- dns-wg - mailman.ripe.net

RIPE NCC Open House: DNS4EU - 31 January, 13:00 UTC
by Chris Buckridge 25 Jan '22

25 Jan '22

Hi all, The European Commission’s recent launch of a tender process to establish a European public DNS resolver service (“DNS4EU”) has generated discussion on this list and elsewhere. Reflecting that, the RIPE NCC will hold an ‘Open House’ online discussion next Monday, 31 January from 13:00-14:00 UTC (14:00-15:00 CET). We invite anyone with an interest in this issue to join for an opportunity to exchange insight and perspectives. RIPE NCC staff will provide a background presentation to kick off the discussion. You can find additional information and register for the session here: https://www.ripe.net/participate/meetings/open-house/ripe-ncc-open-house-dn… I look forward to seeing many of you there next Monday! Best regards, Chris Buckridge Advisor to the Managing Director, Global Strategic Engagement RIPE NCC

1 0

Re: [dns-wg] DNS4EU?
by Jørgen Hovland ☁️ 21 Jan '22

21 Jan '22

1 0

New on RIPE Labs: DNS Vulnerability, Configuration Errors That Can Cause DDoS
by Alun Davies 20 Jan '22

20 Jan '22

Dear colleagues, Giovane Moura and colleagues discovered a DNS vulnerability that, when combined with a configuration error, can lead to massive DNS traffic surges. In this new article on RIPE Labs, they share more about the work they've been working to mitigate the threat: https://labs.ripe.net/author/giovane_moura/dns-vulnerability-configuration-… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

DNS4EU?
by Ana Sen 20 Jan '22

20 Jan '22

Just to add some background that might betray some of the intent of this initiative. in the first mention of the DNS4EU in the Cybersecurity Strategy published in Dec 2020 a motivation for an EU based resolver to reduce dependencies on - note- a handful of non-EU companies, is marked by a footnote informed by this paper <https://www.tandfonline.com/doi/full/10.1080/23738871.2020.1722191>. This seems like a great idea for somebody thinking about the following terms: how to reduce dependencies on non-EU operated infrastructure, how to provide an EU alternative and, add-ons, it has to comply with all the EU values and norms. Fast forward, the add ons develop by being added by extra technicalities and the CEF2 funding programme has a funding line for this. Ideally there are stakeholders already in discussions with the EU Commissions about what an upcoming funding programme should contain in order to fit with the industry and the market needs. I would not be surprised if this call for proposals is already targeted at known stakeholders, but this could also not be the case. It is also telling that this action looks a bit divorced from the rest of the funding line, which is dedicated to the cloud federation. In the high level political discourse - it's not divorced because it's part of the same narrative of reinforcing EU resources vs non-EU, digital autonomy, sovereignty, etc. This aspect is also reflected in the call document, which foresees an assessment of suppliers to strictly exclude non-EU entities, i.e. non-EU entities are not eligible for this call. -- Sincerely, Anastasia Șendrea (Анастасия Шендря)

6 10

DNS4EU
by Andrew Campling 20 Jan '22

20 Jan '22

You may be aware that the European Commission hosted an information day for DNS4EU (and a range of other projects) earlier today. If you're interested in learning more about the call for proposals for the new resolver, I've posted a short update at https://419.consulting/encrypted-dns/f/dns4eu-update which includes links to various material including a recording of the information day. Andrew

