Re: BIND DNS from base vs. pkg

[Jarle Greipsland <jarle.greipsland%norid.no@localhost>]

Greg Troxel <gdt%lexort.com@localhost> writes:
> Using base seems to me like a good plan.  NetBSD 10 has 9.18
> which is bind-LTS but obviously 11 is better, with one fewer
> upgrade over any system lifetime.  And it's 9.18.24, which is
> not 9.18.50.

ISC support for BIND 9.18 ended in July this year, (see
https://www.isc.org/blogs/2026-06-10-bind9-18-eol/). Since then,
a significant number of vulnerabilities have been fixed in the
BIND 9.20 and 9.21 versions (https://kb.isc.org/docs/aa-00913).
Most of these vulnerabilities also exist in the BIND 9.18 (or
earlier) releases, but have not been fixed there.  For use on the
public Internet, I would strongly recommend that you use a
supported version, and keep your systems up to date (ISC plans to
release more frequent security updates of BIND, see
https://www.isc.org/blogs/2026-05-12-bind-security-updates/)

					-jarle
-- 
What the DNS really needs, is CLUE records ... ;-)
				-- Lars-Johan Liman (liman%sunet.se@localhost)