- dns-wg - mailman.ripe.net

EU: DNS abuse study
by Hank Nussbacher 07 Feb '22

07 Feb '22

5 4

IU and publc resolvers
by Jaap Akkerhuis 06 Feb '22

06 Feb '22

Talking about the EU and public resolevsr, ENISA also just published a report about this subject: <https://www.enisa.europa.eu/news/enisa-news/why-security-concerns-drive-cus…>. You will recognize the some names in the "usual supects" list (Acknowledgements section). jaap

2 1

DNS4EU community comment draft proposal
by Joao Luis Silva Damas 06 Feb '22

06 Feb '22

Good morning, Some of you may have already seen this in the cooperation wg mailing list but then again, some may not, so here it goes. We also encourage anyone with opinions on the matter to express them and/or contribute to the statement Regards Joao Damas For the dns-wg chairs ================================================================================= From: Desiree Miloshevic <dmiloshevic(a)donuts.email> To: cooperation-wg(a)ripe.net Dear members, dear all Further to the RIPE NCC’s summary of the DNS4EU Open House discussion posted bellow, and further to your witnessing of our our earlier 'transparent wordsmithing consultation' with other RIPE - WG Chairs I’d like to propose the following high level statement draft for your consideration. Julf and myself, as Co-Chairs are in agreement with this draft statement and Achilleas had excused himself due to his role at the EC. We’d like to know if there is some support from members for having a RIPE community response on this proposal? We would really appreciate your feedback or any comments you’d wish to make. Lastly we'd appreciate if the DNS WG Co-chairs would consider sharing this draft with their members too, since most of the DNS4EU discussion is taking place on that list. Many thanks for your consideration and the feedback, Desiree -- Coop WG Co-Chair Proposed DNS4EU RIPE community statement RIPE community believes that governance of the DNS resolution chain, which is such an important element of everybody's Internet connectivity, should involve all stakeholders and can not solely rely on legislation and regulatory oversight. RIPE Community hopes that any winning bidder will adhere to what we see as a fundamental property of the Internet, with a diverse and competitive landscape, anchored on the principles of multistakeholder Internet governance. RIPE Community believes that the responsibility of well-functioning Internet access including the DNS resolution is with the access providers. We believe it should stay that way. We understand that to be able to minimise some risks when the end user selects a random DNS resolver, a possible and feasible solution is to have the access provider run their local DNS resolvers and/or an additional DNS resolver as a back-up. We hope that the EU could allocate DNS4EU funds to the local Internet community and encourage Internet access providers to run their local DNS resolvers. Additionally, the funds can be also used towards the development of open source software for better and affordable DNS resolution services.

4 3

OARC 37 Schedule is Published
by Hazel Smith 03 Feb '22

03 Feb '22

Hello friends, The schedule for OARC 37 is now published and can be viewed here: https://www.dns-oarc.net/oarc37. Registration is required to be able to attend. The attendees have an option to attend in-person or online. In-person attendees please read about the Covid-19 protocol that's published on the OARC 37 website. Please remember to sign-up for Mattermost chat <http://chat.dns-oarc.net/> and join the Workshops channel. Thank you, Hazel Smith DNS-OARC Programme Committee -- Hazel Smith Site Reliability Engineer // Google Cloud, London hazelesque(a)google.com sre.google

1 0

DNS4EU Open House: summary and recording
by Chris Buckridge 02 Feb '22

02 Feb '22

Dear colleagues, Thank you to all who joined for the RIPE NCC Open House discussion of DNS4EU on Monday, 31 January. We have posted a summary of some key points and links to the video archive here: https://labs.ripe.net/author/chrisb/dns4eu-ripe-ncc-open-house-discussion/ Cheers Chris —— Chris Buckridge Advisor to the Managing Director, Global Strategic Engagement RIPE NCC

