The BIND Forum and the maintenance of critical software
BIND, of course, is the package that implements most of the domain name system. The BIND Forum is a relatively old (and controversial) idea - it was first announced back in January, 2001. The basic idea was that members, in exchange for helping to fund BIND development, would gain access to the BIND developers and, crucially, early access to security updates. The idea of restricting security information (about free software) to those who have paid a fee did not prove popular in the community. As a result of criticism, and, presumably, lack of interest, the Forum idea stalled for almost two years. Now, however, it is back.
Corporate memberships in the Forum cost $5000 per year - unless you have over $2 billion in revenue, in which case you pay $50,000. Universities and nonprofit organizations are asked to pay $1000, and individual memberships have a "target minimum" fee of $100. For these fees, members get:
- Direct notification of patches from ISC.
- Read-only access to the ISC cvs server.
- The ability to attend the "BIND Developers Workshop."
All of this requires signing a relatively lengthy contract (available from the ISC site), along with an "intellectual property policy statement" which, essentially, seems to be a restatement of the BIND license.
Those benefits may well be useful to a small number of companies that are deeply concerned with BIND development. What the Forum really has to offer, though, is early access to security alerts. That access is not available to standard Forum members, though; getting the security information requires signing a separate agreement and tacking an addition 20% onto the membership fees. The agreement states that ISC will notify members of security problems "up to ten days" before telling the world by way of CERT. Members are required to keep this information confidential, however, and must guard it "using authentication and encryption tools which have been approved in writing by ISC."
So, if you pay enough, you'll get early warning of security problems, but only if ISC feels like sending it out. Of course, the last vulnerability was not disclosed through ISC, so Forum membership would not have been all that useful that time around.
The Forum appears, to many, to be a way of extracting money from BIND users by restricting access to vital security information. Some see it as a violation of the ethics of full disclosure and free access to the software. This may all be true, but it is worth keeping some things in mind:
- Restricted access to security information during the early stages
of a vulnerability is increasingly the norm. Linux distributors (and
others), for example, maintain a controlled mailing list for the
discussion of security problems. Done properly, restricted access can
help ensure that patches are available to most users before
information on the problem is widely available.
- Companies that rely heavily on software like BIND have an interest
in seeing that it is maintained well. They should be willing
to pay for this work.
- BIND remains free software; anybody who has a better way of maintaining it and handling security problems can fork the project and run it as they see fit.
If the BIND Forum idea is implemented well, it could support the future development of the software and help make it more secure for all users. If implemented poorly, it could become an insiders club that ends up restricting the general availability of security information indefinitely. The "up to ten days" provision in the security notification agreement is encouraging in this respect: there is an implicit promise that security information will be restricted to the Forum for no longer than that period.
Whether the BIND Forum will be a success and be helpful to all BIND users
remains to be seen. It could well go either way. But, as people and
companies continue to look around for viable ways of funding free software
development, it would not be
surprising to see the creation of more organizations like the BIND Forum in
the future.