Paul Vixie...security company? Is it April Fools?

Hey, he's got plenty of experience with vulnerabilities...

It's a metrics/monitoring company, so I'm guessing sprintf not too much of a risk here. There's some incestuous ISC stuff happening with it, though.

Back then, if you used something else than C, people would discard it as too slow. And almost nobody had learned the chainsaw juggling that is "writing safe C", now mastered by a few superheroes. Most people's creations just died by the wayside, unlike things like Bind and Sendmail and BSD Unix, which got incrementally patched up with varying success.

I just checked, and it turns out I'm using Vixie Cron -- I just hadn't noticed it because it's never been a problem.

That being the case, it would be rude of me not to wish him the best of luck in whatever he does next.

I'd like to thank Paul Vixie for his vision in founding PAIX, the template for the modern day internet exchange.

That would have been a lot more classy without the plug for his new company.

What are you talking about? I am not even sure what you think constitutes "plugging his new company." Mentioning that he is moving on to focus on his new company is hardly a plug. He does not even say "I am moving on to my new company, Farsight...", you have to get to his .sig to even find the name.

I cannot imagine anyone in such a high profile position writing that announcement without including a "what is next."

Paul Vixie can plug as much as he wants.

He's silently done so much for all of us for free. He'd have to kick a lot of kittens before his karma would descend to demi-god.

I'm pretty sure he was paid to write BIND, and maybe some other programs you think he did for your benefit, for "free".

And I'm sure these "free" programs, with all their vulnerabilities, have resulted in quite a few dollars in "consulting" fees which he and his "not-for-profit" (=pay no taxes) organization (ISC) has billed for "support" over the years.

Of course, there's nothing wrong with getting paid for your work. It's when you produce bug-ridden programs that are intended for widespread public use and then claim they are the "gold standard" that you may face criticism.

And now he's in the "security" industry. It is indeed comical.

He's doing the ops-y abuse-y bot-y stuff he's been doing for the last decade, from what I can tell. He's not in the branch of security that cares deeply about secure code.