4 ms·

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which hasn’t been able to be compiled since 2022, has a buffer overflow, but only if one’s $HOME is over 50 characters in length” [3] I’m actually really pleased just how secure MaraDNS is now that it’s getting real in depth security audits. [1] https://samboy.github.io/MaraDNS/webpage/security.html https://samboy.github.io/MaraDNS/webpage/security.html [2] https://github.com/samboy/MaraDNS/discussions/136 https://github.com/samboy/MaraDNS/discussions/136 [3] https://github.com/samboy/MaraDNS/pull/137 https://github.com/samboy/MaraDNS/pull/137

binaryturtle 5mo ago
That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to hunt for those bugs? Which means even if the numbers of found bugs is less in your software at the moment, and it may look more audited for this reason, it may actually be way less secure.
- rgkpz 5mo ago
  "All software has bugs" is the most meaningless statement ever. It is just used for bonding with fellow bug writers who sit at a virtual campfire and muse about inevitabilities. Demonstrably some software has fewer bugs, and its authors are often hated, especially if they are a lone author like Bernstein. Because it must not happen! Projects with useless churn and many bug reports are more popular because only activity matters, not quality.
  - zamadatix 5mo ago
    "All software has bugs" so "be wary of the one trying to say they haven't had any in 3 years" not so "I guess all are equal". For extremely low security bug rates either the scope is extremely narrow, the claim is dubious, or the project is a massive effort which the community talks about directly in posts rather than plugs (e.g. curl).
    - strenholme 5mo ago
      DJB, with Qmail and DjbDNS (as well as Publicfile, which didn’t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being “extremely narrow”, and without the claim being “dubious”. It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. If one thinks the claim of no security bugs of consequence in three years is dubious, feel free to do a security audit of MaraDNS (or DjbDNS, which I also will take responsibility for even though my software is, if you will, a “competitor” to DjbDNS), and report any bugs you find. Speaking of DJB, DjbDNS has had a few security bugs over the years (but not that many), but I’m maintaining a fork of DjbDNS with all of the security bugs I know about fixed: https://github.com/samboy/ndjbdns https://github.com/samboy/ndjbdns I am saying all this as someone who has had significant enough issues with DJB’s software, I ended up writing my own DNS server so I didn’t have to use his server (I might not had done so if DjbDNS was public domain in 2001, but oh well). (As a matter of etiquette, it’s a little rude to claim someone is saying something “dubious”, especially when the claim is backed up with solid evidence [multiple audits didn’t find anything of significance in the last year, as I documented above], unless you have solid evidence the claim is dubious, e.g. a significant security hole more recent than three years old)
      - fc417fc802 5mo ago
        > It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. Can you back that claim up with at least some sort of theory? Because it doesn't match my perception of the real world, nor does it match my mental model of how CVEs happen.
- daneel_w 5mo ago
  > Why should I switch over to something way less proven? Must they prove their software to you? They're offering an alternative, not bargaining for a deal.
  - fc417fc802 5mo ago
    When you offer up an alternative as technically superior in some manner then yes, it is on you to demonstrate such a claim in a convincing manner. "No bugs in 3 years in this software with a much smaller audience and also look AI audits!" comes across as off topic shameless self promotion. At least if an insightful technical discussion ensued the subthread might prove worthwhile but so far it's just the usual tired shit flinging.
    - strenholme 5mo ago