1 0

Re: [dns-wg] dns-wg Digest, Vol 116, Issue 4
by Ana Sen 18 Jan '22

18 Jan '22

correction: the Info day will run from 9AM to *2PM* CEST. Addition: no registration necessary. On Tue, Jan 18, 2022 at 12:00 PM <dns-wg-request(a)ripe.net> wrote: > Send dns-wg mailing list submissions to > dns-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/dns-wg > or, via email, send a message with subject or body 'help' to > dns-wg-request(a)ripe.net > > You can reach the person managing the list at > dns-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of dns-wg digest..." > > > Today's Topics: > > 1. Re: DNS4EU? (Ana Sen) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 18 Jan 2022 11:51:09 +0100 > From: Ana Sen <sendrea.anastasia(a)gmail.com> > To: dns-wg(a)ripe.net > Subject: Re: [dns-wg] DNS4EU? > Message-ID: > < > CACg41NvTTFiXUWi+PVz9wQkwanSbFizFBp_WwQQ7cVpjOr9sXg(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > just an update that tomorrow the EU Commission will organise an Info Day > (like a stakeholder workshop) to cover all the open CEF2 calls for > proposals to respond to any questions interested parties might have. Cloud > federation and DNS will be third on the agenda. The info day will run from > 9 AM to 4 PM CEST. Link: > > https://hadea.ec.europa.eu/events/1st-connecting-europe-facility-digital-ca… > > On Wed, Jan 12, 2022 at 10:27 PM Randy Bush <randy(a)psg.com> wrote: > > > since no one else has said it this time around the tree tracking the > > woozle, ... > > > > how does this avoid creating a nice well-defined target for: IP > > shutdowns, censorship, saving children from abuse, terrorism, ...? > > > > randy > > > > --- > > randy(a)psg.com > > `gpg --locate-external-keys --auto-key-locate wkd randy(a)psg.com` > > signatures are back, thanks to dmarc header butchery > > > > > -- > Sincerely, > > Anastasia ?endrea > (????????? ??????) >

1 0

OARC 37 Workshop, Extending Call for Contributions
by Hazel Smith 13 Jan '22

13 Jan '22

The Program Committee has decided to extend the Call for Contributions until 17 Jan 2022 23:59 UTC. The OARC Board has decided that OARC 37 will be a one day hybrid conference. Thank you if you've already submitted a proposal. We still haven't filled the capacity and are able to accept more content. Please note that remote participation is actively supported. Revised Workshop Milestones: * 27 December 2021 - Submissions open via Indico * 17 January 2022 - Deadline for submission (23:59 UTC) * 19 January 2022 - Initial Contribution list published * 21 January 2022 - Full agenda published * 3 February 2022 - Deadline for slideset submission and Rehearsal * 17 February 2022 - OARC 37 Workshop ( One day conference) The details for presentation submission are published at the Workshop website: https://www.dns-oarc.net/oarc37 If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> Hazel Smith for the DNS-OARC Programme Committee -- Hazel Smith Site Reliability Engineer // Google Cloud, London hazelesque(a)google.com sre.google

1 0

DNS4EU?
by Hank Nussbacher 12 Jan '22

12 Jan '22

19 53

OARC 37 Call for Contributions
by Hazel Smith 28 Dec '21

28 Dec '21

OARC 37 will be an *online/hybrid* meeting on *February 17th and 18th 2022 starting at 16:00 UTC (10:00 CST)*. The onsite part of the meeting will be held in Austin, Texas. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling). - Deployment: Managing DNS changes and propagation, release process, change management. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: Managing service capacity, failovers, disaster recovery. As it is an *online/hybrid* workshop, we'd like to encourage brevity; presentations should not be longer than 20 minutes (with additional time for questions). **Workshop Milestones:** * 27 December 2021 - Submissions open via Indico * 10 January 2022 - Deadline for submission (23:59 UTC) * 11 January 2022 - Initial Contribution list published * 18 January 2022 - Full agenda published * 3 February 2022 - Deadline for slideset submission and Rehearsal * 17 & 18 February 2022 - OARC 37 Workshop The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc37> DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups at DNS-OARC. See the registration page for details. To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Additional information for speakers of OARC 37: * your talk will be broadcast live and recorded for future reference * your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting * you will be expected to attend a rehearsal on *3rd February 2022*. It would be very useful to have your slides (even if draft) ready for this. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> *Hazel Smith, for the DNS-OARC Programme Committee* OARC depends on sponsorship to fund its workshops and associated social events. Please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Hazel Smith Site Reliability Engineer // Google Cloud, London hazelesque(a)google.com sre.google

