Great patch! Ask anyone running ZoneAlarm. While removing the so-called 'fix', repeat today's mantra: 'Gates loves me. Ballmer loves me. I am a whole person.'
@Steve
No, no one should discount any security issue, even low priority ones are serious. However, my point is that the press and mainstream blog owners blew this way out of proportion. So you are correct with your blog post and points here in the comments.
Transaction IDs have been predictable for years, why is it that this is such a huge deal now? I mean give me a break, “Internet flaw could let hackers take over the web” is the winner for the FUD driven headline of the month.
I also, while not mentioning it in the article, take offense to the press assuming that most IT workers would fail to realize that DNS issues can lead to problems, and were too stupid not to notice if a vendor released a patch.
The real story is that this was one of the few times, rare even, that vendors from all platforms released patches that deal with exactly the same issue. Nothing more or less.
My advice and opinion stands. If your vendor releases a patch, no matter what it is for, if it is even remotely security related apply it.
There is a reson this flaw is being taken more seriously than last year's: It's more dangerous. (Also, Kaminsky announced it in a way guaranteed to draw maximum attention to it) I'd say 11 seconds to poison a DNS cache with this exploit (according to Paul Vixie in an email to NANOG) as opposed to the days it would've taken previously is worth sitting up and taking notice of.
Buck WheatJul 9th, 2008 - 22:14:57
Great patch! Ask anyone running ZoneAlarm. While removing the so-called 'fix', repeat today's mantra: 'Gates loves me. Ballmer loves me. I am a whole person.'
Report this comment