Hi James, I understand this has caused you some discomfort, but it was documented both in the release notes and in the announcement and it was necessary to introduce the limits because more fix would have to be intrusive refactoring of the internals, and that is exactly the thing that we were trying to avoid.
As for your suggestion to ship the BIND 9 in a vulnerable state - that would be absolutely wrong thing to do. We released the new version to make sure the BIND 9 is not vulnerable in the default configuration and administrators might assess the risks when increasing the value of the max-types-per-name for their particular environment. Cheers, Ondrej -- Ondřej Surý (He/Him) ond...@isc.org My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours. > On 24. 7. 2024, at 4:18, James Stegemeyer <ja...@stegemeyer.net> wrote: > > Thanks for the new release, and the hard work you do. > > I recently upgraded from 9.18.24 to 9.18.28 per prompting by Ubuntu > USN-6909-1 to preform a security update. I deployed this into production > after passing some tests when installed in a lab. After the upgrade, > Internal Zones that were hosted by Windows Active Directory were rejected and > caused a production impact. Under Windows Active Directory, the DC's create > a round robin DNS record at the apex of the zone and the number of entries > approximately match the number of DC's in the domain. It is not uncommon to > have hundreds of DC's in a domain, so setting a limit of 100 will likely > cause a series of unexpected outages for IT administrators. Because this > change restricts existing functionality, This is a breaking change and as > such should be reserved to a minor release. If this feature was critical to > resolve an issue a provider was having, it should be shipped with default > values of 0 causing it to be effectively disabled allowing the provider to > opt in.<HmgILl6x1HGckq4d.png>I was able to resolve this issue by adding the > following directive to the affected views: > max-types-per-name 1000; > > --James > > > > -- > Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from > this list > > ISC funds the development of this software with paid support subscriptions. > Contact us at https://www.isc.org/contact/ for more information. > > > bind-users mailing list > bind-users@lists.isc.org > https://lists.isc.org/mailman/listinfo/bind-users -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
