Slashdot Mirror


BIND 9.3 Released With Commercial Support

darthcamaro writes "Time for net admins to update BIND: version 9.3 has been released. internetnews.com has a story on it where they talk with Paul Vixie, the founder of BIND's keeper ISC. In it he details why after so many years BIND has finally decided to offer commercial support. 'Many of the companies who use our software free of charge have told us that their corporate risk management strategy requires them to have a bona fide support channel for all of their critical operations,' Vixie said. 'In other words we were told that having the best software wasn't good enough, and giving it away for free wasn't good enough, we also had to ensure that commercial support was available or they could be forced to switch to software they didn't like as well just to get support.' The full press release on the BIND 9.3 release is also available."

55 of 224 comments (clear)

  1. Wait till the next exploit,,, by darkjedi521 · · Score: 4, Informative

    Wasn't at one time BIND the IIS of the unix world? This could open them up to a world of problems if/when the next exploit shows up.

    1. Re:Wait till the next exploit,,, by otis+wildflower · · Score: 3, Informative

      No, you're thinking of Sendmail.

    2. Re:Wait till the next exploit,,, by Rosco+P.+Coltrane · · Score: 5, Funny

      I'm sorry, but who even uses BIND anymore? an article like that on 66.35.250.150 is truly News for Nerds...

      --
      "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
    3. Re:Wait till the next exploit,,, by John+Starks · · Score: 5, Informative

      Exploits are not uncommon in BIND, even today. Take a look at their security alert page, especially the matrix at the bottom. Security problems abound!

      It's not clear why people continue to use BIND. It's probably because it's just assumed that it's the only thing out there. But everything from security to configuration is poorly done in BIND. I use tinydns (part of djbdns) instead on all my servers. It's written by Daniel Bernstein, the same guy that wrote qmail. He's got a great track record -- no security holes in any of his software, AND he backs up that assertion with a $1000 prize to anyone that finds such a hole. He makes a better case than I do for tinydns/qmail vs. BIND/sendmail than I ever could.

    4. Re:Wait till the next exploit,,, by macdaddy · · Score: 3, Insightful
      Anyone who understand DNS, their OS's limits, and software applications can deploy BIND 9 in a frighteningly secure manner.

      ...and anyone that doesn't understand DNS, their OS's limits, or software applications should not be running any server, let along a nameserver, PERIOD, IMHO. The problem today is that there are way to damned many incompotent imbeciles that call them selves admins. Most of the rejects think they know Windows pretty well and thus can run any kind of server. It's really a sad state of affairs. I wish there was a certification that people had to acquire before they could call themselves an admin of any platform.

      I run Bind. I run Sendmail. I'll always use both. I supplement Bind with rbldnsd. I have no need to supplement Sendmail. Both do what I want. Since I'm not an incompotent moron I don't have any trouble configuring either of them. The claims people make about both/either being difficult to admin or insecure are complete bullshit. If the person was a half-assed compotent admin neither would be a problem. I swear, what is the world coming to....

    5. Re:Wait till the next exploit,,, by Florian+Weimer · · Score: 4, Informative

      Exploits are not uncommon in BIND, even today.

      Critical exploits in BIND 9 still have to show up. The really nasty bug so far was actually in OpenSSL.

      It's not clear why people continue to use BIND.

      For the full resolver part, their are hardly any alternatives. If you need DNSSEC, your options besides BIND are even more limited.

      tinydns is unusable for most people (who aren't masochists) because it doesn't conform to existing standards and parctice. Just speaking the DNS protocol is not enough, you also have to implement some of BIND's quirks, and more important: the software has to be maintained. DNS is still evolving, DJB's software is not. (Some of it doesn't even compile on modern, POSIX-conforming systems.)

    6. Re:Wait till the next exploit,,, by ectoraige · · Score: 4, Insightful

      It's not clear why people continue to use BIND.

      I continue to use BIND because I don't like DJB's licence.

      --
      Vs lbh pna ernq guvf, ybt bss abj. Tb bhgfvqr. Syl n xvgr.
    7. Re:Wait till the next exploit,,, by the+morgawr · · Score: 3, Insightful
      If he doesn't give you a license, you are stuck with the default rights under Copyright Law. That's DJB's "license".

      As such you can't make changes and distribute them as part of a integrated set (in theory you could distribute just the patches but it's a grey area). Hence many people consider it "un-free". Some people see this as a problem.

      --
      The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
  2. This is a simple reality in corporate use by Martin+Blank · · Score: 5, Insightful

    No support, no sale.

    I can understand it to a degree; there's no guarantee that the version installed today will not be completely dropped next month. It gets a little aggravating when it holds up an entire project, though, because of one small piece.

    The upside, of course, is more funding for critical projects.

    --
    You can never go home again... but I guess you can shop there.
    1. Re:This is a simple reality in corporate use by Dark+Lord+Seth · · Score: 2
      there's no guarantee that the version installed today will not be completely dropped next month.

      As far as I know, that doesn't stop a whole lot of software companies from doing just that every year, forcing their customers to either upgrade at 80% of the full price or watch support for their current version dwindle down to the eventual EOLing in a year or two, maybe three. That is two or three years/version down the road of said product.

      Also, what kind of support are we talking about here? REAL support as in talking to one of the developers regarding some weird bug one has encountered? Or support as in cheapo callcenter with underpaid operators where your worth is judged on how quickly you get your ass of the line?

    2. Re:This is a simple reality in corporate use by Shakrai · · Score: 4, Insightful
      Many of these support contracts are really just the "Circuit City Extended Waranty" of the corporate world.

      Have you ever known a PHB that didn't get the extended Circuit City warranty? That's what this is all about -- selling it to the PHBs of the World so we can go on using our OSS that we know works and even with the support contract is cheaper then the commercial alternative.

      --
      I want peace on earth and goodwill toward man.
      We are the United States Government! We don't do that sort of thing.
    3. Re:This is a simple reality in corporate use by KimiDalamori · · Score: 2, Insightful

      Why would a coporation be worried about it being dropped? If anything, Open Source projects seem to be a haven for ancient code where it can linger on forever and ever, continually being tweeked and improved over the ages.

      On the other hand, I suppose if some huge IT company wanted to give me money for something I did for free in the community-based support forums alredy availiable, I'd take it too.

      --
      Lagito ergo expectabo
    4. Re:This is a simple reality in corporate use by NineNine · · Score: 5, Insightful

      It's not about whether it works or not. It's about being able to call somebody at 2:00AM when a critical machine goes down, as opposed to waiting for your Usenet post to get propogated, then hoping that l334G33k425 responds to your message in a timely manner and gives you the correct answer. Case in point... my retail businesses have a POS system that I paid for. Granted, there aren't any truly viable OSS ones out there yet, but assume there are. It's worth the money for me to be able to get someone on the phone 30 seconds after it crashes to get my business running again. Or if an employee fucks something up, I know that I can absolutely get someone on the phone who will eventually fix my problem. I don't care how good a competing OSS project is supposed to be: no software is perfect, and there absolutely, positively MUST be someone to fix it when the shit hits the fan (as it always does, eventually). When your rent & power bill & paycheck is on the line every day (as mine are), you don't fuck around. Period.

    5. Re:This is a simple reality in corporate use by Martin+Blank · · Score: 4, Interesting

      In my experience, it doesn't matter if support is 24/7 or three hours a day on odd days of the week every other month. So long as there's a support contract involved, that will get it in over something that has no formal support. I've seen companies buy one product over another solely because, while both are commercial software, one of them offers an option for a support contract and the other does not, whether or not the other one is paid support.

      Where I'm at now, it's not uncommon to see support contracts for one product (and not anything from or as ubiquitous as Microsoft, either) reach a quarter of a million dollars a year or more. It's insane.

      --
      You can never go home again... but I guess you can shop there.
    6. Re:This is a simple reality in corporate use by jdray · · Score: 4, Insightful

      While I wouldn't have put it quite the way you did, I have to agree with you. If the OSS community keeps up the attitude that Shakrai puts forth, adoption into corporate datacenters and business areas will be slow and agonizing. As you said, people want assurances.

      The upside is that companies are used to and willing to fork over large sums of cash for those assurances. So, if you love an OSS project enough to dedicate your life to it, then get to know it inside and out and start offering commercial support for it. If the product is stable, you never have to answer the phone. If you charge $500 per year for support, 100 customers makes for a tidy income. And, honestly, most midsize corporations wouldn't even blink at $500 per year for support on something that goes on a server, unless it was in astonishment at how cheap it was.

      --
      The Spoon
      Updated 6/28/2011
    7. Re:This is a simple reality in corporate use by ron_ivi · · Score: 3, Insightful
      Places I've been, it's taken Oracle Support *days* to get systems up and running - and at as often as not, the in-house DBA or database programmers who worked around the problem _before_ Oracle Support came through.

      ROI calculations are easy, though. If your website might be down for 18 hours while your in-house support guy finishes sleeping, wakes up, and reconfigures BIND; and your web site makes $1000/hour; and the chance of this happening is 10% each year; it's very easy to translate to dollars.

      How much business do you lose in those 30-seconds?

      I think more .com's died because they overdesigned their "zero-downtime incase California sinks in an earthquake, so let's have our database mirror'd around the world"; rather than think through the (modest) implications of a couple hours downtime.

    8. Re:This is a simple reality in corporate use by ChoyLeeFut · · Score: 2, Informative
      It's worth the money for me to be able to get someone on the phone 30 seconds after it crashes to get my business running again.

      30 seconds??

      Wow... you've never had to deal with support from Monolithic Corporation Inc., have you? ;-)

      --

      The postman hits! The postman hits! You have mail.

  3. Finally by Anonymous Coward · · Score: 4, Funny

    I've been waiting forever for them to get this resolved.

  4. Why is this a surprise?! by Da+Fokka · · Score: 3, Insightful

    If you are running any kind of critical operation, support has to be guaranteed. And in our capitalist world, that means paying for it. No matter how good it is, free software has no guarantees whatsoever. And companies need those guarantees. Simply because in court a 'we'll do our best to support our l33t software' is just not good enough

    1. Re:Why is this a surprise?! by AhBeeDoi · · Score: 3, Insightful

      Nobody says that support can't come from a third party. I'm sure there a many consultants/groups (many of whom may be contributors to the project) available that can provide the necessary support.

    2. Re:Why is this a surprise?! by h00dLuM · · Score: 2, Insightful
      The monstrous beast of a company I work for let me set up a linux box running apache/nagios network monitor, unofficially. When I was done, my manager came by to inspect it and and was quite impressed, but I cringed when the launch screen came up with the usual "Not guaranteed for fitness or any purpose" or whatever.

      Then he notices the note at the bottom of the browser about Free Software, he asks me how much it would cost to buy licenses, and my stupid answer is "It doesn't cost anything, (yeah yeah my time) it's free!"

      His reply: "I don't trust free."

      I disagree personally, but this is our corporate environment.

      That frigging Not guaranteed for any purpose thing has somehow got to go, although I know that it's fundamental to the GPL.

    3. Re:Why is this a surprise?! by NineNine · · Score: 2, Insightful

      His reply: "I don't trust free."

      That's completely reasonable. Would you take a hamburger from a guy on a street corner that was giving them away, even if he assured you that they were perfectly good... he just made them himself this morning?

      Exactly.

    4. Re:Why is this a surprise?! by operagost · · Score: 4, Informative
      but I cringed when the launch screen came up with the usual "Not guaranteed for fitness or any purpose" or whatever.
      Guess what? The Microsoft EULA (along with most other companies') says the same thing in other words. And you DO pay hordes of money for those without getting any real support, until you pay hordes more. Might as well get the right free product and buy competent support and save one horde.
      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    5. Re:Why is this a surprise?! by po_boy · · Score: 3, Insightful
      Free Porn. Period. [ninenine.com]


      Would you take porn from a guy on street corner that was giving it away, even if he assured you that it was perfectly good...

      Perhaps some analogies are flawed, I guess.
  5. Good to see they're 'getting it' by mgkimsal2 · · Score: 4, Insightful

    Not specifically the BIND folks, but it's good to see that people are more and more waking up to this fact. Hopefully the fact that something is 'open source' and people are 'making money' from it won't be a newsworthy item in the near future.

    What I think many programmers don't understand is that most people will often choose a so-so product from a well-run business over a better product from a poorly run business or organization. Having no guaranteed support mechanism for BIND (and other projects) does hurt adoption of those projects in many organizations. Option support is essentially the best of both worlds, as long as the prices aren't cost prohibitive. If pricing is too high, there's much less incentive to switch, because people will usually settle for 'good enough' when 'way better' costs a whole lot more.

  6. The best software? by ybmug · · Score: 2, Insightful

    Hopefully that wasn't in reference to Bind. I know a few people who might take issue with that...

  7. <PHB>Who needs competent sysadmins? by GypC · · Score: 4, Insightful

    We bought support. The god-like powers of software vendors are obviously much superior to those of anyone that would work for us, even if the source code is open. </PHB>

  8. BlIND? by chipster · · Score: 3, Funny

    Either I am BlIND, or the only release of 9.3 available is 9.3.0beta2.

  9. In technical terms... by Rosco+P.+Coltrane · · Score: 4, Funny

    "About every year or so they declare it complete, and then implementation begins and we discover that it's actually not complete," Vixie told

    Given what Paul Vixie is famous for, I'd say the lines are:

    0 0 1 1 * /bin/sh -c "echo it's complete"
    5 0 1 1 * /bin/sh -c "echo nevermind..."

    --
    "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
  10. He's bona fide. What are you? by straponego · · Score: 2, Funny
    Bind: I am the only daddy you got! I'm the damn paterfamilias!

    Suit: But you ain't bona fide!

  11. Re:Is this a good thing? by Anonymous Coward · · Score: 3, Informative

    > Hopefully the ISC won't turn this into a RedHat situation.. They find that corporate use is profitable, and release a closed-only solution to corporations, while forking the code over to another open source project..

    How did this get a "Score 3, Insightful" when it's so completely WRONG?!? All the Red Hat source code is freely available - how "closed-only" is this?!?

  12. Todo by T-Ranger · · Score: 5, Funny
    1. Do a business name search on "BIND Support International".
    2. Register it
    3. Ditto for good domain name
    4. Get letterhead printed
    5. Randomly invoice big companies
    6. ??
    7. Profit!
  13. Read your EULA please. by Moderation+abuser · · Score: 4, Insightful

    Then come back and start telling us about the guarantees that you get. Oh, and have a look at your support contracts as well to see exactly you are guaranteed.

    I think you'll find they amount to little more than "we'll do our best to support our l33t software".

    --
    Government of the people, by corporate executives, for corporate profits.
    1. Re:Read your EULA please. by NineNine · · Score: 3, Insightful

      At the very least, you can tell a company that if it doesn't get fixed, you won't buy another piece of software from them, and neither will anybody else you know. An OS person will tell you to fuck off. I'm the leader of a user group for a specialized piece of software, and the company knows that if I'm not happy, most of their customer base is gonna hear about it. There's incentive for them to get it fixed. There's zero incentive for an OS person to fix your problem.

    2. Re:Read your EULA please. by morelife · · Score: 2, Informative

      You are, loudly, shooting yourself in the foot.

      If you had a critical software problem, and you told the vendor you "won't buy another piece of software from them" you know what you still have?

      Your same broken ass software, and a worse relationship with your vendor.

      Read your EULAs, ask your lawyer about them, and then go do a little research on the reliability and fix times for problems in BIND, Postfix, Apache, OpenSSL/SSH, etc etc etc.

      You'll find that you're better off in many cases with OSS, with many less dollars lost.

    3. Re:Read your EULA please. by vena · · Score: 2, Funny

      of course you can also rely on the very catty nature of the OSS community. post to usenet the problem, how to repeat it, that the maintainers refuse to acknowledge it, and if it's at all important it'll make headlines on every geek blog around.

    4. Re:Read your EULA please. by Tony-A · · Score: 2, Insightful

      You'll find that you're better off in many cases with OSS, with many less dollars lost.
      Yes, but how does megacorp have its cake and eat it too? How does megacorp take advantage of the inherent efficiencies of OSS? OSS can be had cheap, very cheap, but the real advantage is on the high end.

      You've paid good money for whatever. That entitles your manager to call your salesman's manager and give him/her an earful. Not that it will do a lot of good, but at least it's something. The vendor has certain responsibilities whether the vendor likes it or not. These responsibilities are tied to the money paid and in reality override whatever legalese is in the EULA or whatever. Satisfied customers are your best salesmen. Dissatisfied customers do not tend to keep it to themselves. It takes something like ten satisfied customers to balance one dissatisfied customer. A very dissatisfied customer, or a dissatisfied prominent customer carries a lot of clout. "Never buy another piece of software" is explicit only at the very end of a nasty downhill slide.

      Corporations, businesses, most of us really, like to feel in control. With OSS, the developer(s)/maintainer(s) are very much in control and are subject only to their own whims. They have no requirement to be reasonable by anyone's standard of reasonableness. (I did not say anyone else's. Intentionally.) By buying foo, by whatever name they choose to call it, corporations buy a sense of control and help ensure the viability of something they depend on. I'd also suspect that corporations have a moral sense that freeloading is not a viable long-term plan.

  14. You know what? by Neil+Blender · · Score: 4, Funny

    I really dig them root name servers.

  15. Good move... by Trolling4Dollars · · Score: 2, Insightful

    ...in way. At least it keeps the crappy proprietary DNS products from infiltrating the net to an extent. Since the asshat suits who think it's better to have commercial support for something are wailing about thi issue, at least it's addressed now. They can go sit and spin.

  16. hilarious by Tumbleweed · · Score: 3, Interesting

    All of a sudden, that commercial comes to mind, "The _stapler's_ down! The _stapler's_ DOWN!"

    They'd best make sure they have a support contract for their staplers. And for their pens & pencils, etc. Critical items, all.

    Maybe this explains why it's so expensive to do business here, and jobs have to be shifted overseas. Then we can get our stapler support from India!

    Symmetry. I like it.

  17. Re:First Post? by NineNine · · Score: 2, Informative

    Windows Server has a DNS service built in.

  18. NOT "Time for net admins to update" by strabo · · Score: 5, Informative

    I really hope that most net admins know better than to update until after the beta is over, and the release version comes out.

    BIND 9.3.0 is not released yet. It is at beta 2, which was released two days ago.

  19. Re:First Post? by 0racle · · Score: 4, Informative

    Your going to need to learn how to read first. Bind for Windows NT/2000 binary and source, just a little down the page.

    --
    "I use a Mac because I'm just better than you are."
  20. Suprised by opportunity by Sloppy · · Score: 2, Insightful
    If you are running any kind of critical operation, support has to be guaranteed. And in our capitalist world, that means paying for it. No matter how good it is, free software has no guarantees whatsoever.
    Free software has whatever guarantee the vendor wants to sell with it -- and the vendor can be anyone! You just happening to be thinking of the case that most of of nerds are in, where we use the software without there being any vendor at all. Thus, there's no guarantee. But it doesn't have to be that way.

    This doesn't so much look like a disadvantage for free software, as it looks like a really easy and cushy business opportunity for some laid-off programmers and sysadmins. Some company wants BIND with support? Then be the guy who sells BIND to them. Get paid $n/month to do almost nothing. Compete with Paul Vixie, selling his own software.

    It looks like Paul's problem, is that nobody else wanted the money, so he was forced into taking it himself. Life's a bitch.

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
  21. How the BIND company makes money by amacleod98 · · Score: 5, Informative

    D. J. Bernstein has a few things to say about this Also see here And here

  22. Well, that's convenient... by Angst+Badger · · Score: 2, Insightful

    In other words we were told that having the best software wasn't good enough [...]

    That works out well, because BIND isn't anywhere near the best software, at least not for name serving. It is, however, an exceedingly reliable source of serious vulnerabilities, and considering how relatively simple DNS is, that's a monumental achievement in its own right.

    --
    Proud member of the Weirdo-American community.
  23. Support? why? by blanks · · Score: 3, Insightful

    Isn't this why companies will pay so much money for IT that know what their doing. If your paying for the best of the best, support should not be a high priority. If you have to use lower quality products just for support, then someone in the chain of command shouldn't have a job.

  24. Shouldn't trust mum's cooking then ... by anti-NAT · · Score: 2, Insightful

    Or how about when you go around to a new colleages house for a BBQ, to get to know them. Do you eat the free food there ?

