Re: update on the djbdns bugs? (fwd)

My email records contradict that.  I talked about these very changes
with Dan Kaminsky and Kevin Day and Paul Theo.  in October 2008.

Kevin Day and Dan Kaminsky are working on a patch in August-October
2008:

==============================

Just to clarify... I had no intention of bringing ANY of this up into  
the mailing lists until I was completely certain I was ready to  
discuss it. Through a bit of a harmless miscommunication, Dan Kaminsky  
said something at a talk about djbdns that wasn't completely ready for  
me to talk about. It got mentioned on the mailing list, and I was  
asked to explain, so I did hoping it wouldn't blow up into something  
that people *did* think was politically/maliciously derived.

I'm working on things *right this second* to hurry it up so I can  
release everything. The intent of my post was not to stir up any  
trouble, but rather to calm people down. I'm a djbdns user myself, and  
don't want it to look bad.

-- Kevin

==============================



The last thing I said was (replying to my own message, a reply to
Kaminksy): 

==============================


On Wed, 8 Oct 2008, Dean Anderson wrote:

> > The reason you share ports is precisely to make the port random, rather
> > than exhaustable.  There are DNS stacks that won't allow multiple
> > outstanding QID's with the same number, and they're problematic.  The
> > other way to prevent exhaustion is to just not have MAXUDP==65536.
> 
> Wrong. If you share ports, then you have to look for a valid query id
> for _ANY_ response on a correct port.  This greatly increases the odds
> of a collision, because then a correct port will have multiple possible
> correct queryids, instead of exactly one.  Are you trying to engineer
> weakness?

Can you send me your other patches?  I have some concerns about those 
patches, based on your incorrect analysis of these problems.

                --Dean

==============================

After this, I heard nothing more from them.

Then Jeff King turns up with the patches.  And "Mark Johnson"  
distributes them anonymously with no accountability, with more tweaking.  
Struck me as just like money-laundering. I called it reputation and
accountability laundering.

		--Dean


On Thu, 11 Mar 2010, Jeff King wrote:

> On Thu, Mar 11, 2010 at 10:56:16AM -0500, Paul Jarc wrote:
> 
> > That claim is actually correct with Jeff's patch.  Dan apparently
> > doesn't understand what the patch does, so it seems safe to say he
> > wasn't involved in developing it.
> 
> I think I have stated this before, but for the record, no, Dan had
> nothing to do with the development of my patch.  A mutual friend told
> Kevin that I knew something about the djbdns code base, Kevin described
> the problem to me by email (there was no paper yet), I understood the
> problem from that and wrote the patches. And those patches are what
> Kevin posted when he announced the issue.
> 
> So while credit goes to Kevin for seeing the problem, he had nothing to
> do with writing patches, and certainly neither did Dan Kaminsky. Any
> bugs or design flaws are mine alone.
> 
> -Peff
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 256 5494