Root-server switches from BIND to NSD

A Sorry End writes "It appears that one of the 13 root-servers, the core of DNS name resolution, have moved away from BIND to NSD since wednesday, Feb 19th, 2003, which is a Good Thing. Since the 26th of october 1990, all root-servers have been running BIND. According to this message, this change was designed to increase the diversity of software in the root name server system, the lack of which is widely considered to be a potential vulnerability. The nsd software has been designed from scratch specifically as an authoritative name server. It has no design commonalities with bind, the currently prevalent DNS implementation. In addition to that nsd provides a significant increase in the performance reserve of k.root-servers.net. NSD was developed at NLnet Labs in coorperation with RIPE."

Comments

Hehe

[zapfie]

Well.. I guess they're not in a BIND anymore!

...god, that was the worst joke ever. Someone shoot me.

Re:Hehe

[DonkeyJimmy]

...god, that was the worst joke ever. Someone shoot me.

I would shoot you, but I can't find you because your name isn't resolving for some reason.

Re:Hehe

[teamhasnoi]

However, the admins of the new servers seem to have NSD cold.

I may have taken that bullet for you...

Diversity?

[Anonymous Coward]

Man, my company would be majorly pissed off. We don't want diversity, we want conformity!! All systems should be running one OS for ease of administration and that OS should be Windows2000. Thankfully I'm offsite and use Linux. ;-)

Re:So how secure is it?

[Anonymous Coward]

Because BIND is a rock of stability.

they should use djbdns

[Anonymous Coward]

Really, look at all the advantages of djbdns:

* free software, under the BSD license (makes it easy to redistribute binaries)

* easy package-based installer (easy to find everything, or to install djbdns in different locations)

* easy to configure with a single config file

* great support from the author, who's a really friendly guy.

Oh wait. NONE OF THAT IS TRUE. Never mind.

Re:they should use djbdns

[Beatbyte]

Anonymous? I THINK NOT!

Re:Similar

[squiggleslash]

This sounds a little to general to me, almost PR'ish.

It has no design commonalities with bind

What does that REALLY mean?

It's true. They didn't even look at the same RFCs... ;-)

affirmative action

[Bull999999]

What they didn't tell you was that the move was mostly due to affirmative action, to ensure diversity on the Internet. Why do you think that IIS is still hanging around?

Affirmative action: More than just for humans.

Back to switchboards

[binaryDigit]

I think they should replace the root dns servers with an old fashion switchboard. I envision a large room in the bowels of VeriSign "manned" by an army of women wearing grey suits with horn rimmed glasses. A dns request will come in via pnuematic tube, the operator will pull one spring loaded ethernet cable from her console and plug it into the correct corresponding jack.

While being resistant to any port based DDOS attacks, they would be DOSable by having some hunky dude drink a pepsi outside their window.

Acronyms galore

[ruiner13]

Wow, all those acronyms are making my head spin. Sigh. What does the NSA think about the DNS servers switching from BIND to SND? Does it make thier TPS reports PDQ? I'd sure hope it uses SQL somehow too.

Security through _______

[Neillparatzo]

Isn't it bad luck to have 13 root servers?

I mean if you're going to be superstitious to the point of worrying about code diversity or eyeballs-per-source-file, I think this is an issue that needs to be addressed.

Re:Security through _______

[TeknoHog]

> Isn't it bad luck to have 13 root servers?

No, but it's bad luck to be superstitious.

Only...

[devphil]

...if the 14th is named bilbo.root-servers.net, and is added specifically for the purpose of breaking the bad luck.

Sorry, heavy geek moment there.

Exactly!

[sterno]

I mean look at Windows. It's had this long reputation of being insecure, so naturally everybody assumes it still is. When really it's... oh... nevermiond.