Entry

How is djbdns more secure?

Is there really an unclaimed $500 cash reward for security holes?

How is djbdns more secure?

Dec 7th, 2001 03:11
Brian Coogan,

The fact that Dan Bernstein is prepared to offer a personal $500 
security guarantee speaks volumes about the way djbdns was designed 
(either that, or he's paid too much!).  Some security features:
 - daemons run as non-root users with separate user-ids;
   (the user-ids need have no permission at all on the filesystem
    and thus their ability to impact the system is low)
 - locks itself into an isolated tree on the system via chroot;
   (meaning the process has only very limited access to the
    filesystem and configuration when running)
 - dnscache is immune to cache poisoning;
   (meaning it cannot be attacked and forced to lie about IP
    addresses)
 - dnscache is careful about who it listens to;
   (again meaning it is very hard to mislead dnscache)
 - djbdns is designed carefully with an emphasis on simplicity.
   (simple means easy to audit and less likely to have bugs)
For more details see http://cr.yp.to/djbdns/ad/security.html
There is a $500 reward for the first demonstrable real security hole in 
djbdns.  The author is sufficiently confident that djbdns is secure 
such that he is prepared to offer a reward for holes out of his own 
pocket - something almost unheard of in the software industry, let 
alone for software whose source is made publicly available!  Either 
this is incredibly foolhardy or makes a statement -- and come what may, 
the $500 has remained unclaimed, as has a similar amount for qmail 
security.
A point well worth noting is that djbdns is some 13,000 lines of C code 
and Bind is well over 100,000 lines of code (I've heard rumours Bind 9 
is 300,000 lines).  It is a _lot_ easier to audit 13,000 lines of code 
for security problems than it is to audit 100,000 lines of code!
For details on the security guarantee itself see
 http://cr.yp.to/djbdns/guarantee.html
For some additional thoughts from djb on secure design (from qmail):
 http://cr.yp.to/qmail/guarantee.html