      I have far more evidence of a very good security record with MaraDNS than “No bugs in 3 years in this software with a much smaller audience and also look AI audits!” • The software has been around for 25 years • The software is popular enough to have been subjected to dozens of security code audits, including two audits in the post-AI era • In those 25 years, only two remote “packet of death” bugs have been found • Also, in those same 25 years, only one single bug report of remotely exploitable memory leaks has been found This isn’t something which, as implied here, has a lot of security bugs only because no one has used or audited the software. This is a long term, mature code base which has only had a few serious security bugs in that timeframe. Here is my evidence: https://samboy.github.io/MaraDNS/webpage/security.html https://samboy.github.io/MaraDNS/webpage/security.html If this evidence isn’t “convincing” to you, I don’t know what evidence would be “convincing”.
      - fc417fc802 5mo ago
        For what it's worth I didn't know about maradns prior to this. Maybe it actually sees fairly wide use? Whether or not I accept your evidence would hinge on that. Regardless I think my point stands - if you don't lead with a convincing line of reasoning all that's left is an empty assertion. Unless I happen to recognize you as an authority in the field that's not going to do anything for me since by default you're some stranger on the internet that might be a dog for all I know. To illustrate the issue with an extreme example, consider that a disused repository on github full of security holes is highly unlikely to have any CVEs regardless of age. The software has to present a worthwhile target (ie have a substantial long term userbase) before anyone will bother to look for exploits. (I guess that might change in the near future thanks to AI but I don't think we're there just yet.)
- BrandoElFollito 5mo ago
  > dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. I concur. The last part, however, is quite worrisome. Dnsmasq is ran by one person, published on their own git and I did not see any information about other maintainers. It is a super important (and great, and useful, and everything) software and i have fears of what will happen one day. Sure, someone can clone and push to github but it may seriously fragment the ecosystem.
  - binaryturtle 5mo ago
    [flagged]
    - BrandoElFollito 5mo ago
      My point was not in the one-person aspect (I use fantastic software done by one person, I also develop some (used by a niche)), it is the bus factor that is worrisome. Some projects die because the dev abandons them (slowly or abruptly). Usually you see this happening with time and have the time to turn around. The bus factor is drastic. One day the project lives and the next day it is gone. There is nobody anymore to push PRs etc. As I said, you can have it picked up via a fork and hope for the best (= that current users will somehow know). havng a backup contibutor eevn just to make the transition is a nice thing to have. > Seeing it here, how someone "shamelessly" (in their own words) adverts their own competing project and then uses dummy accounts to bend the voting and discussion in their favouring… that's definitely NOT how trust is build up. It's something which instantly makes me stay away from a project (better or not). Not sure how this relates to my comment?
    - strenholme 5mo ago
      >>>uses dummy accounts to bend the voting and discussion<<< This is a false accusation with no evidence to back it up. Let me state this clearly: I am not using sockpuppet accounts nor am I stacking the vote. Ycombinator is a secure site and @dang does not allow sockpuppets nor stacked voting. What you are seeing is the hacker spirit of the Ycombinator community: Hackers believe in software diversity, and strongly oppose monoculture, so welcome people who bring up and discuss alternative software.
shakna 5mo ago
Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.
- theamk 5mo ago
  Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by version.
  - shakna 5mo ago
