Re: glibc resolver weakness

[djb () CR YP TO (D. J. Bernstein)]

Steven M. Bellovin writes:
  [ random ID to make blind DNS packet forgery more difficult ]
> 16 bits was far too small to do it right,

Unpredictable IDs and port numbers make large-scale blind forgeries
vastly more expensive. That's more than DNSSEC has ever accomplished.
See http://cr.yp.to/dnscache/forgery.html for further comments.

> http://www.research.att.com/~smb/papers/dnshack.ps

Cache poisoning is a solved problem. A modern DNS cache simply discards
records outside the server's bailiwick.

---Dan