Feeds

Plan to charge for BIND security info

Closed forum being set up

  • alert
  • submit to reddit

Remote control for virtualized desktops

Following revelations about a serious security weakness, the group involved in administering the BIND domain name server software is considering charging for access to security-related information about the important Internet program.

The Internet Software Consortium (ISC) plans to create a forum that will only be open to itself, vendors that include BIND in products, root and top-level domain name server operators, and other "qualified parties" who ISC decides to admit.

Members, who will pay a membership fee and be obliged to sign non-disclosure agreements, will receive privileged early warnings of problems with BIND.

The idea runs counter to the spirit of open disclosure of security problems that has long existed amongst security professionals, and has attracted strong criticism on mailing lists, such as BugTraq, that it will make the impact of any vulnerabilities worse, and play into the hands of crackers.

BIND (Berkeley Internet Name Domain) is an open-source software program that has become the de-facto standard for Domain Name System (DNS) servers on the Internet. Around 80 per cent of DNS servers run BIND.

Last week, a notice outlining a series of severe security problems with BIND was posted by CERT. The advisory documents four vulnerabilities in BIND, including two buffer overflows that could allow attackers to remotely gain unrestricted access to machines running the program

In a interesting discussion on the issue of creating a fee-paying forum, available here, Paul Vixie of ISC, said that the organisation would still issue security through CERT, but felt that using the security clearing house as a way to discuss issues between vendors was awkward, hence the creation of a fee-paying forum. ®

Related story

BIND holes mean big trouble on the Net

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Big Content outs piracy hotbeds: São Paulo, Beijing ... TORONTO?
MPAA calls Canadians a bunch of bootlegging movie thieves
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Verizon bankrolls tech news site, bans tech's biggest stories
No agenda here. Just don't ever mention Net neutrality or spying, ok?
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.