    Its important to maintain your dependencies, by say embedding Lua, rather than rebranding it and then claiming you have no security flaws. If I can find a CVE that _may_ affect the stack in five minutes, what _actual_ problems lurk there? You vendor Lua - thus, it _is_ your responsibility to review every Lua CVE. You've set yourself up as the maintainer by vendoring.
    - selectively 5mo ago
      [flagged]
    - strenholme 5mo ago
      You weren’t replying to me. The parent poster made a good point—a vulnerability in Lua doesn’t mean software running Lua can necessarily be exploited—but, more to the point, I do update Lunacy and make sure it’s secure, just as I still take responsibility for verified important security holes in MaraDNS. See this, for example: https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2014-5461 https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2...
  - ajross 5mo ago
cwillu 5mo ago
I remember being delighted finding maradns as an alternative to the “do everything” of dnsmasq way back when I set up a dns server, and more importantly, I haven't had to think about it since then.
gcr 5mo ago
MaraDNS is much less popular than dnsmasq though. I have several libraries that I've written. Not one single serious security bug in them has been found since 1991. Granted, nobody uses my libraries... Not to diminish your team's achievement! :D But it's important to contextualize claims like this with information about what your userbase looks like
- andrewjf 5mo ago
  I don't think that's relevant. You can still find security issues in software nobody uses. The question is a matter of impact because of how used the software is.
  - VorpalWay 5mo ago
    Way fewer people are going to look at obscure things, so a lower percentage of issues will likely have been found. There is less fame and fotune in spending security research time on obscure software. Most small libraries won't be covered by any bug bounty programs either for example.
    - andrewjf 5mo ago
      You don't need other people anymore to find security issues, you can do it yourself with AI.
      - rhdnfjtkfmf 5mo ago
        Even accepting the premise, is it not immediately obvious to you that folks will be spending more money and effort aiming AI at higher-impact targets? This isn’t all-or-nothing.
- strenholme 5mo ago
  A lot of security and other audits have been performed against it though; MaraDNS, after all, is notable enough to have a Wikipedia page and hundreds of GitHUB stars. For example, when the Ghost Domain Name DNS vulnerability was discussed, MaraDNS was audited and named (MaraDNS was immune to the security bug, for the record) https://web.archive.org/web/20120304054959/https://www.isc.org/files/imce/ghostdomain_camera.pdf https://web.archive.org/web/20120304054959/https://www.isc.o...
z3ratul163071 5mo ago
good job. but it is amazing we are still writing core networking tools in vulnerable language such as c in 2026.
- strenholme 5mo ago
  Agreed, it made a lot more sense to write MaraDNS in C in 2001 though. The main advantage of writing in C over Rust here in 2026 is that C has two different Lua interpreters, and there isn’t a port of Lua to Rust yet; [1] yes, there are ways to use the C version of Lua in Rust, but that’s different. If I were to write a new server today, I could very well write it in Go, then use GopherLua for the Lua engine: https://github.com/yuin/gopher-lua https://github.com/yuin/gopher-lua Although, even here, the advantage of C is that I could increase performance by using LuaJIT: https://luajit.org/luajit.html https://luajit.org/luajit.html [1] If I were to use Rust, I would consider using Rune as an embedded language as per https://rune-rs.github.io/ https://rune-rs.github.io/
ExoticPearTree 5mo ago
> Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Out of curiosty: what is the point you’re trying to make? That there are alternatives to dnsmasq? That somehow your software is “better”? This plug provides zero value to the dnsmasq discussion. As others have pointed out: the more used a software is, the more scrutiny it gets and more bugs or edge cases are found.
kortilla 5mo ago
Flagged because this discussion about dnsmasq and another dns resolver implementation that has relatively no rollout worldwide by comparison is pointless.

