The ISC would host a zone that would contain TXT records with
security/bug advisories for every version:
I have a better idea.
ISC could set up a web page that would contain security/bug advisories for
every version. In order to make it easier for people to find this web
page, it could be listed in various directories such as CERT. And it could
also be put into search engines so that someone could go to Google, type
in "BIND bug site:isc.org" and click "I'm Feeling Lucky".
yadda yadda yadda...
Indeed!
Let's face it folks, DNS is not the tool of choice for publishing anything
other than the mapping between hostnames and IP addresses.
For some things the web is better. For others LDAP is better. And for the
problem that Paul mentioned at the beginning there is only one solution;
the press.
The fact is that Paul wants to catch the attention of people who aren't
paying attention right now. He has stated that email notices don't work
and we can assume that the BIND security web page, and CERT's web pages
also don't work. No, there is only one thing Paul can do right now.
a. Collect some realistic numbers as to the number of DNS servers that are
vulnerable to the various exploits. Ask people who do network scanning to
provide some statistics on what they see and scale them up according to
the number of hosts in the host-count database. For example, assume that
someone has scanned N hosts and discovers that N/10 are running BIND and
that 40% of those are vulnerable. Also assume that the hostcount shows 20
million hosts in the world. Infer from this that there are 2 million BIND
servers and that there are 800,000 vulnerable ones. But do the
calculations with some real data, not my example figures.
b. Write a press release with the following headline:
N Thousand Internet Servers Suffer Same Fate as Iraqi Server
Or maybe write some variation on this but keep it scary and keep Iraq in
the headline. The body of the press release should explain the attacks
that the Iraqi server was suffering from, then point out how many other
servers are also vulnerable and then point out how terrorists could use
these vulnerabilities against us. If you can, name some specific
organizations where you know the vulnerability exists. Pick a large
organization or two that has many nameservers and the vulnerability exists
in some obscure corner of the organization, not on their main nameservers.
They really can't sue over this because you haven't damaged them by
disclosing enough detail for an attacker to use.
c. release to both the national press and the computer/network trade
press.
That's how you get people's attention and that's also how the clueful
technical people get the authority and funding to go in and fix the
vulnerable boxes. As long as we continue to play games and pretend that
Internet operations is still the old boys club that it once was, we will
continue to suffer from these nagging issues.
People on the NANOG mailing list do not run the Internet anymore. NANOG's
market share of network operations people has been steadily shrinking as
the Internet has grown. This may still be the moist clueful gathering
place, but there are an awful lot of people out there today designing,
building and operating networks, who have never heard of NANOG.
There is no universal forum anymore. The Internet isn't special anymore.
--Michael Dillon