Creating A DNS Cache With djbdns
Building a local DNS cache will speed up your internet connection since the time for the translation job (converting domain names into IP addresses) will become negligible with the assumption that the DNS cache gets the information from the parent DNS. |
|
|
Comments (62)
djbdns is abandonware
15 earlier comments in the full thread.
No, TeX is public domain (i.e. free) software. The source is not locked, and it has been worked on and adapted to current needs. see: http://en.wikipedia.org/wiki/TeX#License . Not like the distribution issues with DJB's.
DJB may be supported in the short term, but really, how maintainable is an app with that kind of restriction? Sooner or later, it just isn't feasible.
BTW, the djbdns libraries are public domain also. I don't really care about the other records and it is trivial to generate the necessary lines in the tinydns data file anyway, so that makes it really a non-issue. Feel free to use them to write your own software.
How you install daemontools is up to you. The configuration can be changed before you compile. I think the daemontools-installer source package in Debian is a good example of what you can do.
I *never* use anything authored by djb because of his cavalier disregard for standards that he doesn't agree with or finds inconvenient.
Further, his malevolent dictatorship style of project leadership ensures that even when he does have a good idea it will never receive the argy-bargy, cut-and-thrust, input that is characteristic of true guru contribution to development.
Apart from that, I thought TC's points were well made.
Subject: Re: PATCH: Zero-length MX records and reject_unknown_sender_domain From: wietse () porcupine ! org (Wietse Venema) Date: 2006-12-28 1:09:35 Message-ID: 20061228010935.6731DBC0A9 () spike ! porcupine ! org
Todd A. Green: > Wietse Venema wrote: > >> Perhaps surprisingly, the MX result syntax check happens only when > >> the DNS lookup client actually asks for a result. > > Thank you Wietse. After patching I'm getting: > > 550 4.1.8 : Sender address rejected: Domain not found > > Given we did get a record back, could the error message be "Domain does > not handle email" or "Domain has Null MX record" or anything that would > let us differentiate null MX records in our logs from those who don't > have A/MX records?
Fsck off.
Wietse
> Thanks again for the quick fix, > Todd > >
Which has absolutely nothing to do with anything I said. I said, effectively, that support by unauthorized third parties does not mean a program isn't abandonware.
> The only fights I've ever seen with using djbdns or qmail were between those who agree with djb and those who didn't read or understand what he had to say.
Which also has nothing to do with anything I said, though I agree that a number of people don't agree with DJB. Whether that's because they don't understand him or not is for the reader to decide.
So far, you've still done nothing to refute any of TC arguments.
For the record, I'm willing to accept that DJBDNS is well written, stable, and secure software. I'm not willing to accept that it's currently supported or that it's the best choice to use in light of the available alternatives.
It also has nothing to do with the law in the United States, now matter what the author says.
Licenses are, indeed, enforceable because the control the terms under which you are allowed to use a piece of software. The weasel words are "legally downloaded". To legally download something, you must download it in accord with the rights granted by the copyright holder, unless, of course, that software is in the public domain.
Linking to crap sites giving bad information is not a good way to support your credibility.
LOL
Quoting: There is an as-yet-unclaimed $500 prize (see External Links, below) for the first person to find a privilege escalation security hole in djbdns.
From BSDFreaks.nl:
Quoting:Deze dns server heeft tot op heden dag nog geen één security lek gehad dit in tegenstelling tot BIND die er veel heeft gehad[("This DNS-server didn't have any security breach till today, in contrast to BIND, which had many")
From the OpenBSD FAQ:
Quoting:Why isn't qmail or djbdns included? License, or lack of: the inability to distribute a modified version of this software keeps it from being considered
So, to me it looks like djbdns is not proven to be insecure, but other developers than Bernstein are a bit afraid to co-develop djbdns and help to make it more secure because of copyright issues, simply because it isn't GPL and it's author is too recalcitrant to make it GPL.
I found a djbdns-site which was lastly updated in 2006, and a patch for djbdns released in 2006. To me, the fact that several djbdns-websites are still online even 6 years after the last release shows it's not abandonware. The fact that djbdns.org doesn't exist anymore has another reason.
Bug fixes don't have to do anything with security; apart from showing the program had its errors before the fixes. Look at the number of XP security fixes, and it's still not that secure. OpenBSD only fixed two remote flaws in about 10 years, which in the same reasoning could make OpenBSD look insecure, and if somebody didn't knew OpenBSD, could be used to show 'OpenBSD dev's don't give %^&* about remote holes'. The fact that 'djbdns' didn't have any (big) changes the last five years, in fact shows the current implementation / configuration / source code is tested in real life for six years, without big security issues showing up on the net. Can't say that about DNSMasq!
