4 ms·
Lost me at wanting to run BIND. BINDs security track record is poor and does not show promise of improvement. Run something else. There are plenty of systems th
by raggi 5y ago
Lost me at wanting to run BIND. BINDs security track record is poor and does not show promise of improvement. Run something else. There are plenty of systems that can consome or convert from bind format if thats what you want.
- psim1 5y agoBIND has a track record because it has existed for decades. At present, what's wrong with it?
- raggi 5y agoHere are a couple of more recent RCE's: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25216 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2521... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625 There are numerous DoS CVE's over the same time period.
- egberts1 5y agoSPNEGO, (and GSS-API) used by less than 1% of the Bind users (by observatory) and exploitable if configured as enabled that the entire code segment got removed by the maintainer from its code permanently. The rest is pretty solid and well tested.
- brian_cunnie 5y agoI've been running BIND on the internet for a quarter century (ns-he.nono.io, ns-digitalocean.nono.io). Sure, I got burned 20 years ago with, IIRC, a zone-transfer exploit, but in those days BIND ran as root (remember: the internet was new then). Nowadays BIND runs as a non-privileged user in a chroot'ed environment, so even if it's compromised the blast radius is tightly constrained. And I like BIND. I like editing zone files by hand. It never fails to make me happy.