La Salle Debain

Today was our 11th wedding anniversary. It's amazing to think that so much time has passed but Jyoti and I are still filled with the unlimited breadsticks of our love.

! http://www.braincells.com/debian/images/1234567890.gif 400w 268h (1234567890) !

On Monday, I was informed that my server (a xen instance hosted at Brainfood was chewing up a lot of bandwidth by giving out long DNS responses at the rate of several per second. According to Peter Palfrader, it was most likely due to this DoS attack.

Apparently I was contributing to the problem because my name server (running bind9 ) was accepting queries from anywhere on the Internet. You can test this via an online tool from SANS or by issuing the following command from a machine which is not on your network.

dig -t ns @your.name.server

If the status that comes back is NOERROR, you have a problem.

The fix is to restrict the IPs you allow queries from by adding the allow-query directive to your bind configuration. If you are using the stock Debian setup, add it in the options stanza in /etc/bind/named.conf.options

Because all my services run on one machine, I did it like this:

allow-query { localhost; };

If yours are spread out over several hosts, you need to add all their IPs.

If you are authoritative for any zones, you want to allow queries from anywhere so add

allow-query { any; };

to the stanza for each zone. In a stock Debian setup, these are in /etc/bind/named.conf.local

Once you have done this and restarted bind, go back to the online tool or run dig again. If status is REFUSED, congratulations you have saved the Internet.

So in the end I decided to vote in the Lenny/DFSG violations GR despite lingering apathy. Option 5 won so hopefully we can get on with releasing the next stable version of Debian.

For giggles, I explained all the issues to my daughter Shailaja and asked for her opinion. Her advice is that we should not worry about firmware being non-free because it could take a long time to sort out and in the mean time people would get fed up of waiting for Debian and go somewhere else. However we should make a big list of all the devices that require the binary blobs and tell everyone not to use them. To this end she has made the following sign you can copy and send to recalcitrant hardware manufacturers.

Attention Tiago. In the future please follow standard Debian Planet protocols.

- - -=-=-=-=-=- Don't Delete Anything Between These Lines =-=-=-=-=-=-=-=-
[ 5 ] Choice 1: Reaffirm mango as the only acceptable flavour for lassi [3:1]
[ 7 ] Choice 2: Allow gulab jamun but only if you clear your plate what do you think I'm made of money or what?
[ 6 ] Choice 3: Allow gulab jamun but give what you can't eat to your sister I'm never bringing you here again
[ 3 ] Choice 4: Empower the release team to order extra naan
[ 4 ] Choice 5: Assume the green bits are really spicy
[ 2 ] Choice 6: Exclude nutritional info -- trust me you don't want to know
[ 1 ] Choice 7: Further Discussion
- - -=-=-=-=-=- Don't Delete Anything Between These Lines =-=-=-=-=-=-=-=-

It has been reported that the roots of Monty Python's Dead Parrot Sketch are 1600 years old. The original is from a Greek joke collection called Philogelos (The Laugh Addict.) It goes like this:

A man goes up to a student dunce (scholastikos) and says "The slave you sold me died." "By the Gods," the dunce counters, "When he was with me, he never did any such thing!"

I HAVE NO FRONT TEETH. YOUR ARGUMENT IS INVALID.