To conclude, I'm still not sure, but I'll give djbdns the benefit of the doubt, and wouldn't be afraid to use it as my DNS-caching server. Please note, if djbdns was really that insecure, the OpenBSD team would have given a different reason for not supporting djbdns than 'licensing issues'.
(Please don't mind mentioning OpenBSD more than once - since I don't know that much about security I choose to trust them)
Out of curiosity -- Is English a second language for you?
I ask because you seem to be having a lot of trouble with it. I'm not sure how to make any clearer that, for material covered by copyright, your rights are limited to those granted by the copyright holder, with specific exceptions granted by law, known as fair use.
However, thats' because English is my first (and, mostly, only) language. I may just be unaware of something odd in it's constructs.
You claimed that the software download was governed by the rights granted to you by the copy right holder, which is correct. You then said that "linking to crap sites giving bad information is not a good way to support my credibility", which is wrong. It is not a crap site with bad information. He is correct for many reasons.
That crap site, why it is non-other than the site of the software author. It is he who is telling me that it is ok for me to download, patch and distribute software patches to my hearts content. How can I be any clearer?
hkwint: Your bsdfreak.nl quote doesn't seem to be about djbdns, but it is hard to tell since no link was provided and the quote doesn't actually mention it by name.
I claimed nothing. I stated the facts as they are. You are free to ignore reality to your heart's content.
The software author is free to grant you all the rights he wishes to the software for which he holds the copyright. To the extent that he puts idiotic tripe on the site, it is a crap site.
Neither I nor TC have even insinuated that it's insecure. She's stated, and I've agreed, that it's abandonware. As I've noted above, support by third parties does not remove something from the abandonware category.
> You then said that linking to crap sites giving bad information is not a good way to support my credibility, which is wrong.
So, you think quoting sites with factually incorrect information supports your credibility? Interesting.
> It is he who is telling me that it is ok for me to download, patch and distribute software patches to my hearts content.
His software. Not all software uses his license (for which I can only give thanks). Some licenses specifically prohibit such activities.
Which just goes to show that Venema's ego is a least within an order of magnitudes of DJB's. Notice that he can't be bothered to use the BSD or GPL licenses either.
Quoting:hkwint: Your bsdfreak.nl quote doesn't seem to be about djbdns,
Off course it is! But I assume Dutch is a second language to you ;) (darn Google localization, that's why for everything I search for Dutch sites show up, and I'm too lazy to type google.us)
http://www.bsdfreaks.nl/index.php/front_howto/53/683
Quoting:Opzetten cacheing nameserver voor je netwerk ()
Which means "Setup cacheing nameserver for your network"
Quoting:Als namserver wordt gebruik gemaakt van djbdns van DJ Bernstein (o.a. maker qmail)
"As a namesrever, djbdns is used."
Quoting:Deze dns server heeft tot op heden dag nog geen één security lek gehad
"This dns server didn't have one security breach until today."
Quoting:Deze dns server heeft tot op heden dag nog geen één security lek gehad
Quoting:This DNS server has not had any security breach yet
Or, more literally, "This DNS server has not had a security breach to this day." That's closer to the translation hkwink gave.
DJBDNS is stable, secure, and best of breed software
7 earlier comments in the full thread.
The funny thing is that nobody on this forum has said that the software is crap.
They've just said that they don't want to use it. I say the same thing about lots of software every day.
For that matter, I tend to shy away from lots of software that doesn't seem like it's actively maintained, especially if its critical.
You and others are free to choose differently, a concept Pat doesn't seem to grasp.
Whoops!! Got me in the wrong crowd. I'm perfectly willing to use non-free software for some things, if there is no good free alternative.
Mostly, though, I'm not interested in non-free stuff.
It certainly appears that way. I begin to wonder what Pat's motivation is in all this?
> Mostly, though, I'm not interested in non-free stuff.
Me neither.
V arire fnvq nalguvat bs gur fbeg.
qvabgenp: Sbe gung znggre, V graq gb ful njnl sebz ybgf bs fbsgjner gung qbrfa'g frrz yvxr vg'f npgviryl znvagnvarq, rfcrpvnyyl vs vgf pevgvpny.
V'z gur rknpg bccbfvgr, nf ybat nf gur fbsgjner nhgube vf npghnyyl n erny crefba jvgu n erny wbo naq abg fbzrbar jub jebgr fbzrguvat naq qvfnccrnerq bs gur snpr bs gur cynarg.
