Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

61–70 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#61

Post by koverstreet »

rlpb wrote: post #51
koverstreet wrote: post #44

Earlier quoted context omitted.

You definitely need different channels for high priority fixes and normal releases, stable and testing releases and all that. But two years is impractical and Debian gets a ton of friction over it. Web browsers and maybe one or two other packages are able to carve out exceptions, because those packages are big enough for the rules to bend and no one can argue with a straight face that Debian is going to somehow muste…

> ...upstream package maintainers who are expected to deal with bug reports from ancient versions... They are not expected to deal with this. This is the responsibility of the Debian package maintainer. If you (as an upstream) licensed your software in a manner that allows Debian to do what it does, and they do this to serve their users who actually want that, you are wrong to then complain about it. If you don't wan…

If package maintainers were always fine upstanding package maintainers as you imagine them to be I wouldn't be complaining, but I have in fact had Debian ship my software and screw it up and gotten a flood of bug reports, so... :)

I think you need to chill out. Relicensing the way you suggest would be _quite_ the hostile act, and I'm not going to that either. But I am an engineer, so of course I'm going to talk about engineering best practices when it comes up.

You don't have to take it as an attack on your favorite distro - that really does pee in the pool of the upstream/downstream relationship between distros and their upstream.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#62

Post by vel0city »

toast0 wrote: post #58
koverstreet wrote: post #33

Earlier quoted context omitted.

You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... So when you do update and get that GSSAPI change, it comes with two years worth of other updates - and tracking that down mixed in with everything else is going to be all kinds of fun. And if you're two years out of the loop and it turns out upstream bro…

> You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... Doing terrible work every 2 years is better than doing it every day?

Personally I'd rather have a manageable stream of little bad things consistently over time rather than suddenly having a mountain of bad things one day.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#63

Post by fc417fc802 »

daneel_w wrote: post #47
binaryturtle wrote: post #43

Earlier quoted context omitted.

That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to…

> Why should I switch over to something way less proven? Must they prove their software to you? They're offering an alternative, not bargaining for a deal.

When you offer up an alternative as technically superior in some manner then yes, it is on you to demonstrate such a claim in a convincing manner. "No bugs in 3 years in this software with a much smaller audience and also look AI audits!" comes across as off topic shameless self promotion. At least if an insightful technical discussion ensued the subthread might prove worthwhile but so far it's just the usual tired shit flinging.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#64

Post by asveikau »

washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

You can always ask the Debian project for your money back.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#65

Post by 3ASAF »

philipwhiuk wrote: post #56
rela-12w987 wrote: post #36

The AI bug report tsunami is not in all projects. As the top comment notes, MaraDNS didn't have any. I assume djbdns and tinydns didn't either, otherwise they'd shout it from the rooftops. I never understood why some projects get extremely popular and others don't. I also suspect by now that the reports by tools that are "too dangerous to release" scan all projects but selectively only contact those with issues, so t…

> The AI bug report tsunami is not in all projects. It's in popular projects.

No, postfix hasn't had a single valid bug found by AI. There are legions of other projects as well.

It is a distorted view, because projects become popular by allowing indiscriminate commits, bugs, maintainers.

If I'd start a new project I'd allow anyone in and blog about 100 exploits every year, because that is exactly what people want. I'm serious.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#66

Post by shakna »

strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#67

Post by cwillu »

vel0city wrote: post #62
toast0 wrote: post #58

Earlier quoted context omitted.

> You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... Doing terrible work every 2 years is better than doing it every day?

Personally I'd rather have a manageable stream of little bad things consistently over time rather than suddenly having a mountain of bad things one day.

That's great; I prefer something different.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#68

Post by cwillu »

SoftTalker wrote: post #49

Never liked using dnsmasq. Always felt like too much in one tool. A local caching resolver, dhcp server, and tftp/pxe boot setup were always things I preferred to configure separately.

That line of thinking is exactly why I ended up using maradns for my dns hosting way back.

10/10, no regrets, would recommend.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#69

Post by 3ASAF »

strenholme wrote: post #60
zamadatix wrote: post #52

Earlier quoted context omitted.

"All software has bugs" so "be wary of the one trying to say they haven't had any in 3 years" not so "I guess all are equal". For extremely low security bug rates either the scope is extremely narrow, the claim is dubious, or the project is a massive effort which the community talks about directly in posts rather than plugs (e.g. curl).

DJB, with Qmail and DjbDNS (as well as Publicfile, which didn’t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being “extremely narrow”, and without the claim being “dubious”. It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. If one thinks the claim of no security b…

People here don't know that MaraDNS was already popular on extremely critical security mailing lists that basically hated anything but qmail and postfix. If you introduce more bugs and blog about them, it will probably gain in popularity. :)

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#70

Post by cwillu »

strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

I remember being delighted finding maradns as an alternative to the “do everything” of dnsmasq way back when I set up a dns server, and more importantly, I haven't had to think about it since then.
Post reply on HN