Ubuntu Systemd Vulnerability
The most dangerous thing about systemd-resolved is that it exposes its own non-standard DNS resolution protocol over dbus, which the documentation recommends applications use instead of standard, interoperable protocols[1]:<p>&gt; The native, fully-featured API systemd-resolved exposes on the bus. See the API Documentation for details. Usage of this API is generally recommended to clients as it is asynchronous and fully featured (for example, properly returns DNSSEC validation status and interface scope for addresses as necessary for supporting link-local networking).<p>systemd wants applications to depend on systemd-resolved so it becomes irreplaceable.  This is very bad, because the first thing you should do on a system with systemd-resolved is uninstall it.  The systemd developers are not qualified to write either DNS software[2] or C code that talks to the network.<p>[1] <a href="https:&#x2F;&#x2F;www.freedesktop.org&#x2F;software&#x2F;systemd&#x2F;man&#x2F;systemd-resolved.service.html" rel="nofollow">https:&#x2F;&#x2F;www.freedesktop.org&#x2F;software&#x2F;systemd&#x2F;man&#x2F;systemd-res...</a><p>[2] See <a href="http:&#x2F;&#x2F;seclists.org&#x2F;oss-sec&#x2F;2014&#x2F;q4&#x2F;592" rel="nofollow">http:&#x2F;&#x2F;seclists.org&#x2F;oss-sec&#x2F;2014&#x2F;q4&#x2F;592</a>, which came out after Lennart Poettering had the hubris to call systemd-resolved a &quot;pretty complete caching DNS and LLMNR stub resolver&quot;[3] even though the dangers of DNS cache poisoning were already well known at the time.<p>[3] <a href="https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;609740&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;609740&#x2F;</a>