4 ms·

I linked to it because I think trying to keep it under wraps but issuing binary patches is doomed from the start. I guess my sarcasm wasn't clear enough, so I c

I linked to it because I think trying to keep it under wraps but issuing binary patches is doomed from the start. I guess my sarcasm wasn't clear enough, so I changed it it "... only slightly challenging ...". Mainly, I think the computer industry at large should know better by now. Delay the people who would fix things from getting the details they need and hoping the 'evil types' (their words) won't be able to figure it out in the mean time is a pretty bad strategy. (Fortunately, the "good guys" are often good at reverse-engineering things too.) I don't know anything at all about the technical details here, but it sounds like the whole thing is being handled very badly.

tptacek 18y ago
I agree with you. In this case, for reasons I won't go into right here, I think the effort to "hide" this "new flaw" was doomed from the start. But in general, if you patch it, it's out there. If this announcement counts as "Hackers News", it's marginal at best. "Protocols designed in the '70s found insecure --- film at 11!" But the discussion about whether you can reliable reverse patches to vulns? THAT's fun.
- gojomo 18y ago
  That so many vendors have collaborated to synchronize a patch release is interesting Hacker News. The odd quasi-disclosure -- here's how to test, here's a mostly-helpful patch, but full details will wait a month or until third parties figure it out -- is Hacker News. Regular reminders of the general insecurity of DNS are also a public service, attached to megapatch firedrills or not.
  - tptacek 18y ago
    It would be news if it was (a) news or (b) really true. Regarding (a), there was more collaboration and a bigger fire drill on the OULU.FI SNMP findings from 2003. That was a series of memory corruption and code execution findings in multiple different implementations. ---------------------------------------------------------- EVERYTHING BELOW THIS LINE WAS WRONG Also, Microsoft patches on a schedule ("Patch Tuesday"), so if you have an activist security researcher trying to keep details from getting out, the major coordination problem is already solved: you're releasing on Patch Tuesday. What I'm saying is, if you find ANYTHING, and you want to talk about a mass vendor reaction, get Microsoft on board and you're done. Dan has a professional relationship with Microsoft. Regarding (b), most of the implementations that are patching fall into two categories: (1) --- Derivatives of ISC BIND (2) --- Fantastically weak embedded or proprietary DNS implementations that were totally screwed prior to any new research result, and are now catching up on 13-15 years of DNS best practices for fear of being found out.

tptacek 18y ago

I agree with you. In this case, for reasons I won't go into right here, I think the effort to "hide" this "new flaw" was doomed from the start. But in general, if you patch it, it's out there. If this announcement counts as "Hackers News", it's marginal at best. "Protocols designed in the '70s found insecure --- film at 11!" But the discussion about whether you can reliable reverse patches to vulns? THAT's fun.

gojomo 18y ago
That so many vendors have collaborated to synchronize a patch release is interesting Hacker News. The odd quasi-disclosure -- here's how to test, here's a mostly-helpful patch, but full details will wait a month or until third parties figure it out -- is Hacker News. Regular reminders of the general insecurity of DNS are also a public service, attached to megapatch firedrills or not.
- tptacek 18y ago
  It would be news if it was (a) news or (b) really true. Regarding (a), there was more collaboration and a bigger fire drill on the OULU.FI SNMP findings from 2003. That was a series of memory corruption and code execution findings in multiple different implementations. ---------------------------------------------------------- EVERYTHING BELOW THIS LINE WAS WRONG Also, Microsoft patches on a schedule ("Patch Tuesday"), so if you have an activist security researcher trying to keep details from getting out, the major coordination problem is already solved: you're releasing on Patch Tuesday. What I'm saying is, if you find ANYTHING, and you want to talk about a mass vendor reaction, get Microsoft on board and you're done. Dan has a professional relationship with Microsoft. Regarding (b), most of the implementations that are patching fall into two categories: (1) --- Derivatives of ISC BIND (2) --- Fantastically weak embedded or proprietary DNS implementations that were totally screwed prior to any new research result, and are now catching up on 13-15 years of DNS best practices for fear of being found out.