January 2022 - dns-wg - mailman.ripe.net

what I'd want from DNS4EU
by Michael Richardson 01 Feb '22

01 Feb '22

I attended this "morning" (for me)'s discussion about DNS4EU. I don't know much about what the EC is put out in it's RFP as I don't live in the EU (..yet?) and aren't in a position to respond to it. Right now, people know about 8.8.8.8. They spray painted it on walls in Turkey a few years ago! Amateur network administrators, aka local teens, know that if someone is having problems with their device, that sticking 8.8.8.8 in sometimes helps. Many ISPs and many "pro-sumers" who configure their own home gateways will stick 8.8.8.8 in as a DNS server. I run my own recursive resolvers, but, on my desktop I have: nameserver 2607:f0b0:f::babe:f00d nameserver 209.87.249.18 nameserver 8.8.8.8 search sandelman.ca (The first two point to the same machine) Why? because sometimes shit happens, and that local VM is broken, and it's easier to use DNS to fix DNS. Yeah, I have breadcrumbs in my /etc/hosts too. So what I would like DNS4EU to do is to create a European hosted and operated alternative. It doesn't have to be run by a single entity. In fact, I think that this is a bad idea. But, it does have to have the same kind of "name" recognition as 8.8.8.8 (%) That might mean, literally, spray painting it on walls. Berlin people could hire 1UP crew maybe. It seems clear that this new resolver address will need to have multiple servers and and be anycasted. It could be run by a multitude of operators, with at least one per country. That solves the entire digital sovereignty issue, and the "local" denylist. a) This is where RIPE NCC starts to come in: find and allocate some memorable IPv4/24, and IPv6/48 for this. Let's call this R.R.R.R b) In order to run DoT, DoH, we need TLS certificates. If the system is anycast, and is run by a multitude of entities, then we need to be able to deploy certificates to a multitude of entities and each need to manage their own private keys. "dns.google" works because Google is a CA. (I didn't know that was the FQDN for it until I visited it just now) This is the second activity which RIPE NCC should be involved it: coordinating the certificates for the entities. How exactly to do this, technically, is an open question to me. There are many possible arrangements, including some new ones like RFC9060. c) The variety of entities running these servers need consistent and regular training. There is a further interesting thing to me, and that involves the IoT situations with DoT/DoH. There are three issues. 1) IoT devices that ignore the local resolver settings and try to use 8.8.8.8. This upsets many people (Vixie is loudest), because many of us have concerns about what the devices are doing. DoH makes it near impossible to observe. I have an IETF OPSAWG draft about DNS and MUD. There are privacy issues with the devices crossing national jurisdictions with their queries. I suspect GDPR ones, but I'm no lawyer. 2) Many would like to use DNS queries as canaries for malware on IoT devices. 3) Many would like to prevent IoT devices from being able to reach certain known malware sites. Recognize that when we allocate R.R.R.R, we get all of R.R.R.0/24 at least, and we could run a number of diffentiated services at R.R.R.I, etc. If R.R.R.I was promoted as a GDPR-safe place for IoT devices to send queries to, and if the canaries could be coordinated, then that would likely be a win for the security of the Internet. (Of course, making IoT devices pay attention to RDNSS and DHCP values would be my priority. But, return R.R.R.I to those IoT devices would make sense) (%) I know that 8.8.4.4 is also a google resolver, but I rarely use it. 1.1.1.1 is easier to remember. I can't remember the IPv6 for any of them offhand. Yet, I know sprint.net is http://[2600::] for instance. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr(a)sandelman.ca http://www.sandelman.ca/ | ruby on rails [ -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

1 0

RIPE NCC Open House: DNS4EU - 31 January, 13:00 UTC
by Chris Buckridge 25 Jan '22

25 Jan '22

Hi all, The European Commission’s recent launch of a tender process to establish a European public DNS resolver service (“DNS4EU”) has generated discussion on this list and elsewhere. Reflecting that, the RIPE NCC will hold an ‘Open House’ online discussion next Monday, 31 January from 13:00-14:00 UTC (14:00-15:00 CET). We invite anyone with an interest in this issue to join for an opportunity to exchange insight and perspectives. RIPE NCC staff will provide a background presentation to kick off the discussion. You can find additional information and register for the session here: https://www.ripe.net/participate/meetings/open-house/ripe-ncc-open-house-dn… I look forward to seeing many of you there next Monday! Best regards, Chris Buckridge Advisor to the Managing Director, Global Strategic Engagement RIPE NCC

1 0

Re: [dns-wg] DNS4EU?
by Jørgen Hovland ☁️ 21 Jan '22

21 Jan '22

1 0

New on RIPE Labs: DNS Vulnerability, Configuration Errors That Can Cause DDoS
by Alun Davies 20 Jan '22

20 Jan '22

Dear colleagues, Giovane Moura and colleagues discovered a DNS vulnerability that, when combined with a configuration error, can lead to massive DNS traffic surges. In this new article on RIPE Labs, they share more about the work they've been working to mitigate the threat: https://labs.ripe.net/author/giovane_moura/dns-vulnerability-configuration-… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

