Hacker News Reader

Lost me at wanting to run BIND. BINDs security track record is poor and does not show promise of improvement. Run something else. There are plenty of systems that can consome or convert from bind format if thats what you want.

View on HN

I've been running BIND on the internet for a quarter century (ns-he.nono.io, ns-digitalocean.nono.io). Sure, I got burned 20 years ago with, IIRC, a zone-transfer exploit, but in those days BIND ran as root (remember: the internet was new then). Nowadays BIND runs as a non-privileged user in a chroot'ed environment, so even if it's compromised the blast radius is tightly constrained.

And I like BIND. I like editing zone files by hand. It never fails to make me happy.

BIND has a track record because it has existed for decades. At present, what's wrong with it?

Here are a couple of more recent RCE's:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2521... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625

There are numerous DoS CVE's over the same time period.

SPNEGO, (and GSS-API) used by less than 1% of the Bind users (by observatory) and exploitable if configured as enabled that the entire code segment got removed by the maintainer from its code permanently.

The rest is pretty solid and well tested.

Reply on news.ycombinator.com