Post by @jwildeboer@social.wildeboer.net
At the core of the global internet are the DNS root servers. These 13 go-to places are at the top of authority when it comes to making sure you can connect to any server with a domain name. What you might not know is that 10 of these 13 root servers are ultimately under US jurisdiction. Should that worry you? I guess not, the current system is quite robust. But I deal in risk assessment and probabilities. And I think this isn't an ideal setup.
@jwildeboer There could be more of them... but they are all feeding themselves out of hidden primary root controlled by Verisign, a US corporation. So at the end, those public ones don't really count. Except if you consider they might, collectively, all decide to use another root than IANA one which is never impossible but quite not the highest probability. (and see previous court cases about .LY yes there were attempts to remove TLDs from root). They also all have relationships with ICANN. 1/x
@pmevzek It's the other way around. ICANN is the master. And ICANN has so far been quite OK-ish at defending the freedom of The Net. My personal preference would be to have no centralisation at all. But knowing that is impossible in the way DNS works, the next best solution would be to put ICANN under the UN, not the US. One letter, big consequences :)
@jwildeboer "ICANN is the master.". Technically/theoretically just a technical coordinator implementing policies discussed and decided among all stakeholders (including governments with in theory again all the same power, but also other orgs) :-) Yes, no need to point out the difference between theory and practice and who captures what and how much.
@pmevzek It's a discussion I'd rather have over a long evening with food and drinks. 500 character messages are limiting. Could there be a more decentralised way for trust establishment? Yes. I think there is. It's what the ICAO (a UN agency) has established for travel documents. Which relies on a bilateral system of agreements, not a centralised one. See ICAO 9303 part 12 https://www.icao.int/publications/doc-series/doc-9303
@jwildeboer You are comparing something that is relevant only between governments (how they trust each other regarding travel documents) with something that has a public reach and needs a consensus, of not just governments but every single party online (who exactly controls .com or any other TLD?). You could mention as well how most BGP peering are set (over a beer 🙂 ?). But otherwise agree on the fact that the topic is far too broad for a thread here 🙂
@pmevzek I come from the times where you called someone in Dortmund at the university to add your .de domain in the right way, so yes, I am old and biased. I am also one of those that understand the complexity of reliability where centralisation is the obvious choice and decentralisation is an explosion of questions. Right now we can live reasonably well with centralisation on the DNS level but my risk assessment puts doubts on this. What next? That's the question. No real answers.
@janikvonrotz@fosstodon.org
i think that summarizes well where we are. DNS decentralization is hard and we have more questions and concerns than concrete ways to fix it.
our best and easiest chance to fix this was in the 1980s :)
@jwildeboer @pmevzek Few organizations manage their own DNS servers. They contract with companies, mostly big American companies, as shown in this page: https://ithi.research.icann.org/graph-m9.html. (I helped set up that page.)
centralization of folks running outsourced auth servers, web servers, TLS/cert providers, and email is definitely another disturbing choke point in US control of non-US entities.
not only do many companies not have the staff or expertise to do it themselves, the "big folks" make it very hard to not use one of them. email is probably the worst.
i'd had hopes that VMs and "server in a virtual box" might make that trend slow down but it doesn't seem to.
one of the things we'd need to solve for real decentralization is how to enable entities below the big tech level to do more of their own services and have it accepted by big tech.
@paul_ipv6 @jwildeboer @pmevzek I think that security, and especially resilience to DoS attacks, is a big driver for concentration. The DNS server that you set in your basement can trivially be taken out by a DoS attack, so instead you contract with Cloudflare.
though the technology is binary, the technology implementations don't need to be.
for much of the world, something local to your town or state would be fine and better than a server in a basement. those folks that need DDoS scrubbing could use more choices than cloudflare. certainly folks that don't trust the US govt would prefer a DDoS service not in thrall to the US govt.
if we all don't want to be forever controlled by a half dozen US corporations, we need to start working on viable alternatives.
On behalf of the Mastodon HOA, we are concerned about your attempts to gatekeep people from shaming.
It is 100% acceptable to simply say "you should just move" even if the speaker hasn't done any research on where to move to or the desiderata of the proposed alternatives.
Please make a note of it.
@huitema @paul_ipv6 @pmevzek I don’t really get the logic. When my four (2xIPv4, 2xIPv6) DNS servers I’ve configured as next step would fall over due to some attack, I switch to the next set? And for my local basement services I don’t need to reach out to the internet anyway.