binaryturtle 5mo ago

That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to hunt for those bugs? Which means even if the numbers of found bugs is less in your software at the moment, and it may look more audited for this reason, it may actually be way less secure.

rgkpz 5mo ago
"All software has bugs" is the most meaningless statement ever. It is just used for bonding with fellow bug writers who sit at a virtual campfire and muse about inevitabilities. Demonstrably some software has fewer bugs, and its authors are often hated, especially if they are a lone author like Bernstein. Because it must not happen! Projects with useless churn and many bug reports are more popular because only activity matters, not quality.
- zamadatix 5mo ago
  "All software has bugs" so "be wary of the one trying to say they haven't had any in 3 years" not so "I guess all are equal". For extremely low security bug rates either the scope is extremely narrow, the claim is dubious, or the project is a massive effort which the community talks about directly in posts rather than plugs (e.g. curl).
  - strenholme 5mo ago
    DJB, with Qmail and DjbDNS (as well as Publicfile, which didn’t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being “extremely narrow”, and without the claim being “dubious”. It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. If one thinks the claim of no security bugs of consequence in three years is dubious, feel free to do a security audit of MaraDNS (or DjbDNS, which I also will take responsibility for even though my software is, if you will, a “competitor” to DjbDNS), and report any bugs you find. Speaking of DJB, DjbDNS has had a few security bugs over the years (but not that many), but I’m maintaining a fork of DjbDNS with all of the security bugs I know about fixed: https://github.com/samboy/ndjbdns https://github.com/samboy/ndjbdns I am saying all this as someone who has had significant enough issues with DJB’s software, I ended up writing my own DNS server so I didn’t have to use his server (I might not had done so if DjbDNS was public domain in 2001, but oh well). (As a matter of etiquette, it’s a little rude to claim someone is saying something “dubious”, especially when the claim is backed up with solid evidence [multiple audits didn’t find anything of significance in the last year, as I documented above], unless you have solid evidence the claim is dubious, e.g. a significant security hole more recent than three years old)
    - fc417fc802 5mo ago
      > It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. Can you back that claim up with at least some sort of theory? Because it doesn't match my perception of the real world, nor does it match my mental model of how CVEs happen.
daneel_w 5mo ago
> Why should I switch over to something way less proven? Must they prove their software to you? They're offering an alternative, not bargaining for a deal.
- fc417fc802 5mo ago
  When you offer up an alternative as technically superior in some manner then yes, it is on you to demonstrate such a claim in a convincing manner. "No bugs in 3 years in this software with a much smaller audience and also look AI audits!" comes across as off topic shameless self promotion. At least if an insightful technical discussion ensued the subthread might prove worthwhile but so far it's just the usual tired shit flinging.
  - strenholme 5mo ago
    I have far more evidence of a very good security record with MaraDNS than “No bugs in 3 years in this software with a much smaller audience and also look AI audits!” • The software has been around for 25 years • The software is popular enough to have been subjected to dozens of security code audits, including two audits in the post-AI era • In those 25 years, only two remote “packet of death” bugs have been found • Also, in those same 25 years, only one single bug report of remotely exploitable memory leaks has been found This isn’t something which, as implied here, has a lot of security bugs only because no one has used or audited the software. This is a long term, mature code base which has only had a few serious security bugs in that timeframe. Here is my evidence: https://samboy.github.io/MaraDNS/webpage/security.html https://samboy.github.io/MaraDNS/webpage/security.html If this evidence isn’t “convincing” to you, I don’t know what evidence would be “convincing”.
    - fc417fc802 5mo ago
      For what it's worth I didn't know about maradns prior to this. Maybe it actually sees fairly wide use? Whether or not I accept your evidence would hinge on that. Regardless I think my point stands - if you don't lead with a convincing line of reasoning all that's left is an empty assertion. Unless I happen to recognize you as an authority in the field that's not going to do anything for me since by default you're some stranger on the internet that might be a dog for all I know. To illustrate the issue with an extreme example, consider that a disused repository on github full of security holes is highly unlikely to have any CVEs regardless of age. The software has to present a worthwhile target (ie have a substantial long term userbase) before anyone will bother to look for exploits. (I guess that might change in the near future thanks to AI but I don't think we're there just yet.)
BrandoElFollito 5mo ago
> dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. I concur. The last part, however, is quite worrisome. Dnsmasq is ran by one person, published on their own git and I did not see any information about other maintainers. It is a super important (and great, and useful, and everything) software and i have fears of what will happen one day. Sure, someone can clone and push to github but it may seriously fragment the ecosystem.
- binaryturtle 5mo ago
  [flagged]
  - BrandoElFollito 5mo ago
    My point was not in the one-person aspect (I use fantastic software done by one person, I also develop some (used by a niche)), it is the bus factor that is worrisome. Some projects die because the dev abandons them (slowly or abruptly). Usually you see this happening with time and have the time to turn around. The bus factor is drastic. One day the project lives and the next day it is gone. There is nobody anymore to push PRs etc. As I said, you can have it picked up via a fork and hope for the best (= that current users will somehow know). havng a backup contibutor eevn just to make the transition is a nice thing to have. > Seeing it here, how someone "shamelessly" (in their own words) adverts their own competing project and then uses dummy accounts to bend the voting and discussion in their favouring… that's definitely NOT how trust is build up. It's something which instantly makes me stay away from a project (better or not). Not sure how this relates to my comment?
  - strenholme 5mo ago
    >>>uses dummy accounts to bend the voting and discussion<<< This is a false accusation with no evidence to back it up. Let me state this clearly: I am not using sockpuppet accounts nor am I stacking the vote. Ycombinator is a secure site and @dang does not allow sockpuppets nor stacked voting. What you are seeing is the hacker spirit of the Ycombinator community: Hackers believe in software diversity, and strongly oppose monoculture, so welcome people who bring up and discuss alternative software.

