djbdns
[Top] [All Lists]

Re: My criticisms of DjbDNS

To: Sam Trenholme <sam+djbdns@chaosring.org>
Subject: Re: My criticisms of DjbDNS
From: Cory Wright <cwright@standblue.net>
Date: Thu, 15 Mar 2007 00:34:24 -0500
Cc: dns@list.cr.yp.to
Delivered-to: sp-com-lists@consult.net
Delivered-to: gmail-djbdns@securepoint.com
Delivered-to: sp.com.list@gmail.com
Delivered-to: mailing list dns@list.cr.yp.to
In-reply-to: <20070315001818.772F8D7510C@mail.literati.org>
Mailing-list: contact dns-help@list.cr.yp.to; run by ezmlm
References: <20070315001818.772F8D7510C@mail.literati.org>

On Mar 14, 2007, at 7:18 PM, Sam Trenholme wrote:
This goes back to the djbdns license; the person who blamed the user for
a djbdns problem really had no other choice. He could not patch djbdns
and distribute a modified djbdns to fix the issue.

This is an often cited issue, but I am a little curious about who all these people are that have the need to distribute modified versions of djbdns. If you need to distribute custom packages internally among your own systems it isn't really a problem. Maybe it is a problem for distributors such as Red Hat and Novell, but Debian and Ubuntu have found ways around the licensing issue and still provide packages (although they are source builds). Who are all these people who are anxious to distribute modified versions of djbdns?

The only issue I have here is that DJB has not applied simple updates to djbdns, such as the /etc/dnsroots.global patch for the current root servers, thus causing a somewhat misconfigured system out of the box. I know it is simple to update/patch, but it seems it would be just as easy for DJB to update the source as well. Same for the errno.h change to conf-cc.

Djbdns was the best DNS option available when it came out. That was
over five years ago. Since then, the internet has changed and djbdns has
not kept up.

Although the Internet has changed over the last five years, I do not believe there have been any significant changes to DNS in that time. djbdns is just as good a choice today as it was when it was released (or better, as it now has a 5+ year reliability record).

Now that BIND9 and MaraDNS have a proven security record,

As someone who has run a large BIND system in the past, I can say that it's security issues are only one part of the problem. The startup time on systems with over 300k domains is simply unacceptable, even on massive hardware. This alone was reason enough to switch to tinydns.

I would personally like to see an updated "DNS Server Survey" to see what level of adoption djbdns (particularly tinydns) has these days. The most recent survey I can find is from 2004, although DJB's own survey is even older.

Cory

--
Cory Wright
http://ants.wynand.com/



<Prev in Thread] Current Thread [Next in Thread>