In message <9407221351.AA24121@rwing.UUCP>, Pat Myrto writes: >Security through obscurity is alive and well here, too, I see. Therefore >the crackers who are exploiting the hole have the guaranteed knowlege >that all users of DNS are vulnerable. Do they now? Anyone watching the IN-ADDR.ARPA. stuff flying around the net has got to have at least one synapse left to put 2+2 together and figure out there's a security problem and what it is. >Great. > >Perhaps more than ONE head working on the problem might be a good idea? >Surely there is more than ONE person that can devise a fix... There are several people on the bind-workers list who actively (i mean post patches within hours and minutes of new releases) support vix on BIND. There is by no means ONE person working on BIND, and I'm confident that there are people on bind-workers who are familiar enough with the issues and the code to either provide a fix or to confirm vix's fix. --Dave