Following revelations about a serious security weakness, the group involved in administering the BIND domain name server software is considering charging for access to security-related information about the important Internet program.

The Internet Software Consortium (ISC) plans to create a forum that will only be open to itself, vendors that include BIND in products, root and top-level domain name server operators, and other "qualified parties" who ISC decides to admit.

Members, who will pay a membership fee and be obliged to sign non-disclosure agreements, will receive privileged early warnings of problems with BIND.

The idea runs counter to the spirit of open disclosure of security problems that has long existed amongst security professionals, and has attracted strong criticism on mailing lists, such as BugTraq, that it will make the impact of any vulnerabilities worse, and play into the hands of crackers.

BIND (Berkeley Internet Name Domain) is an open-source software program that has become the de-facto standard for Domain Name System (DNS) servers on the Internet. Around 80 per cent of DNS servers run BIND.

Last week, a notice outlining a series of severe security problems with BIND was posted by CERT. The advisory documents four vulnerabilities in BIND, including two buffer overflows that could allow attackers to remotely gain unrestricted access to machines running the program

In a interesting discussion on the issue of creating a fee-paying forum, available here, Paul Vixie of ISC, said that the organisation would still issue security through CERT, but felt that using the security clearing house as a way to discuss issues between vendors was awkward, hence the creation of a fee-paying forum. ®

Related story

BIND holes mean big trouble on the Net