Slashdot Mirror

← Back to Stories (view on slashdot.org)

Open Source BIND Alternative Launches

Posted by kdawson on from the ties-that-bind dept.

bednarz writes "A group of experts on Tuesday released an open source alternative to the BIND DNS server. The new software — dubbed Unbound 1.0 — is a recursive DNS server. From its first prototype in 2004, Unbound was designed to be a faster, more secure replacement for BIND. Unbound supports DNS security extensions (DNSSEC), which authenticate DNS lookups but are not yet widely deployed because they rely on a public key infrastructure. Unbound was released to open source developers by NLnet Labs, VeriSign, Nominet and Kirei."

6 of 162 comments (clear)

  1. It's not... by cosmocain · · Score: 5, Informative

    ...a DNS-Server.

    Taken from here: Unbound is a validating, recursive, and caching DNS resolver. Huh, frontpage-information is always quite hard to get.

    1. Re:It's not... by spinkham · · Score: 4, Informative

      It IS a DNS server, just not an authoritative server. DNS servers come in 2 flavors, authoritative servers (which hold the actual info) and recursive servers (which do the looking up for a client).
      Most DNS servers do both, so "DNS server" means many different things depending on the context. When your ISP gives you a "DNS server" to use, it's a recursive server, not an authoratative server.
      The end user has a "stub resolver", which does not qualify as a server.

      For a more indepth discussion of DNS architecture and DNSSEC, you can check out "DNS for Rocket Scientists" here http://www.zytrax.com/books/dns/ or a talk I gave on DNS security here:
      http://www.mavensecurity.com/presentations

      --
      Blessed are the pessimists, for they have made backups.
  2. FYI, bind9 is already open source by molo · · Score: 5, Informative

    This posting makes it sound like bind9 is not sufficiently open/free. That is not correct, and kdawson should do a better job of editing to prevent biased postings like this.

    Bind9 is licensed under the ISC license, a BSD-like license. The full text of the license follows.

    -molo

    Copyright (C) 1996-2001 Internet Software Consortium.

    Permission to use, copy, modify, and distribute this software for any
    purpose with or without fee is hereby granted, provided that the above
    copyright notice and this permission notice appear in all copies.

    THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
    DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
    INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
    INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
    FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
    NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
    WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

    --
    Using your sig line to advertise for friends is lame.
  3. Re:djbdns by oyenstikker · · Score: 5, Informative

    the few Freedom wrinkles in the license.

    djbdns is now in the public domain (as of December 2007). Before that, there was no license.

    http://cr.yp.to/distributors.html
    --
    The masses are the crack whores of religion.
  4. For those of you wondering what the difference is: by an.echte.trilingue · · Score: 4, Informative
    For those of you who (like me) don't know the difference between the two, from wikipedia:

    DNS servers
    The Domain Name System consists of a hierarchical set of DNS servers. Each domain or subdomain has one or more authoritative DNS servers that publish information about that domain and the name servers of any domains "beneath" it. The hierarchy of authoritative DNS servers matches the hierarchy of domains. At the top of the hierarchy stand the root nameservers: the servers to query when looking up (resolving) a top-level domain name (TLD).

    DNS resolvers
    A resolver looks up the resource record information associated with nodes. A resolver knows how to communicate with name servers by sending DNS queries and heeding DNS responses.

    A DNS query may be either a recursive query or a non-recursive query:
    • A non-recursive query is one where the DNS server may provide a partial answer to the query (or give an error). DNS servers must support non-recursive queries.
    • A recursive query is one where the DNS server will fully answer the query (or give an error). DNS servers are not required to support recursive queries.
    The resolver (or another DNS server acting recursively on behalf of the resolver) negotiates use of recursive service using bits in the query headers.

    Resolving usually entails iterating through several name servers to find the needed information. However, some resolvers function simplistically and can communicate only with a single name server. These simple resolvers rely on a recursive query to a recursive name server to perform the work of finding information for them.
    --
    weirdest thing I ever saw: scientology advertising on slashdot.
  5. Re:DNS is a big problem and it's getting bigger by mseeger · · Score: 4, Informative
    80 large for software? , and DNS software? are you nuts?

    I do IT as a living for 25 years now, so the answer to your question is YES.

    Do you realize how fast a computer you can get for $80K?

    The answer is YES again. I sell it too...

    Its just DNS software , why would you want to pay ANYTHING let along that much? Buying a faster computer to do the same thing makes a whole lot more scene.

    The answer here is NO. The problem with this thread and the discussion here is, that you underestimate the problem.

    Example: It's 2007. You have 4 Caching DNS servers on 3Ghz Dual Xeon, each runs a two BIND 8 processes. Each BIND process is bound to a specific IP address. The servers really work hard, but the DNS performance (time to answer, percentage of queries ansered) doesn't satisfy you. What do you do?

    OK, let's start:

    • The clever guy says: Dude, you're still running BIND 8. That's outdated. Switch to the new BIND 9! It's got multithreading. Use it and all you're sorrows are gone.
      The real world says: BIND 9 on a Dual CPU system brings you 140% of the performance of BIND 8. But you're running 2 processes on each system. Switching to BIND 9 decreases your performance per CPU for about 30%.
    • The clever guys replies: OK, buy four more machines. Use one BIND 9 on each of them.
      The real world says: OK, you increased your capacity by 40% while doubling the costs. This is a workaround but no solution...
    • The clever guy says: OK, buy 12 machines, put BIND 9 on all of them.
      The real world says: OK, no you qadruppeled your costs. Are you aware that managing a hardware costs more than the iron itself. And how, by the way, do you distribute the load?
    • The clever guy says: Oh, just use a load balancer.
      The real world takes it spreadsheet and says: Well a load balancer for that load costs something too. Any one here knows how to setup and configure ACME load balancer?
    • The clever guy says: OK, drop the load balancer. Just give the users the address of the new name servers by PPPoE.
      Ar this point the real world sighs: Ah, and you are aware that about 30+% have hardwired the name server.

    Believe me, this is the simplified version for beginners.

    Regards, Martin