Subject: Re: Hiding BIND version number

From: Stefan Jon Silverman <[email-masked]>
Date: Sun, 20 Dec 1998 09:38:33 -0500 (EST)

> From: John Gilmore <[email-masked]>
> 
> The people who wrote your security scanner are idiots.  Ignore this
> warning.  Knowing the version number is only of minor help in exploiting
> bugs; the usual way to exploit a bug in BIND is to simply try to exploit
> it.  If you succeed, it was the right version; if not, it was a fixed
> version.
> 
> 	John Gilmore
> 

	Amen to this thought -- first bit of "security sanity" that I
have seen in a very long time...If you follow the right lists, you know
when to upgrade -- if you don't, you should probably find another line
of work...

	Security through obscurity has never been one of my favored
methods of protecting anything...

    Regards,

    b c++'ing u,

    %-) sjs

PS: I am my own employer, therefore: "all opinions are twice spoken for;"
    and they do, in fact, scare the hell out of said employer!!!

-------------------------------------------------------------------------------
Stefan Jon Silverman - President                     SJS Associates, N.A., Inc.
                                                                     Suite 15-B
Inter-/Intra-Net Architecture, Implementation & Security    698 West End Avenue
                                                             New York, NY 10025
E-mail:    [email-masked]                                   Phone: 212 662 9450
Website:   http://www.sjsinc.com                            Fax:   212 662 9461
Text-Page: [email-masked]                              Cell:  917 929 1668
-------------------------------------------------------------------------------
                  Weebles wobble, but they don't fall down!!!
-------------------------------------------------------------------------------