3 ms·

DJB paid out $1,000 in 2009 to Matthew Dempsky for a djbdns security vulnerability. https://marc.info/?l=djbdns&m=123613000920446&w=2 https://marc.info/?l=djbd

by dsl 6y ago

DJB paid out $1,000 in 2009 to Matthew Dempsky for a djbdns security vulnerability. https://marc.info/?l=djbdns&m=123613000920446&w=2 https://marc.info/?l=djbdns&m=123613000920446&w=2

davidu 6y ago
I used to work with Matthew. He's next level smart, and very modest. We are very lucky he is a good hacker and not an evil hacker. :-)
Quekid5 6y ago
> The next release of djbdns will be backed by a new security guarantee. I was a bit curious about this wording which seems quite weasel-wordy at first glance, so these are the snapshots of the page that have been saved by Archive here https://archive.vn/https://cr.yp.to/djbdns/guarantee.html https://archive.vn/https://cr.yp.to/djbdns/guarantee.html I did a rough diff of the two first saved snapshots (which span 2009), and got this: @@ -6,7 +6,7 @@ The djbdns security guarantee -I offer $500 to the first person to publicly report a verifiable security hole in the latest version of djbdns. +I offer $1000 to the first person to publicly report a verifiable security hole in the latest version of djbdns. @@ -14,17 +14,25 @@ -Bugs outside of djbdns, such as OS bugs or browser bugs, do not qualify. The vulnerability of DNS to forgery does not qualify. Denial-of-service attacks do not qualify. (An attacker can easily take down the Domain Name System, or selected parts of it; this is not news.) +Examples of problems that do not qualify: + + + + Bugs outside of djbdns, such as OS bugs or browser bugs. (People could seize control of BIND 9.1 through an OpenSSL buffer overflow, but that was a bug in OpenSSL, not in BIND.) + + The vulnerability of DNS to forgery. (BIND's port reuse makes blind forgery much less expensive, but this is a quantitative difference, not a qualitative difference. The DNS architecture needs cryptographic protection.) + + Denial-of-service attacks. (BIND 9's fragility makes denial of service completely trivial; but an attacker can easily take down the Domain Name System without using any of BIND's bugs. The DNS architecture needs to be decentralized.) I don't think this looks unreasonable in terms of actual consequences/definitions, but it is interesting how much effort and verbiage he spends on pointing out the flaws of other DNS servers.

by dsl 6y ago

DJB paid out $1,000 in 2009 to Matthew Dempsky for a djbdns security vulnerability. https://marc.info/?l=djbdns&m=123613000920446&w=2 https://marc.info/?l=djbdns&m=123613000920446&w=2

davidu 6y ago

I used to work with Matthew. He's next level smart, and very modest. We are very lucky he is a good hacker and not an evil hacker. :-)

Quekid5 6y ago

> The next release of djbdns will be backed by a new security guarantee. I was a bit curious about this wording which seems quite weasel-wordy at first glance, so these are the snapshots of the page that have been saved by Archive here https://archive.vn/https://cr.yp.to/djbdns/guarantee.html https://archive.vn/https://cr.yp.to/djbdns/guarantee.html I did a rough diff of the two first saved snapshots (which span 2009), and got this: @@ -6,7 +6,7 @@ The djbdns security guarantee -I offer $500 to the first person to publicly report a verifiable security hole in the latest version of djbdns. +I offer $1000 to the first person to publicly report a verifiable security hole in the latest version of djbdns. @@ -14,17 +14,25 @@ -Bugs outside of djbdns, such as OS bugs or browser bugs, do not qualify. The vulnerability of DNS to forgery does not qualify. Denial-of-service attacks do not qualify. (An attacker can easily take down the Domain Name System, or selected parts of it; this is not news.) +Examples of problems that do not qualify: + + + + Bugs outside of djbdns, such as OS bugs or browser bugs. (People could seize control of BIND 9.1 through an OpenSSL buffer overflow, but that was a bug in OpenSSL, not in BIND.) + + The vulnerability of DNS to forgery. (BIND's port reuse makes blind forgery much less expensive, but this is a quantitative difference, not a qualitative difference. The DNS architecture needs cryptographic protection.) + + Denial-of-service attacks. (BIND 9's fragility makes denial of service completely trivial; but an attacker can easily take down the Domain Name System without using any of BIND's bugs. The DNS architecture needs to be decentralized.) I don't think this looks unreasonable in terms of actual consequences/definitions, but it is interesting how much effort and verbiage he spends on pointing out the flaws of other DNS servers.