DNS4EU?
by Ana Sen 20 Jan '22

20 Jan '22

Just to add some background that might betray some of the intent of this initiative. in the first mention of the DNS4EU in the Cybersecurity Strategy published in Dec 2020 a motivation for an EU based resolver to reduce dependencies on - note- a handful of non-EU companies, is marked by a footnote informed by this paper <https://www.tandfonline.com/doi/full/10.1080/23738871.2020.1722191>. This seems like a great idea for somebody thinking about the following terms: how to reduce dependencies on non-EU operated infrastructure, how to provide an EU alternative and, add-ons, it has to comply with all the EU values and norms. Fast forward, the add ons develop by being added by extra technicalities and the CEF2 funding programme has a funding line for this. Ideally there are stakeholders already in discussions with the EU Commissions about what an upcoming funding programme should contain in order to fit with the industry and the market needs. I would not be surprised if this call for proposals is already targeted at known stakeholders, but this could also not be the case. It is also telling that this action looks a bit divorced from the rest of the funding line, which is dedicated to the cloud federation. In the high level political discourse - it's not divorced because it's part of the same narrative of reinforcing EU resources vs non-EU, digital autonomy, sovereignty, etc. This aspect is also reflected in the call document, which foresees an assessment of suppliers to strictly exclude non-EU entities, i.e. non-EU entities are not eligible for this call. -- Sincerely, Anastasia Șendrea (Анастасия Шендря)

6 10

DNS4EU
by Andrew Campling 20 Jan '22

20 Jan '22

You may be aware that the European Commission hosted an information day for DNS4EU (and a range of other projects) earlier today. If you're interested in learning more about the call for proposals for the new resolver, I've posted a short update at https://419.consulting/encrypted-dns/f/dns4eu-update which includes links to various material including a recording of the information day. Andrew

1 0

Re: [dns-wg] dns-wg Digest, Vol 116, Issue 4
by Ana Sen 18 Jan '22

18 Jan '22

correction: the Info day will run from 9AM to *2PM* CEST. Addition: no registration necessary. On Tue, Jan 18, 2022 at 12:00 PM <dns-wg-request(a)ripe.net> wrote: > Send dns-wg mailing list submissions to > dns-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/dns-wg > or, via email, send a message with subject or body 'help' to > dns-wg-request(a)ripe.net > > You can reach the person managing the list at > dns-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of dns-wg digest..." > > > Today's Topics: > > 1. Re: DNS4EU? (Ana Sen) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 18 Jan 2022 11:51:09 +0100 > From: Ana Sen <sendrea.anastasia(a)gmail.com> > To: dns-wg(a)ripe.net > Subject: Re: [dns-wg] DNS4EU? > Message-ID: > < > CACg41NvTTFiXUWi+PVz9wQkwanSbFizFBp_WwQQ7cVpjOr9sXg(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > just an update that tomorrow the EU Commission will organise an Info Day > (like a stakeholder workshop) to cover all the open CEF2 calls for > proposals to respond to any questions interested parties might have. Cloud > federation and DNS will be third on the agenda. The info day will run from > 9 AM to 4 PM CEST. Link: > > https://hadea.ec.europa.eu/events/1st-connecting-europe-facility-digital-ca… > > On Wed, Jan 12, 2022 at 10:27 PM Randy Bush <randy(a)psg.com> wrote: > > > since no one else has said it this time around the tree tracking the > > woozle, ... > > > > how does this avoid creating a nice well-defined target for: IP > > shutdowns, censorship, saving children from abuse, terrorism, ...? > > > > randy > > > > --- > > randy(a)psg.com > > `gpg --locate-external-keys --auto-key-locate wkd randy(a)psg.com` > > signatures are back, thanks to dmarc header butchery > > > > > -- > Sincerely, > > Anastasia ?endrea > (????????? ??????) >

1 0

OARC 37 Workshop, Extending Call for Contributions
by Hazel Smith 13 Jan '22

13 Jan '22

The Program Committee has decided to extend the Call for Contributions until 17 Jan 2022 23:59 UTC. The OARC Board has decided that OARC 37 will be a one day hybrid conference. Thank you if you've already submitted a proposal. We still haven't filled the capacity and are able to accept more content. Please note that remote participation is actively supported. Revised Workshop Milestones: * 27 December 2021 - Submissions open via Indico * 17 January 2022 - Deadline for submission (23:59 UTC) * 19 January 2022 - Initial Contribution list published * 21 January 2022 - Full agenda published * 3 February 2022 - Deadline for slideset submission and Rehearsal * 17 February 2022 - OARC 37 Workshop ( One day conference) The details for presentation submission are published at the Workshop website: https://www.dns-oarc.net/oarc37 If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> Hazel Smith for the DNS-OARC Programme Committee -- Hazel Smith Site Reliability Engineer // Google Cloud, London hazelesque(a)google.com sre.google

1 0

DNS4EU?
by Hank Nussbacher 12 Jan '22

12 Jan '22

19 53