Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

101–110 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#101

Post by dc396 »

rgkpz wrote: post #45
binaryturtle wrote: post #43

Earlier quoted context omitted.

That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to…

"All software has bugs" is the most meaningless statement ever. It is just used for bonding with fellow bug writers who sit at a virtual campfire and muse about inevitabilities. Demonstrably some software has fewer bugs, and its authors are often hated, especially if they are a lone author like Bernstein. Because it must not happen! Projects with useless churn and many bug reports are more popular because only activi…

If DJB is "hated", it isn't because he's a lone author (Linus Torvalds was once a lone author and I don't think he was hated). It's because he can be an asshole. To quote George Bernard Shaw, “The reasonable man adapts himself to the world: the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man.”

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#102

Post by VorpalWay »

andrewjf wrote: post #94
gcr wrote: post #83

Earlier quoted context omitted.

MaraDNS is much less popular than dnsmasq though. I have several libraries that I've written. Not one single serious security bug in them has been found since 1991. Granted, nobody uses my libraries... Not to diminish your team's achievement! :D But it's important to contextualize claims like this with information about what your userbase looks like

I don't think that's relevant. You can still find security issues in software nobody uses. The question is a matter of impact because of how used the software is.

Way fewer people are going to look at obscure things, so a lower percentage of issues will likely have been found. There is less fame and fotune in spending security research time on obscure software. Most small libraries won't be covered by any bug bounty programs either for example.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#103

Post by koyote »

SoftTalker wrote: post #49

Never liked using dnsmasq. Always felt like too much in one tool. A local caching resolver, dhcp server, and tftp/pxe boot setup were always things I preferred to configure separately.

I agree, it also goes against the Linux "way of doing things". For example, Opnsense uses the dhcp portions of dnsmasq only (and unbound for the dns parts) which just feels 'wrong'.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#104

Post by andrewjf »

VorpalWay wrote: post #102
andrewjf wrote: post #94

Earlier quoted context omitted.

I don't think that's relevant. You can still find security issues in software nobody uses. The question is a matter of impact because of how used the software is.

Way fewer people are going to look at obscure things, so a lower percentage of issues will likely have been found. There is less fame and fotune in spending security research time on obscure software. Most small libraries won't be covered by any bug bounty programs either for example.

You don't need other people anymore to find security issues, you can do it yourself with AI.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#105

Post by x3n0ph3n3 »

unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

I disagree -- we're clearly getting better safeguards by way of AI agents to spot potential vulnerabilities!

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#106

Post by leptons »

aftbit wrote: post #54

Has OpenWRT released a new build yet? Answer: no, but they're working on it. https://forum.openwrt.org/t/dnsmasq-set-of-serious-cves/2500...

DD-WRT is also on point...

https://github.com/mirror/dd-wrt/issues/465

https://svn.dd-wrt.com/changeset/64944

https://svn.dd-wrt.com/changeset/64905

The release is "coming soon".

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#107

Post by gerdesj »

koyote wrote: post #103
SoftTalker wrote: post #49

Never liked using dnsmasq. Always felt like too much in one tool. A local caching resolver, dhcp server, and tftp/pxe boot setup were always things I preferred to configure separately.

I agree, it also goes against the Linux "way of doing things". For example, Opnsense uses the dhcp portions of dnsmasq only (and unbound for the dns parts) which just feels 'wrong'.

When I first came across Linux you would download the code (very slowly) to /usr/src/linux (extract and cd) and run "make config". You'd answer quite a lot of y/n and later y/n/m questions and then copy a binary and later on run a script to put things in place. Then you would fix up lilo and off you trot ... or not 8)

Is that the Linux way you are on about? No obviously not 8)

I think you mean the "unix idealized but never really happened exactly but we are quite close if you squint a bit ... way" where each tool does one job well and the pipeline takes up the slack.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#108

Post by zx8080 »

rgkpz wrote: post #45
binaryturtle wrote: post #43

Earlier quoted context omitted.

That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to…

"All software has bugs" is the most meaningless statement ever. It is just used for bonding with fellow bug writers who sit at a virtual campfire and muse about inevitabilities. Demonstrably some software has fewer bugs, and its authors are often hated, especially if they are a lone author like Bernstein. Because it must not happen! Projects with useless churn and many bug reports are more popular because only activi…

> "All software has bugs" is the most meaningless statement ever.

It's not! It's the foundation of all dev AI products marketing.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#109

Post by dwattttt »

toast0 wrote: post #58
koverstreet wrote: post #33

Earlier quoted context omitted.

You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... So when you do update and get that GSSAPI change, it comes with two years worth of other updates - and tracking that down mixed in with everything else is going to be all kinds of fun. And if you're two years out of the loop and it turns out upstream bro…

> You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... Doing terrible work every 2 years is better than doing it every day?

I've brought this up with leap second adjustments; a process you do once every two years is one you'll never get good at. If you want them to go smoothly, do them monthly.

LetsEncrypt has been a great example of this in certificate management.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#110

Post by [deleted] »

koverstreet wrote: post #22
zrm wrote: post #12

Earlier quoted context omitted.

They're not going to put a newer version in stable. The way stable gets newer versions of things is that you get the newer version into testing and then every two years testing becomes stable and stable becomes oldstable, at which point the newer version from testing becomes the version in stable. The thing to complain about is if the version in testing is ancient.

No, that's exactly the thing to complain about. That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. Not to mention, you think the C of today is bad? Have you looked at old C? And the disadvantage is that backporting is manual, resource intensive, and prone to error - and the p…

[deleted]
Post reply on HN