Post by @jwildeboer@social.wildeboer.net
At the core of the global internet are the DNS root servers. These 13 go-to places are at the top of authority when it comes to making sure you can connect to any server with a domain name. What you might not know is that 10 of these 13 root servers are ultimately under US jurisdiction. Should that worry you? I guess not, the current system is quite robust. But I deal in risk assessment and probabilities. And I think this isn't an ideal setup.
@jwildeboer There could be more of them... but they are all feeding themselves out of hidden primary root controlled by Verisign, a US corporation. So at the end, those public ones don't really count. Except if you consider they might, collectively, all decide to use another root than IANA one which is never impossible but quite not the highest probability. (and see previous court cases about .LY yes there were attempts to remove TLDs from root). They also all have relationships with ICANN. 1/x
@pmevzek It's the other way around. ICANN is the master. And ICANN has so far been quite OK-ish at defending the freedom of The Net. My personal preference would be to have no centralisation at all. But knowing that is impossible in the way DNS works, the next best solution would be to put ICANN under the UN, not the US. One letter, big consequences :)
2 boosts
@jwildeboer " the next best solution would be to put ICANN under the UN, not the US. " We would have to disagree on that. But there were such attempts in the past. Hence the WSIS, WGIG, IGF, etc. so that idea is 20+ years old and were the major force towards making ICANN less relient on US gov. (breakup from NTIA in 2016). ICANN just houses for now PTI (aka IANA) which technically coordinates. But companies like Verisign have their own specific contracts with US gov.
@jwildeboer "ICANN is the master.". Technically/theoretically just a technical coordinator implementing policies discussed and decided among all stakeholders (including governments with in theory again all the same power, but also other orgs) :-) Yes, no need to point out the difference between theory and practice and who captures what and how much.
@pmevzek It's a discussion I'd rather have over a long evening with food and drinks. 500 character messages are limiting. Could there be a more decentralised way for trust establishment? Yes. I think there is. It's what the ICAO (a UN agency) has established for travel documents. Which relies on a bilateral system of agreements, not a centralised one. See ICAO 9303 part 12 https://www.icao.int/publications/doc-series/doc-9303
@jwildeboer You are comparing something that is relevant only between governments (how they trust each other regarding travel documents) with something that has a public reach and needs a consensus, of not just governments but every single party online (who exactly controls .com or any other TLD?). You could mention as well how most BGP peering are set (over a beer 🙂 ?). But otherwise agree on the fact that the topic is far too broad for a thread here 🙂
@pmevzek I come from the times where you called someone in Dortmund at the university to add your .de domain in the right way, so yes, I am old and biased. I am also one of those that understand the complexity of reliability where centralisation is the obvious choice and decentralisation is an explosion of questions. Right now we can live reasonably well with centralisation on the DNS level but my risk assessment puts doubts on this. What next? That's the question. No real answers.
i think that summarizes well where we are. DNS decentralization is hard and we have more questions and concerns than concrete ways to fix it.
our best and easiest chance to fix this was in the 1980s :)
@jwildeboer @pmevzek Few organizations manage their own DNS servers. They contract with companies, mostly big American companies, as shown in this page: https://ithi.research.icann.org/graph-m9.html. (I helped set up that page.)
centralization of folks running outsourced auth servers, web servers, TLS/cert providers, and email is definitely another disturbing choke point in US control of non-US entities.
not only do many companies not have the staff or expertise to do it themselves, the "big folks" make it very hard to not use one of them. email is probably the worst.
i'd had hopes that VMs and "server in a virtual box" might make that trend slow down but it doesn't seem to.
one of the things we'd need to solve for real decentralization is how to enable entities below the big tech level to do more of their own services and have it accepted by big tech.
@paul_ipv6 @jwildeboer @pmevzek I think that security, and especially resilience to DoS attacks, is a big driver for concentration. The DNS server that you set in your basement can trivially be taken out by a DoS attack, so instead you contract with Cloudflare.
though the technology is binary, the technology implementations don't need to be.
for much of the world, something local to your town or state would be fine and better than a server in a basement. those folks that need DDoS scrubbing could use more choices than cloudflare. certainly folks that don't trust the US govt would prefer a DDoS service not in thrall to the US govt.
if we all don't want to be forever controlled by a half dozen US corporations, we need to start working on viable alternatives.
On behalf of the Mastodon HOA, we are concerned about your attempts to gatekeep people from shaming.
It is 100% acceptable to simply say "you should just move" even if the speaker hasn't done any research on where to move to or the desiderata of the proposed alternatives.
Please make a note of it.
@huitema @paul_ipv6 @pmevzek I don’t really get the logic. When my four (2xIPv4, 2xIPv6) DNS servers I’ve configured as next step would fall over due to some attack, I switch to the next set? And for my local basement services I don’t need to reach out to the internet anyway.
@jwildeboer@social.wildeboer.net
Would be interested in your opinion about @aral@mastodon.ar.al 's take in using plain IP addresses instead of domains, via "web numbers"?
@fasnix @jwildeboer @aral @pmevzek
Much easier to share a customised hosts file, with both ipv4 and ipv6 addresses (and add an ipv6 address/name for your home server so others can use it).
@aral @fasnix @jwildeboer @pmevzek
1. Create hosts file (it's just a plain text file)
2. Share it with people you know
Done and done.
Doesn't matter if someone else creates one that conflicts with yours - your friends use yours. Everyone else, what do I care?
Same as blocking gmail. So what if spammers can't reach me? We all have iThingees, FaceTime and iMessage are end to end encrypted as well as encrypted on the server, and anyone who wants to email me can damn well get a paid email account (I lease server space for web hosting and email, so I'm paying for mine, so not being a hypocrite. I don't want my emails going to a Google server, period).
@barbra@vivaldi.net
"1. Create hosts file (it's just a plain text file)
2. Share it with people you know"
You assume that everybody knows how to create a hosts file.
I don't.
And your "average internet Joe" assumably doesn't as well.
And what about people I don't know, how should they find my (small-)webspace?
Anyone who I can't share that hosts file directly with?
@aral@mastodon.ar.al @jwildeboer@social.wildeboer.net @pmevzek@framapiaf.org
@fasnix @aral @jwildeboer @pmevzek
1) post a clickable link to the ipv6 address. It's just html, which is just text.
2) for discoverability, word of mouth is good enough. You're not looking for eyeballs or to go viral - just a way to bypass American control of the internet. Better to have a small community than a bunch of spammers, influencer shitposts, griefers, grifters, etc. Easily banned by ip when they start showing up.
Eventually set up an allow list - other ips banned, so no AI scraping. People would need a referral for access. Because YOU DON'T WANT EVERYONE AND THEIR DOG IN YOUR COMMUNITY!
No nazis, no fascists, no MAGA, no marketers, no ads (advertising eventually ruins everything it touches).
Just 10 to 1000 people with a shared interest of hobby.
@barbra @fasnix @jwildeboer @pmevzek Right, so decentralised address books. That’s what I’m saying too.
that's a bit strong. ICANN isn't the master. they are the maitre de. everyone running a registry/registrar with a new contract (not the ccTLDs) mostly follows the rules but if there were truly a revolution amongst root server operators or TLD registries, they don't have much recourse.
DNS was originally designed without much thought for politics, rogue states. they solved a lot of technical complexities by having a single coherent root. but that makes real decentralization very hard, if not impossible.
i'd love to see a complete redesign but can't even imagine the chaos and arguments and ridiculously long rollout something else would take.
i'd also much rather see that then then UN trying to take things over. what the UN should be would make sense but the UN hasn't been very effective at most of its charter.