Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?

Slashdot videos: Now with more Slashdot!

  • View

  • Discuss

  • Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).


Comment: FAIL. (Score 4, Interesting) 101

by Ethanol (#43220455) Attached to: Google Implements DNSSEC Validation For Public DNS

Google has not correctly implemented DNSSEC. If you send them a normal DNS query and the response is not validly signed, they just pass the answer back to you without any indication that it's invalid. They only tell you that the answer failed to validate if you set the DO ("dnssec okay") or AD ("authentic data") bits in your query, which almost no DNS clients currently do.

If the answer is invalid, a validating name server is supposed to respond with SERVFAIL, so that even if the client doesn't know anything about DNS security, it will still be protected against spoofing. Google is claiming to provide protection against spoofing, and then they aren't providing *any protection at all*.

If you want DNSSEC protection, you're still going to have to run a validating name server yourself: either BIND 9 or Unbound. (Disclosure: I'm a BIND 9 author.) It is, nowadays, extremely easy to configure a validating name server using BIND 9; in any version since 9.8.0, a one-line named.conf will do it:

options { dnssec-validation auto; };

Run named with that configuration and "nameserver" in resolv.conf and you're good to go. Google public DNS is not ready to trust yet.

Comment: Re:There are other options for DynDNS only routers (Score 1) 223

by Ethanol (#38413610) Attached to: DynDNS Cuts Back Free DNS Options

In fact, you don't need a dynamic DNS provider at all. My home router (a Netgear WNDR3700, costs about $85) is running CeroWRT, which includes BIND 9, which takes care of dynamic DNS by itself. It also does DNSSEC validation, and serves a dozen or so DNSSEC-signed domains. It's also my web server, IPv6 tunnel endpoint, shell server, and a passel of other things. Current uptime 224 days. Consumer router hardware can do a lot these days.

(Full disclosure: I'm a BIND 9 author and helped with the CeroWRT port.)

Comment: I just want a bundle discount (Score 1) 722

by Ethanol (#36778510) Attached to: Netflix Deflects Rage Over Price Increase

I totally recognize that this is a stupid reaction, but if service #1 costs X dollars and service #2 costs Y dollars, I want a little lagniappe if I purchase both--the bundle of services #1 and #2 should cost an amount less than X+Y.

If they'd announced that streaming was $9 and DVD's were $9 and the combination would be discounted to only $16, I would have been sad about the price increase but a lot less irked, even though it still would've been $16. At least it isn't $18, I'd think, and I'd pay up. But they made each service $8, and didn't discount the bundle at all, and so it grates on me.

Marketing fail on their part. Rationality fail on mine.

Comment: Re:latest BIND not affected (Score 4, Informative) 144

by Ethanol (#35291416) Attached to: High Severity BIND Vulnerability Advisory Issued

That's because the latest BIND was released specifically to patch this vulnerability. They just didn't really tell anybody about the vulnerability until after 9.7.3 was released.

That's not correct. The locking bug had already been fixed in 9.7.3b1, a month before it was found to be exploitable as a DoS. When we did find that out, we consulted with vendors and decided to continue with the releases in progress.

Comment: And of course... (Score 3, Interesting) 113

by Ethanol (#35153158) Attached to: The CIA's Amazing RC Animals From the 70s

Those of us who are a certain age and were geeky enough to read Danny Dunn books know exactly where the CIA got this idea.

(Luckily Danny was able to destroy Professor Bullfinch's notes so the CIA wouldn't be able to replicate the much better dragonfly he'd invented, so they had to fall back on tiny, impractical gasoline engines instead.)

Comment: Re:Ares = manrated, Falcon = cargo. (Score 5, Informative) 352

by Ethanol (#32626478) Attached to: SpaceX Falcon 9 Relatively Cheap Compared To NASA's New Pad

Actually, the Falcon 9, unlike most reusable boosters, was designed in advance to carry humans. It meets all of NASA's requirements for a human-rated vehicle except for an escape system. SpaceX has stated their intention to dot that final i within a couple of years. The Dragon spacecraft they're designing for the Falcon 9 will support a crew of 7.

Comment: Re:DNSSEC is an arduous solution (Score 1) 70

by Ethanol (#32161756) Attached to: DNSSEC and the Geopolitical Future of the Internet

DNSSEC and DNSCurve solve two different (though overlapping) problems. DNSSEC is about end-to-end authentication and validation: It strives to ensure that the data you received is the data the actual owner of a name server intended to send, unaltered by anyone along the way. DNSCurve is about ensuring a trustworthy connection between the authoritative name server and the resolver (and incidentally about encrypting queries, which is nice), but it doesn't do a thing to keep the resolver from lying to you. Man in the middle is a problem with DNS, as anyone who stays in hotels frequently can attest.

As for set-it-and-forget-it, if you use BIND 9.7 (on which, full disclosure, I was the lead engineer), it comes pretty close. If you don't roll keys, it can maintain itself forever, and you can roll ZSK's with a cron job. Rolling KSK's still requires operator intervention in most cases. (But rolling keys is optional; people with higher security needs will want to do it often, but low-value targets can get away with doing it infrequently or never.)

Comment: Re:It doesn't look very understandable to me (Score 2, Informative) 172

by Ethanol (#31550654) Attached to: ISC Releases the First Look At BIND 10

Thank you very much for looking at the code. If you could send critiques like that to the developer list instead of posting them to slashdot, it'd have a better chance of getting attention from the other developers.

I suppose it's their definition of "extensibility" -- a framework where everything is accessed through wrapped pimpls, so that anybody could change the implementation without changing binary compatibility with... oh, wait, it's an executable, so WTF?

Actually the bit you're looking at is libdns, which we're trying to design in such a way that it can be used by other DNS-aware applications, not just BIND. (I happen to agree with several of your other points, though, and there are places outside libdns where the pimpl thing was used and maybe shouldn't have been.)

Comment: Re:Years? (Score 1) 172

by Ethanol (#31547468) Attached to: ISC Releases the First Look At BIND 10

surely writing a DNS server can't be that hard?

Try it some time! It's fun! I can even refer you to an ongoing open-source project that you can contribute to, if you like! :)

To give a rough idea of scale, BIND 9 has about half a million lines of C code, and the first release took a couple of years to write.

(BIND 10, in its current minimal and unfinished state, is about 40,000 lines of C++, and 10,000 lines of python.)

Saliva causes cancer, but only if swallowed in small amounts over a long period of time. -- George Carlin