Re: Custom DNS Filtering Plugin in BIND 9

2025-03-20 Thread Grant Taylor via bind-users
On 3/19/25 10:02 AM, Ondřej Surý wrote: Thinking aloud - perhaps, we can extend the plugin API (and RPZ) in a way to add the classification to the message processing and then the RPZ processing could read the classification and take an action? This sounds like my understanding of what the Resp

Re: Custom DNS Filtering Plugin in BIND 9

2025-03-20 Thread Marcus Kool
I wrote a closed source filtering plugin for BIND and I found that the #1 issue is that there is no defined interface between a plugin and BIND internal data structures. Since data structures (may) have small changes between patch releases, this implies that with /every/ release of BIND, the plu

Re: ISC, GitHub, and CVE-2025-30066

2025-03-20 Thread Ondřej Surý
> On 20. 3. 2025, at 23:12, John Thurston wrote: > > And since I know that ISC has projects at GitHub, and I suspect that ISC > projects would be a big, fat, juicy target for code injection, I feel like I > gotta ask . . Is ISC willing to weigh in and say if their projects may have > been aff

ISC, GitHub, and CVE-2025-30066

2025-03-20 Thread John Thurston
I was reading about CVE-2025-30066. I must admit that my git-knowledge is close to nil, but if I'm reading the description right then this CVE is describing a pathway which let bad-actors potentially gain keys to other projects in GitHub. Projects that used the compromised version of *tj-acti

Re: Custom DNS Filtering Plugin in BIND 9

2025-03-20 Thread Michael De Roover
On Wednesday, March 19, 2025 4:05:29 PM CET you wrote: > Michael, > > you can hardly create a static list from all of the domains that can > possibly exists. > > I do understand the usefulness of dynamic classification. > > There’s just not a straightforward interface for it now. Somebody will h