Sankuru

Today I came across an interesting article at zdnet. The general manager of Skye, an outsourced DNS service, owned by Nominum, claims that BIND would be insecure because anybody can download its source code and discover its vulnerabilities. By the way, BIND is the number one software in use across the internet for implementing DNS services. Since the source code for the DNS server in use at Skye is kept secret, he argues that their offering would be more secure.

The first problem with these statements, is the long history in system security research which resolutely rejects the idea of security through obscurity. The only safe assumption is Shannon's maxim: The enemy knows the system. This research result was originally published by Kerckhoff: The security of a system must depend only on the secrecy of the key, and not on the secrecy of any other part of the system.

Therefore, my first question is now: How much can you trust a company with your security, if they are apparently not aware of even the most basic theories in information security?

My second question is: Since -- in their view -- the source code needs to be secret, what prevents anybody else and their little sister, from making the same unverifiable claims of fantastic security concerning their own secret source code?

According to Hanlon's razor, we should not attribute to malice that which can be adequately explained by stupidity. However, the ability to design and operate a DNS service does require a minimum of intelligence. Therefore, I suspect that the claims do not come from people who are stupid, but from people who think that we are stupid. But then again, the speed at which information gets communicated on the internet, is a disaster for their style of doing business.