RE: Does blocking TCP DNS packets keep your Bind safe?

["Reckhard, Tobias" <Reckhard () secunet de>]

> BIND is written in C and for better or worse, C is *HARD* to program in
> a secure and safe manner, especially when you have an application as large
> and complex as BIND is.
Exactly, one of the main reasons for BINDs problems are its complexity. And
complexity is very dangerous to security, as we all know. The question that
remains is whether a name serving and proxying package needs to be as large
and complex as BIND--djbdns seems very lightweight in comparison. What is it
that it can't do for you that BIND can (allow me to exclude DNSSEC) and that
justifies BINDs complexity?

Tobias

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards