BIND 9.3 Released With Commercial Support

darthcamaro writes "Time for net admins to update BIND: version 9.3 has been released. internetnews.com has a story on it where they talk with Paul Vixie, the founder of BIND's keeper ISC. In it he details why after so many years BIND has finally decided to offer commercial support. 'Many of the companies who use our software free of charge have told us that their corporate risk management strategy requires them to have a bona fide support channel for all of their critical operations,' Vixie said. 'In other words we were told that having the best software wasn't good enough, and giving it away for free wasn't good enough, we also had to ensure that commercial support was available or they could be forced to switch to software they didn't like as well just to get support.' The full press release on the BIND 9.3 release is also available."

Comments

Wait till the next exploit,,,

[darkjedi521]

Wasn't at one time BIND the IIS of the unix world? This could open them up to a world of problems if/when the next exploit shows up.

Re:Wait till the next exploit,,,

[otis wildflower]

No, you're thinking of Sendmail.

Re:Wait till the next exploit,,,

[Rosco P. Coltrane]

I'm sorry, but who even uses BIND anymore? an article like that on 66.35.250.150 is truly News for Nerds...

Re:Wait till the next exploit,,,

[John Starks]

Exploits are not uncommon in BIND, even today. Take a look at their security alert page, especially the matrix at the bottom. Security problems abound!

It's not clear why people continue to use BIND. It's probably because it's just assumed that it's the only thing out there. But everything from security to configuration is poorly done in BIND. I use tinydns (part of djbdns) instead on all my servers. It's written by Daniel Bernstein, the same guy that wrote qmail. He's got a great track record -- no security holes in any of his software, AND he backs up that assertion with a $1000 prize to anyone that finds such a hole. He makes a better case than I do for tinydns/qmail vs. BIND/sendmail than I ever could.

Re:Wait till the next exploit,,,

[macdaddy]

Anyone who understand DNS, their OS's limits, and software applications can deploy BIND 9 in a frighteningly secure manner.

...and anyone that doesn't understand DNS, their OS's limits, or software applications should not be running any server, let along a nameserver, PERIOD, IMHO. The problem today is that there are way to damned many incompotent imbeciles that call them selves admins. Most of the rejects think they know Windows pretty well and thus can run any kind of server. It's really a sad state of affairs. I wish there was a certification that people had to acquire before they could call themselves an admin of any platform.

I run Bind. I run Sendmail. I'll always use both. I supplement Bind with rbldnsd. I have no need to supplement Sendmail. Both do what I want. Since I'm not an incompotent moron I don't have any trouble configuring either of them. The claims people make about both/either being difficult to admin or insecure are complete bullshit. If the person was a half-assed compotent admin neither would be a problem. I swear, what is the world coming to....

Re:Wait till the next exploit,,,

[Florian Weimer]

Exploits are not uncommon in BIND, even today.

Critical exploits in BIND 9 still have to show up. The really nasty bug so far was actually in OpenSSL.

It's not clear why people continue to use BIND.

For the full resolver part, their are hardly any alternatives. If you need DNSSEC, your options besides BIND are even more limited.

tinydns is unusable for most people (who aren't masochists) because it doesn't conform to existing standards and parctice. Just speaking the DNS protocol is not enough, you also have to implement some of BIND's quirks, and more important: the software has to be maintained. DNS is still evolving, DJB's software is not. (Some of it doesn't even compile on modern, POSIX-conforming systems.)

Re:Wait till the next exploit,,,

[ectoraige]

It's not clear why people continue to use BIND.

I continue to use BIND because I don't like DJB's licence.

Re:Wait till the next exploit,,,

[the morgawr]

If he doesn't give you a license, you are stuck with the default rights under Copyright Law. That's DJB's "license".

As such you can't make changes and distribute them as part of a integrated set (in theory you could distribute just the patches but it's a grey area). Hence many people consider it "un-free". Some people see this as a problem.

This is a simple reality in corporate use

[Martin Blank]

No support, no sale.

I can understand it to a degree; there's no guarantee that the version installed today will not be completely dropped next month. It gets a little aggravating when it holds up an entire project, though, because of one small piece.

The upside, of course, is more funding for critical projects.

Re:This is a simple reality in corporate use

[Shakrai]

Many of these support contracts are really just the "Circuit City Extended Waranty" of the corporate world.

Have you ever known a PHB that didn't get the extended Circuit City warranty? That's what this is all about -- selling it to the PHBs of the World so we can go on using our OSS that we know works and even with the support contract is cheaper then the commercial alternative.

Re:This is a simple reality in corporate use

[NineNine]

It's not about whether it works or not. It's about being able to call somebody at 2:00AM when a critical machine goes down, as opposed to waiting for your Usenet post to get propogated, then hoping that l334G33k425 responds to your message in a timely manner and gives you the correct answer. Case in point... my retail businesses have a POS system that I paid for. Granted, there aren't any truly viable OSS ones out there yet, but assume there are. It's worth the money for me to be able to get someone on the phone 30 seconds after it crashes to get my business running again. Or if an employee fucks something up, I know that I can absolutely get someone on the phone who will eventually fix my problem. I don't care how good a competing OSS project is supposed to be: no software is perfect, and there absolutely, positively MUST be someone to fix it when the shit hits the fan (as it always does, eventually). When your rent & power bill & paycheck is on the line every day (as mine are), you don't fuck around. Period.

Re:This is a simple reality in corporate use

[Martin Blank]

In my experience, it doesn't matter if support is 24/7 or three hours a day on odd days of the week every other month. So long as there's a support contract involved, that will get it in over something that has no formal support. I've seen companies buy one product over another solely because, while both are commercial software, one of them offers an option for a support contract and the other does not, whether or not the other one is paid support.

Where I'm at now, it's not uncommon to see support contracts for one product (and not anything from or as ubiquitous as Microsoft, either) reach a quarter of a million dollars a year or more. It's insane.

Re:This is a simple reality in corporate use

[jdray]

While I wouldn't have put it quite the way you did, I have to agree with you. If the OSS community keeps up the attitude that Shakrai puts forth, adoption into corporate datacenters and business areas will be slow and agonizing. As you said, people want assurances.

The upside is that companies are used to and willing to fork over large sums of cash for those assurances. So, if you love an OSS project enough to dedicate your life to it, then get to know it inside and out and start offering commercial support for it. If the product is stable, you never have to answer the phone. If you charge $500 per year for support, 100 customers makes for a tidy income. And, honestly, most midsize corporations wouldn't even blink at $500 per year for support on something that goes on a server, unless it was in astonishment at how cheap it was.

Re:This is a simple reality in corporate use

[ron_ivi]

Places I've been, it's taken Oracle Support *days* to get systems up and running - and at as often as not, the in-house DBA or database programmers who worked around the problem _before_ Oracle Support came through.

ROI calculations are easy, though. If your website might be down for 18 hours while your in-house support guy finishes sleeping, wakes up, and reconfigures BIND; and your web site makes $1000/hour; and the chance of this happening is 10% each year; it's very easy to translate to dollars.

How much business do you lose in those 30-seconds?

I think more .com's died because they overdesigned their "zero-downtime incase California sinks in an earthquake, so let's have our database mirror'd around the world"; rather than think through the (modest) implications of a couple hours downtime.

Finally

[Anonymous Coward]

I've been waiting forever for them to get this resolved.

Why is this a surprise?!

[Da Fokka]

If you are running any kind of critical operation, support has to be guaranteed. And in our capitalist world, that means paying for it. No matter how good it is, free software has no guarantees whatsoever. And companies need those guarantees. Simply because in court a 'we'll do our best to support our l33t software' is just not good enough

Re:Why is this a surprise?!

[AhBeeDoi]

Nobody says that support can't come from a third party. I'm sure there a many consultants/groups (many of whom may be contributors to the project) available that can provide the necessary support.

Re:Why is this a surprise?!

[operagost]

but I cringed when the launch screen came up with the usual "Not guaranteed for fitness or any purpose" or whatever.

Guess what? The Microsoft EULA (along with most other companies') says the same thing in other words. And you DO pay hordes of money for those without getting any real support, until you pay hordes more. Might as well get the right free product and buy competent support and save one horde.

Re:Why is this a surprise?!

[po_boy]

Free Porn. Period. [ninenine.com]

Would you take porn from a guy on street corner that was giving it away, even if he assured you that it was perfectly good...

Perhaps some analogies are flawed, I guess.

Good to see they're 'getting it'

[mgkimsal2]

Not specifically the BIND folks, but it's good to see that people are more and more waking up to this fact. Hopefully the fact that something is 'open source' and people are 'making money' from it won't be a newsworthy item in the near future.

What I think many programmers don't understand is that most people will often choose a so-so product from a well-run business over a better product from a poorly run business or organization. Having no guaranteed support mechanism for BIND (and other projects) does hurt adoption of those projects in many organizations. Option support is essentially the best of both worlds, as long as the prices aren't cost prohibitive. If pricing is too high, there's much less incentive to switch, because people will usually settle for 'good enough' when 'way better' costs a whole lot more.

<PHB>Who needs competent sysadmins?

[GypC]

We bought support. The god-like powers of software vendors are obviously much superior to those of anyone that would work for us, even if the source code is open. </PHB>

BlIND?

[chipster]

Either I am BlIND, or the only release of 9.3 available is 9.3.0beta2.

In technical terms...

[Rosco P. Coltrane]

"About every year or so they declare it complete, and then implementation begins and we discover that it's actually not complete," Vixie told

Given what Paul Vixie is famous for, I'd say the lines are:

0 0 1 1 * /bin/sh -c "echo it's complete"
5 0 1 1 * /bin/sh -c "echo nevermind..."

Re:Is this a good thing?

[Anonymous Coward]

> Hopefully the ISC won't turn this into a RedHat situation.. They find that corporate use is profitable, and release a closed-only solution to corporations, while forking the code over to another open source project..

How did this get a "Score 3, Insightful" when it's so completely WRONG?!? All the Red Hat source code is freely available - how "closed-only" is this?!?

Todo

[T-Ranger]

1. Do a business name search on "BIND Support International".
2. Register it
3. Ditto for good domain name
4. Get letterhead printed
5. Randomly invoice big companies
6. ??
7. Profit!

Read your EULA please.

[Moderation abuser]

Then come back and start telling us about the guarantees that you get. Oh, and have a look at your support contracts as well to see exactly you are guaranteed.

I think you'll find they amount to little more than "we'll do our best to support our l33t software".

Re:Read your EULA please.

[NineNine]

At the very least, you can tell a company that if it doesn't get fixed, you won't buy another piece of software from them, and neither will anybody else you know. An OS person will tell you to fuck off. I'm the leader of a user group for a specialized piece of software, and the company knows that if I'm not happy, most of their customer base is gonna hear about it. There's incentive for them to get it fixed. There's zero incentive for an OS person to fix your problem.

You know what?

[Neil Blender]

I really dig them root name servers.

hilarious

[Tumbleweed]

All of a sudden, that commercial comes to mind, "The _stapler's_ down! The _stapler's_ DOWN!"

They'd best make sure they have a support contract for their staplers. And for their pens & pencils, etc. Critical items, all.

Maybe this explains why it's so expensive to do business here, and jobs have to be shifted overseas. Then we can get our stapler support from India!

Symmetry. I like it.

NOT "Time for net admins to update"

[strabo]

I really hope that most net admins know better than to update until after the beta is over, and the release version comes out.

BIND 9.3.0 is not released yet. It is at beta 2, which was released two days ago.

Re:First Post?

[0racle]

Your going to need to learn how to read first. Bind for Windows NT/2000 binary and source, just a little down the page.

How the BIND company makes money

[amacleod98]

D. J. Bernstein has a few things to say about this Also see here And here

Support? why?

[blanks]

Isn't this why companies will pay so much money for IT that know what their doing. If your paying for the best of the best, support should not be a high priority. If you have to use lower quality products just for support, then someone in the chain of command shouldn't have a job.

baffled by obsession with "official" support

[Bob the Hamster]

I work in IT for an aerospace manufacturer, and I am baffled by other company's obsession with commercial support. I feel lucky to work for an employer who isn't a stickler for it.

By far the best support I get is from newsgroups, mailing list archives, or simple RTFM'ing

A company with a boiler-room full of telephone techs simply isn't capable of providing better support than the support that the open source community already puts at my fingertips.