3 2

what I'd want from DNS4EU
by Michael Richardson 01 Feb '22

01 Feb '22

I attended this "morning" (for me)'s discussion about DNS4EU. I don't know much about what the EC is put out in it's RFP as I don't live in the EU (..yet?) and aren't in a position to respond to it. Right now, people know about 8.8.8.8. They spray painted it on walls in Turkey a few years ago! Amateur network administrators, aka local teens, know that if someone is having problems with their device, that sticking 8.8.8.8 in sometimes helps. Many ISPs and many "pro-sumers" who configure their own home gateways will stick 8.8.8.8 in as a DNS server. I run my own recursive resolvers, but, on my desktop I have: nameserver 2607:f0b0:f::babe:f00d nameserver 209.87.249.18 nameserver 8.8.8.8 search sandelman.ca (The first two point to the same machine) Why? because sometimes shit happens, and that local VM is broken, and it's easier to use DNS to fix DNS. Yeah, I have breadcrumbs in my /etc/hosts too. So what I would like DNS4EU to do is to create a European hosted and operated alternative. It doesn't have to be run by a single entity. In fact, I think that this is a bad idea. But, it does have to have the same kind of "name" recognition as 8.8.8.8 (%) That might mean, literally, spray painting it on walls. Berlin people could hire 1UP crew maybe. It seems clear that this new resolver address will need to have multiple servers and and be anycasted. It could be run by a multitude of operators, with at least one per country. That solves the entire digital sovereignty issue, and the "local" denylist. a) This is where RIPE NCC starts to come in: find and allocate some memorable IPv4/24, and IPv6/48 for this. Let's call this R.R.R.R b) In order to run DoT, DoH, we need TLS certificates. If the system is anycast, and is run by a multitude of entities, then we need to be able to deploy certificates to a multitude of entities and each need to manage their own private keys. "dns.google" works because Google is a CA. (I didn't know that was the FQDN for it until I visited it just now) This is the second activity which RIPE NCC should be involved it: coordinating the certificates for the entities. How exactly to do this, technically, is an open question to me. There are many possible arrangements, including some new ones like RFC9060. c) The variety of entities running these servers need consistent and regular training. There is a further interesting thing to me, and that involves the IoT situations with DoT/DoH. There are three issues. 1) IoT devices that ignore the local resolver settings and try to use 8.8.8.8. This upsets many people (Vixie is loudest), because many of us have concerns about what the devices are doing. DoH makes it near impossible to observe. I have an IETF OPSAWG draft about DNS and MUD. There are privacy issues with the devices crossing national jurisdictions with their queries. I suspect GDPR ones, but I'm no lawyer. 2) Many would like to use DNS queries as canaries for malware on IoT devices. 3) Many would like to prevent IoT devices from being able to reach certain known malware sites. Recognize that when we allocate R.R.R.R, we get all of R.R.R.0/24 at least, and we could run a number of diffentiated services at R.R.R.I, etc. If R.R.R.I was promoted as a GDPR-safe place for IoT devices to send queries to, and if the canaries could be coordinated, then that would likely be a win for the security of the Internet. (Of course, making IoT devices pay attention to RDNSS and DHCP values would be my priority. But, return R.R.R.I to those IoT devices would make sense) (%) I know that 8.8.4.4 is also a google resolver, but I rarely use it. 1.1.1.1 is easier to remember. I can't remember the IPv6 for any of them offhand. Yet, I know sprint.net is http://[2600::] for instance. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr(a)sandelman.ca http://www.sandelman.ca/ | ruby on rails [ -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

1 0

RIPE NCC Open House: DNS4EU - 31 January, 13:00 UTC
by Chris Buckridge 25 Jan '22

25 Jan '22

Hi all, The European Commission’s recent launch of a tender process to establish a European public DNS resolver service (“DNS4EU”) has generated discussion on this list and elsewhere. Reflecting that, the RIPE NCC will hold an ‘Open House’ online discussion next Monday, 31 January from 13:00-14:00 UTC (14:00-15:00 CET). We invite anyone with an interest in this issue to join for an opportunity to exchange insight and perspectives. RIPE NCC staff will provide a background presentation to kick off the discussion. You can find additional information and register for the session here: https://www.ripe.net/participate/meetings/open-house/ripe-ncc-open-house-dn… I look forward to seeing many of you there next Monday! Best regards, Chris Buckridge Advisor to the Managing Director, Global Strategic Engagement RIPE NCC

1 0

Re: [dns-wg] DNS4EU?
by Jørgen Hovland ☁️ 21 Jan '22

21 Jan '22

1 0

New on RIPE Labs: DNS Vulnerability, Configuration Errors That Can Cause DDoS
by Alun Davies 20 Jan '22

20 Jan '22

Dear colleagues, Giovane Moura and colleagues discovered a DNS vulnerability that, when combined with a configuration error, can lead to massive DNS traffic surges. In this new article on RIPE Labs, they share more about the work they've been working to mitigate the threat: https://labs.ripe.net/author/giovane_moura/dns-vulnerability-configuration-… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

DNS4EU?
by Ana Sen 20 Jan '22

20 Jan '22

Just to add some background that might betray some of the intent of this initiative. in the first mention of the DNS4EU in the Cybersecurity Strategy published in Dec 2020 a motivation for an EU based resolver to reduce dependencies on - note- a handful of non-EU companies, is marked by a footnote informed by this paper <https://www.tandfonline.com/doi/full/10.1080/23738871.2020.1722191>. This seems like a great idea for somebody thinking about the following terms: how to reduce dependencies on non-EU operated infrastructure, how to provide an EU alternative and, add-ons, it has to comply with all the EU values and norms. Fast forward, the add ons develop by being added by extra technicalities and the CEF2 funding programme has a funding line for this. Ideally there are stakeholders already in discussions with the EU Commissions about what an upcoming funding programme should contain in order to fit with the industry and the market needs. I would not be surprised if this call for proposals is already targeted at known stakeholders, but this could also not be the case. It is also telling that this action looks a bit divorced from the rest of the funding line, which is dedicated to the cloud federation. In the high level political discourse - it's not divorced because it's part of the same narrative of reinforcing EU resources vs non-EU, digital autonomy, sovereignty, etc. This aspect is also reflected in the call document, which foresees an assessment of suppliers to strictly exclude non-EU entities, i.e. non-EU entities are not eligible for this call. -- Sincerely, Anastasia Șendrea (Анастасия Шендря)

6 10