    Or go to a party where everybody has to bring food or drinks. Do you eat the free food there ? Would you be offended if other people don't eat the free food that you brought ? If they don't, aren't they saying that you are untrustworthy ?

    Free doesn't mean you can't trust something.

    You are overlooking social and reputational consequences of providing something at no cost that has intrinsic value. I know you know about this idea, as you posted your own example earlier. In your case, it was software you paid money for. You still threaten social and reputational consequences if the product fails, which for a commercial company has financial consquences. For people who provide software for free, social and reputational consequences are far more costly, as the only increase in value they get from providing the software for free are social and reputational.

    In fact, this is one of the fundamental truths of The Cluetrain Manifesto. The Internet provides the ability for social and reputational consquences to travel much further and much faster, which increase the impact of those consequences.

    I'm sure if BIND wasn't good enough, the readership of Slashdot would know about it pretty quickly. We already know when an exploitable bug is discovered, the day it is discovered. That is likely to be one of the major origins of negative comments about BIND in Slashdot forums. The Slashdot community is a large technical community, who usually are in positions to select one DNS server implementation over another.

    If ISC care about their social position within the Internet community (I'm sure they do), and want to avoid reputational consquences when they can't be relied upon (I'm sure they do), they can either try to out market the negative messages, or try to do the right job. It is almost a sport for techos to spot marketroids, so I'm confident they will try to do the right job.

    --
    The Internet's nature is peer to peer - 20050301_cs_profs.pdf
  25. BIND, Security, and You. by EmCeeHawking · · Score: 2, Funny

    Taco:

    I trust you already have the Slashdot article entitled "Vulnerability found in BIND 9.3" queued up for Saturday, right ?

  26. Re:First Post? by dasmegabyte · · Score: 2, Informative

    So? If he wanted a quality DNS server, he would have asked about DJBDNS.

    Dan Bernstein might be an, uh, "colourful" character, but his software is fast, easy to use, easy to admin, and all around better than anything Vixie & crew could offer. Plus this guy's devotion to security is nothing less than astounding. I trust his internet tools wherever possible...shit, i even run an instance of his no frills HTTP server for images.

    --
    Hey freaks: now you're ju
  27. baffled by obsession with "official" support by Bob+the+Hamster · · Score: 3, Interesting

    I work in IT for an aerospace manufacturer, and I am baffled by other company's obsession with commercial support. I feel lucky to work for an employer who isn't a stickler for it.

    By far the best support I get is from newsgroups, mailing list archives, or simple RTFM'ing

    A company with a boiler-room full of telephone techs simply isn't capable of providing better support than the support that the open source community already puts at my fingertips.

  28. Comment removed by account_deleted · · Score: 2, Informative

    Comment removed based on user account deletion

  29. Re:Java / .NET / Strict OOP by Tony-A · · Score: 2, Insightful

    What you're selling is your phone number. RTFM doesn't do the customer any good if the customer doesn't know what a FM is, or even WHICH FM to R. Even if most of the customers can do it all themselves, it's nice to have that phone number in case of emergencies.

  30. all open-source software should do this by Sivaram_Velauthapill · · Score: 2, Insightful

    I think if open-source software is to gain popularity (particularly in the enterprise environment), they must all provide corporate support.

    Regardless of what you think, corporations are all about minimizing risk and shifting blame onto someone else. Having a support contract is almost a minimum at many large corporations. If there is a problem, management would like to have the confidence that some specialist outside the organization will be helping--or more likely, blamed for the problems. It is much easier for management to blame another company than themselves. Which seems more easy to defend:
    "hmm... my team is working as much as they can on it. It'll be resolved soon"

    OR

    "The problem is being dealt with. Our vendor (insert name; say Novell) is providing a resolution."

    Sivaram Velauthapillai

    --
    Sivaram Velauthapillai
    Seeking the meaning of life... @slashdot of all places ;)
  31. Re:Who needs competent sysadmins? by GypC · · Score: 2, Insightful

    Exactly... they didn't need a competent sysadmin, they just had to do without until the cavalry arrived. That way, the IT department doesn't actually have to learn a whole lot about computers, they can just be glorified hardware techies that hire their buddies for good jobs, and pay vendors out the nose for tools and services they should be able to script or figure out themselves.