Re: update on the djbdns bugs?

On Sep 28, 2008, at 3:31 PM, Paul Theodoropoulos wrote:
> seven weeks now.
>
> seriously, if you found you were wrong about this issue, then a  
> responsible investigator reports back that the original claim was  
> erroneous - rather than leaving it hanging there like a fart in a  
> warm room.  if you're still working on it, then "we're still working  
> on it" is appropriate, since 'soon' long ago lapsed.
>
> either there's an issue - serious or not - or there is no issue. it  
> becomes FUD when a definitive statement is never forthcoming - seven  
> weeks is certainly not within any reasonable definition of "soon".


Sorry for the delay, I've had a whole heck of a lot going on.

I'm trying to be as responsible as I can here. There is a real, but  
not earth-shattering problem with djbdns with regard to spoofing. The  
same type of issue may also be present in another DNS package, but  
it's proving to be considerably harder to quantify and isolate, so I  
want to do the right thing and not say "This problem exists in djbdns"  
and have someone 5 minutes later realize it's also in product X where  
it's potentially worse.

I am still working on all of this though, with some gracious help from  
a few people with far more mathematical skills than I have to exactly  
quantify the risk and correctness of a fix. We all believe that  
releasing a document that accurately describes the problem in ways I  
can't would be far better for everyone than to just release a diff and  
try to explain why it may help.


That said, I will make every attempt to expedite this, since I know  
you guys are waiting.

-- Kevin