1 0

DNS4EU?
by Andrew Campling 21 Dec '21

21 Dec '21

I've noted various comments about the EU's DNS4EU initiative on the list over the last week or so. If anyone is interested in more detail and missed the related discussion on our weekly call a few weeks back, you can find the recording at https://419.consulting/encrypted-dns/f/dns4eu. > On 17 Dec 2021, at 11:21, Stephane Bortzmeyer <bortzmeyer(a)nic.fr> wrote: > > On Fri, Dec 17, 2021 at 01:43:12AM +0000, Geoff Huston <gih(a)apnic.net> > wrote a message of 67 lines which said: > >> The problem for everyone else is the incursion of a US private entity >> into the heart of the Internet?s name resolution infrastructure. >> >> Over the past 16 months the number of EU users who pass queries to >> Google?s Public DNS has risen from a little over 15% to touching 30% >> >> If you are working in the EC and you see yet another piece of the >> Internet?s digital communications infrastructure being aggregated and >> centralized by a gigantic US entity, then wouldn?t you be a little >> bit disconcerted? > > I think we all understand the starting point, and the concern of the > EC. The problem is that they apparently don't provide a detailed > problem analysis. Observing that the market share of US public > resolvers increases is one thing, understanding why is another thing, > and which is very important to solve the problem. Was there are survey > about the reasons for this switch to these resolvers? > > For instance, an important reason (may be the main one) why users use > US public resolvers is because they don't implement censorship > (SciHub, football events, music and film sharing). The DNS4EU project > is silent about whether or not they will have censorship (a > problematic silence!) but I note that they claim DNS4EU is a lying > resolver. Even if lies are initially limited to malware and C&C, I > have no doubt that the IP people (IP not being the Internet Protocol) > will, as soon as they discover DNS4EU, ask for censorship and they are > a very powerful lobby. If DNS4EU yields to their requirments, then the > project is doomed. The use of the pejorative term "lying" resolver is unhelpful in this context. It is important to acknowledge that the vast majority of Internet users are not experts; indeed most are unaware of either the purpose or the existence of DNS. They are however exposed to vast amounts of malicious content and, in my opinion, any mass-market resolver that does not block access to such content by default is not fit for purpose. In addition, for citizens of countries covered by GDPR, accessing a resolver located in the same jurisdiction is beneficial as it doesn't then export personal data elsewhere - US-based resolvers have the disadvantage of falling under the US CLOUD Act and FISA 702. As far as protection of intellectual property is concerned, it seems reasonable to me that Internet companies comply with court orders in the same way that other companies have to do so: despite the assertions of cyberlibertarians, the Internet is not a separate place beyond the reach of national legislation. This is just as well, otherwise we'd still be prey to the whims of surveillance capitalists and not protected by GDPR etc. > >> So I think this is not really about the quality of the alternatives >> available for European users (and ISPs) in the DNS resolution market. > > I don't think that many people switched to Google or Cloudflare > because of DNSSEC validation (unfortunately) but may be they switched > because of technical malfunctions. Each time there is a big breakage > of the resolver of an IAP, everybody on the social networks advise > "use 8.8.8.8" and people don't come back after that. So, even if > DNSSEC doesn't matter, robustness does. > I know that one of the drivers of the DNS4EU project was to improve the resilience of Internet infrastructure given the way that increased centralisation has weakened this over the last few years. Providing an alternative open resolver is just one of several approaches being taken in this regard. An additional benefit of a European resolver is the opportunity to extract localised cybersecurity intelligence, something that I know the similar Canadian Shield project has already acknowledged has been an outcome of its operation. Many of the commercial threat feeds are US-centric whereas DNS4EU provides the ability to draw insight from what may be a significant European user base. Andrew

2 1