Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

71–80 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#71

Post by fc417fc802 »

strenholme wrote: post #60
zamadatix wrote: post #52

Earlier quoted context omitted.

"All software has bugs" so "be wary of the one trying to say they haven't had any in 3 years" not so "I guess all are equal". For extremely low security bug rates either the scope is extremely narrow, the claim is dubious, or the project is a massive effort which the community talks about directly in posts rather than plugs (e.g. curl).

DJB, with Qmail and DjbDNS (as well as Publicfile, which didn’t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being “extremely narrow”, and without the claim being “dubious”. It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. If one thinks the claim of no security b…

> It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years.

Can you back that claim up with at least some sort of theory? Because it doesn't match my perception of the real world, nor does it match my mental model of how CVEs happen.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#72

Post by raggi »

PhilipRoman wrote: post #32
dist-epoch wrote: post #7

How bad is it if someone infects my home router using such a thing? They can MITM non-encrypted requests, but there are not a lot of those, right? What else can they do, assuming the computers behind the router are all patched up.

If you blindly TOFU ssh sessions, those can be pwned easily in many common use cases. Legacy software configurations like NFS with IP authentication will be bypassed. Realistically the most likely scenario is using your home as a VPN, or a DDOS node.

yeah, and it's not like people recently launched a coffee shop that accepts payments over tofu ssh and a shell provider doing the same

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#73

Post by koverstreet »

bluGill wrote: post #46
koverstreet wrote: post #22

Earlier quoted context omitted.

No, that's exactly the thing to complain about. That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. Not to mention, you think the C of today is bad? Have you looked at old C? And the disadvantage is that backporting is manual, resource intensive, and prone to error - and the p…

You have far too much faith in automated testing. Don't get me wrong, I use and encourage extensive automated testing. However only extensive manual testing by people looking for things that are "weird" can really find all bugs. (though it remains to be seen what AI can do - I'm not holding my breath)

100% - but that's where writing regression tests when people find things really helps with the stress levels of future-you :)

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#74

Post by fc417fc802 »

koverstreet wrote: post #61
rlpb wrote: post #51

Earlier quoted context omitted.

> ...upstream package maintainers who are expected to deal with bug reports from ancient versions... They are not expected to deal with this. This is the responsibility of the Debian package maintainer. If you (as an upstream) licensed your software in a manner that allows Debian to do what it does, and they do this to serve their users who actually want that, you are wrong to then complain about it. If you don't wan…

If package maintainers were always fine upstanding package maintainers as you imagine them to be I wouldn't be complaining, but I have in fact had Debian ship my software and screw it up and gotten a flood of bug reports, so... :) I think you need to chill out. Relicensing the way you suggest would be _quite_ the hostile act, and I'm not going to that either. But I am an engineer, so of course I'm going to talk about…

> I am an engineer, so of course I'm going to talk about engineering best practices when it comes up.

The trouble is you seem to be assuming that best practices for you, in your opinion, also apply to everyone else. They don't. Not everyone sees things the way you do or is facing the same issues or is making the same set of tradeoffs. There are downsides to what debian does but there are also upsides.

At this point, given the plethora of high quality options available as well as how easy it is to mix and match them on the same system thanks to container-related utilities and common practices I really don't think there's any room for someone who doesn't like the debian model (ie in general, as opposed to targeted objections) to complain about how they do things. If you want cutting edge userspace on debian stable at this point you have at least 3 options between nix, guix, and gentoo. There's also flatpak and snap which come built in.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#75

Post by strenholme »

fc417fc802 wrote: post #63
daneel_w wrote: post #47

Earlier quoted context omitted.

> Why should I switch over to something way less proven? Must they prove their software to you? They're offering an alternative, not bargaining for a deal.

When you offer up an alternative as technically superior in some manner then yes, it is on you to demonstrate such a claim in a convincing manner. "No bugs in 3 years in this software with a much smaller audience and also look AI audits!" comes across as off topic shameless self promotion. At least if an insightful technical discussion ensued the subthread might prove worthwhile but so far it's just the usual tired s…

I have far more evidence of a very good security record with MaraDNS than “No bugs in 3 years in this software with a much smaller audience and also look AI audits!”