shakna 5mo ago

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

theamk 5mo ago
Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by version.
- shakna 5mo ago
  Its important to maintain your dependencies, by say embedding Lua, rather than rebranding it and then claiming you have no security flaws. If I can find a CVE that _may_ affect the stack in five minutes, what _actual_ problems lurk there? You vendor Lua - thus, it _is_ your responsibility to review every Lua CVE. You've set yourself up as the maintainer by vendoring.
  - selectively 5mo ago
    [flagged]
  - strenholme 5mo ago
    You weren’t replying to me. The parent poster made a good point—a vulnerability in Lua doesn’t mean software running Lua can necessarily be exploited—but, more to the point, I do update Lunacy and make sure it’s secure, just as I still take responsibility for verified important security holes in MaraDNS. See this, for example: https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2014-5461 https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2...
- ajross 5mo ago

cwillu 5mo ago

I remember being delighted finding maradns as an alternative to the “do everything” of dnsmasq way back when I set up a dns server, and more importantly, I haven't had to think about it since then.

gcr 5mo ago

MaraDNS is much less popular than dnsmasq though. I have several libraries that I've written. Not one single serious security bug in them has been found since 1991. Granted, nobody uses my libraries... Not to diminish your team's achievement! :D But it's important to contextualize claims like this with information about what your userbase looks like

andrewjf 5mo ago
I don't think that's relevant. You can still find security issues in software nobody uses. The question is a matter of impact because of how used the software is.
- VorpalWay 5mo ago
  Way fewer people are going to look at obscure things, so a lower percentage of issues will likely have been found. There is less fame and fotune in spending security research time on obscure software. Most small libraries won't be covered by any bug bounty programs either for example.
  - andrewjf 5mo ago
    You don't need other people anymore to find security issues, you can do it yourself with AI.
    - rhdnfjtkfmf 5mo ago
      Even accepting the premise, is it not immediately obvious to you that folks will be spending more money and effort aiming AI at higher-impact targets? This isn’t all-or-nothing.
strenholme 5mo ago
A lot of security and other audits have been performed against it though; MaraDNS, after all, is notable enough to have a Wikipedia page and hundreds of GitHUB stars. For example, when the Ghost Domain Name DNS vulnerability was discussed, MaraDNS was audited and named (MaraDNS was immune to the security bug, for the record) https://web.archive.org/web/20120304054959/https://www.isc.org/files/imce/ghostdomain_camera.pdf https://web.archive.org/web/20120304054959/https://www.isc.o...

z3ratul163071 5mo ago

good job. but it is amazing we are still writing core networking tools in vulnerable language such as c in 2026.

strenholme 5mo ago
Agreed, it made a lot more sense to write MaraDNS in C in 2001 though. The main advantage of writing in C over Rust here in 2026 is that C has two different Lua interpreters, and there isn’t a port of Lua to Rust yet; [1] yes, there are ways to use the C version of Lua in Rust, but that’s different. If I were to write a new server today, I could very well write it in Go, then use GopherLua for the Lua engine: https://github.com/yuin/gopher-lua https://github.com/yuin/gopher-lua Although, even here, the advantage of C is that I could increase performance by using LuaJIT: https://luajit.org/luajit.html https://luajit.org/luajit.html [1] If I were to use Rust, I would consider using Rune as an embedded language as per https://rune-rs.github.io/ https://rune-rs.github.io/

ExoticPearTree 5mo ago

> Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Out of curiosty: what is the point you’re trying to make? That there are alternatives to dnsmasq? That somehow your software is “better”? This plug provides zero value to the dnsmasq discussion. As others have pointed out: the more used a software is, the more scrutiny it gets and more bugs or edge cases are found.

kortilla 5mo ago

Flagged because this discussion about dnsmasq and another dns resolver implementation that has relatively no rollout worldwide by comparison is pointless.