vulnerability details.