Subject: Re: Fingerprinting DNS implementations.

From: Ted Lemon <[email-masked]>
Date: Wed, 10 Dec 2003 20:05:38 -0600

On Dec 10, 2003, at 12:53 PM, Dean Anderson wrote:
> This could get into a sort of war of fingerprinting and obscuring 
> changes,
> which would seem to be destructive...

Or, it could turn into a war of bug fixing, which would be 
constructive, and would motivate people to move to less buggy versions 
of their name server software.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Dean Anderson <[email-masked]>
Date: Wed, 10 Dec 2003 23:00:21 -0500 (EST)

On Wed, 10 Dec 2003, Ted Lemon wrote:

> Or, it could turn into a war of bug fixing, which would be constructive,
> and would motivate people to move to less buggy versions of their name
> server software.

I'm Doubtful. The (linux) fingerprint changes seem (to me anyway--not an
expert on the exact changes), gratuitous changes that aren't expected to
actually break anything. This is a far cry from fixing bugs.  Its just
busy work created by the need for a response to fingerprinting.  Its also
not usaully done in the mainline, but as optional changes, basically
making it seem like there are more versions then there are.

		--Dean

---

From: "Mathias Samuelson" <[email-masked]>
Date: Thu, 11 Dec 2003 09:34:47 +0100

> and would motivate people to move to less buggy versions of their name 

Just my $0.02. It's, as you all know, surprisingly often the case that 
the network operators aren't even aware of what version of software they 
are running. I've heard some people argue that they shouldn't run 
anything else than whatever version of BIND Sun bundles with Solaris, no 
matter how many vulnerabilities there's in that software. Obscuring the 
fact that one is running such software doesn't seem to be a good 
security measure anyway.

So, for what it's worth, I agree with those who are pro what Dean and 
Jakob is doing.

All best
Mathias
-- 
    Mathias Samuelson
Phone: +46 (0)8 5058 3111
      Dimension AB

You can fetch my GnuPG key (CB6D9D85) with fingerprint
B98BB34ADAA91D4F2F47E6363EC2C8BDCB6D9D85
from (e.g.) blackhole.pca.dfn.de.