Linked by Amjith Ramanujam on Sun 3rd Aug 2008 15:56 UTC, submitted by netpython
Thread beginning with comment 325488
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
"They are last at bat in the DNS patching game, and when they manage to hit the DNS bug the patch is an easy out."
Apple uses BIND for its DNS server, and a patch for BIND was indeed available but it was buggy. A performance issue was discovered on high-traffic recursive servers, defined as those seeing a query volume of greater than 10,000/queries per second.
Apple uses BIND for its DNS server, and a patch for BIND was indeed available but it was buggy. A performance issue was discovered on high-traffic recursive servers, defined as those seeing a query volume of greater than 10,000/queries per second.
Sometimes you got to weigh whether the previous version, which had a serious bug, outweighs the bug in the new version, which has a less serious bug. If you wait to get rid of bugs by waiting for bug-free software, you may wait for a long time...
Also, when Apple did patch it, and they did, with the aforementioned buggy patch, they didn't even patch it properly on the client OS, which is less likely to encounter such a scenario. That in spite of documenting that they *had* patched it, like they had, belatedly, for OS X Server.
Edited 2008-08-04 06:21 UTC




Member since:
2005-11-16
"They are last at bat in the DNS patching game, and when they manage to hit the DNS bug the patch is an easy out."
Apple uses BIND for its DNS server, and a patch for BIND was indeed available but it was buggy. A performance issue was discovered on high-traffic recursive servers, defined as those seeing a query volume of greater than 10,000/queries per second. So yes the official patch for BIND was and is still buggy.
I don't think that Apple would ship a buggy patch for systems in production (open source guys does yes, but well that's their decision...), even if the security threat is high. Shipping buggy code even to fill a security issue is not acceptable.