Sbe pevgvpny freivprf, V ybbx sbe jryy jevggra, qbphzragngrq, fgnoyr fbsgjner jvgu n uvfgbel bs irel srj gb mreb frphevgl vffhrf naq na npgvir vagryyvtrag hfre pbzzhavgl . Vs gur znvyvat yvfg sbe gur fbsgjner vf shyy bs "arj eryrnfr", "ubj qb V", "PCH ng znk nsgre yngrfg hcqngr", rgp, gura sbe zr gur fbsgjner vf abg sbe zl pevgvpny freivprf. V yvxr gb fyrrc ng avtug.
V cebonoyl fubhyq qrsvar fgnoyr. Fgnoyr gb zr vf, gur fbsgjner qbrfa'g punatr bire gvzr, hayrff V jnag vg gbb. Irel yvggyr fbsgjner gurfr qnlf vf fgnoyr. Fbzr crbcyr pbashfr fgnoyr jvgu gur fbsgjner orvat nonaqbarq. Fbzr crbcyr unir guvf fgenatr abgvba gung fbsgjner ebgf. V'ir arire fzryyrq ebggra fbsgjner ba nal bs zl freiref.
V nyfb yvxr fbsgjner gung vf fznyy naq qbrf bar guvat irel jryy, naq pna unir srngherf nqqrq ol hfvat vg va pbawhpgvba jvgu bgure fbsgjner.
Ubjrire vg vf uneq gb qb nalguvat jvgu guvf irel aneebj sbphf. Fb, V qb hfr n ybg bs bgure fbsgjner yvxr cuc naq ncnpur gung V jngpu yvxr n unjx. V'z nyfb hfvat atvak sbe jro freivat. Vg ybbxf irel avpr naq vf cerggl gvtug pbqr jvfr.
Oynzr ghkpuvpx, fur qrpvqrq gb tb artngvir ba n tbbq cvrpr bs fbsgjner jvgu bhg qbvat nal erfrnepu.
No Pat, the blame is pretty much on you. Most, if not all, of TC's concerns have been shown as real. You just didn't like what she said, or the way she said it.
You keep refering to djbdns as ' a good piece of software', and what we're all telling you is that that's a pretty subjective assessment... more accurate if you preface it with 'in my opinion'. We might buy that one.
Gur fbbare jr fgbc gur artngvivgl nobhg nyy fbsgjner, gur orggre.
Naq, V fgvyy qba'g oryvrir gung fbsgjner ebgf.
Quoting:Whoops!! Got me in the wrong crowd. I'm perfectly willing to use non-free software for some things, if there is no good free alternative.
I apologize.
/me re-files dino under "P" for proprietary, locks the cabinet and goes out for coffee ;-)
After that last one I sure do :D
Of course you have.
Your entire theme in this conversation is offense at others weighing the merits of a particular piece of software differently from the way you do.
Sounds like freedom is not something you value as it entails others making choices for reasons that differ from yours.
In TC's own words:
"I totally love any alternative to the bloaty, ridiculously-complex BIND, and used to deploy djbdns a lot. But there haven't been any updates in years, and DJB's silly re-distribution policy (patches may be distributed, but not modified code or binaries) assures that it will orphaned."
That doesn't sound like a lack of research to me.
> Oh well, if you're having fun I shan't get in your way!
Don't worry TC, we can take care of ourselves. I have my battery powered full spectrum light all ready to go. :)
> The sooner we stop the negativity about all software, the better.
Saying that a piece of software has been abandoned is not negativity. It is a statement of fact, which can be verified as either true or not. In this case, it is true. Saying that a piece of software is not "Free Software" is not negativity. Again, it's a fact which can be verified. Again, in this case, it's true.
All of the things you state in your title are true, with one caveat: For its time. All of the things TC stated are true: the software is abandoned, and it does not use a Free Software license, which history has shown does assure that it will be orphaned.
Simply put, you are both right, but while TC is willing to accept your points, you're not willing to accept hers. Jimf is correct, you just don't like what she said or how she said it.
Well, they did stink...
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Sign up and post (it is free) or Log in and post

djbdns does not natively support AAAA/A6 (IPv6) records, SRV, NAPTR, or RP (responsible person) records, or any number of the newer-style records. (Here is a nice page listing a lot of them http://www.ietf.org/IESG/Implementations/RFC1886-Implementat...) You can find patches for these from various sites around the Web, and then you can explain why you think patches that are subject only to random user review, and not reviewed by DJB or anyone else with standing or credibility, from random authors are acceptable.
I was already uncomfortable with djbdns because of its reliance on daemontools, which also has not been updated since 2001. I could overlook daemontool's quirks, such as its non-standard filesystem structure. It creates a bunch of new top-level directories with no regard for any standard Linux filesystem conventions. But unmaintained code, especially for something as sensitive as name services? Not for me, thank you very much. It's a shame, because dnscache and tinydns were awesome in their day, and should have spurred a DNS server revolution.