1 |
Håkon Alstadheim wrote: |
2 |
> Crayon Shin Chan wrote: |
3 |
>> On Friday 11 May 2007 18:48, jarry@×××.net wrote: |
4 |
>> |
5 |
>>> Poor security of bind is imho similar superstition as it is |
6 |
>>> for sendmail: once in the past this software had some problem, |
7 |
>>> so now a lot of people think they should forever avoid using it... |
8 |
>>> |
9 |
>> If the OP doesn't need any bind-specific feature then why not use djbdns |
10 |
>> which has a better security track record. djb software are built from the |
11 |
>> ground up to be secure (as is possible), he also splits the "program" |
12 |
>> into smaller executables, each having a specific job thus making each of |
13 |
>> them secure a simpler task. Whilst bind and sendmail have made |
14 |
>> substantial efforts to be more secure, they are still built on legacy and |
15 |
>> bloated monolithic code. |
16 |
>> |
17 |
>> |
18 |
> Just to fill in the picture a bit, the djb* software also has a long |
19 |
> "flip-the-bird-at-any-rfc-you-don't-like" track-record. |
20 |
> |
21 |
|
22 |
I generally agree with Håkon on this. :-). |
23 |
|
24 |
The other issue is that djb likes to abandon his software after it's |
25 |
"done". Things like DNSSEC and dynamic updates don't exist in djbdns and |
26 |
aren't planned. They don't matter so much if you're just doing |
27 |
authoritative DNS, but if you're doing interesting thing on your network |
28 |
Bind is pretty much required. |
29 |
|
30 |
kashani |
31 |
-- |
32 |
gentoo-user@g.o mailing list |