• The software has been around for 25 years

• The software is popular enough to have been subjected to dozens of security code audits, including two audits in the post-AI era

• In those 25 years, only two remote “packet of death” bugs have been found

• Also, in those same 25 years, only one single bug report of remotely exploitable memory leaks has been found

This isn’t something which, as implied here, has a lot of security bugs only because no one has used or audited the software. This is a long term, mature code base which has only had a few serious security bugs in that timeframe.

Here is my evidence:

https://samboy.github.io/MaraDNS/webpage/security.html

If this evidence isn’t “convincing” to you, I don’t know what evidence would be “convincing”.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#76

Post by toast0 »

vel0city wrote: post #62
toast0 wrote: post #58

Earlier quoted context omitted.

> You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... Doing terrible work every 2 years is better than doing it every day?

Personally I'd rather have a manageable stream of little bad things consistently over time rather than suddenly having a mountain of bad things one day.

That's a fine choice, but it doesn't fit with using packaged software from Debian stable.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#77

Post by strenholme »

fc417fc802 wrote: post #71
strenholme wrote: post #60

Earlier quoted context omitted.

DJB, with Qmail and DjbDNS (as well as Publicfile, which didn’t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being “extremely narrow”, and without the claim being “dubious”. It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. If one thinks the claim of no security b…

> It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. Can you back that claim up with at least some sort of theory? Because it doesn't match my perception of the real world, nor does it match my mental model of how CVEs happen.

Yes, I can.

https://samboy.github.io/MaraDNS/webpage/DNS.security.compar...

Also, my sister post: https://news.ycombinator.com/item?id=48112042

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#78

Post by ryandrake »

zie wrote: post #42
koverstreet wrote: post #33

Earlier quoted context omitted.

You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... So when you do update and get that GSSAPI change, it comes with two years worth of other updates - and tracking that down mixed in with everything else is going to be all kinds of fun. And if you're two years out of the loop and it turns out upstream bro…

Clearly you disagree with the debian stable perspective. That's fine, it's not for everyone. You can just run debian unstable or debian testing, depending on where exactly you draw the line. If you want the rolling release like distro, just run debian unstable. That's what you get. It's on par with all the other constantly updated distros out there. Or just run one of those. Also, Debian stable has a lifetime a lot l…

...or just leave grandparents on the previous version of Stable until they get a new computer. Honestly not a huge fan of upgrading software at all, if I'm the one supporting the machines.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#79

Post by fc417fc802 »

strenholme wrote: post #77
fc417fc802 wrote: post #71

Earlier quoted context omitted.

> It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. Can you back that claim up with at least some sort of theory? Because it doesn't match my perception of the real world, nor does it match my mental model of how CVEs happen.

Yes, I can. https://samboy.github.io/MaraDNS/webpage/DNS.security.compar... Also, my sister post: https://news.ycombinator.com/item?id=48112042

Is that not begging the question? You have asserted X and now you point to a particular track record to back the claim of X up but the track record only serves as valid evidence of X if we already accept your assertion that X is the case.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#80

Post by fc417fc802 »

strenholme wrote: post #75
fc417fc802 wrote: post #63

Earlier quoted context omitted.

When you offer up an alternative as technically superior in some manner then yes, it is on you to demonstrate such a claim in a convincing manner. "No bugs in 3 years in this software with a much smaller audience and also look AI audits!" comes across as off topic shameless self promotion. At least if an insightful technical discussion ensued the subthread might prove worthwhile but so far it's just the usual tired s…

I have far more evidence of a very good security record with MaraDNS than “No bugs in 3 years in this software with a much smaller audience and also look AI audits!” • The software has been around for 25 years • The software is popular enough to have been subjected to dozens of security code audits, including two audits in the post-AI era • In those 25 years, only two remote “packet of death” bugs have been found • A…

For what it's worth I didn't know about maradns prior to this. Maybe it actually sees fairly wide use? Whether or not I accept your evidence would hinge on that. Regardless I think my point stands - if you don't lead with a convincing line of reasoning all that's left is an empty assertion. Unless I happen to recognize you as an authority in the field that's not going to do anything for me since by default you're some stranger on the internet that might be a dog for all I know.

To illustrate the issue with an extreme example, consider that a disused repository on github full of security holes is highly unlikely to have any CVEs regardless of age. The software has to present a worthwhile target (ie have a substantial long term userbase) before anyone will bother to look for exploits. (I guess that might change in the near future thanks to AI but I don't think we're there just yet.)

Post reply on HN