oss-security - Re: Root name server changes -> bind

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 22 May 2008 11:31:55 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: Root name server changes -> bind

* Jonathan Smith:

> Why did ICANN allow the old IP address to be taken by an untrusted
> party?

The party isn't untrusted (they're still involved in operating the B
root).  They're not a third party, either, they're the legitimate owner
of that address block.

ICANN should have arranged for a longer transition period, as it was
done in previous transitions (I think a few older address still respond
to queries).

> It would seem that IPs formerly used by root DNS servers should
> be permanently retired to prevent just this sort of thing.

There's no way to retire an IP address, especially if it is located in a
network prefix that is still in production (which was a driving force
behind most past root servers migrations).

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.