Post by @paul_ipv6@infosec.exchange

@jwildeboer There could be more of them... but they are all feeding themselves out of hidden primary root controlled by Verisign, a US corporation. So at the end, those public ones don't really count. Except if you consider they might, collectively, all decide to use another root than IANA one which is never impossible but quite not the highest probability. (and see previous court cases about .LY yes there were attempts to remove TLDs from root). They also all have relationships with ICANN. 1/x

@pmevzek It's the other way around. ICANN is the master. And ICANN has so far been quite OK-ish at defending the freedom of The Net. My personal preference would be to have no centralisation at all. But knowing that is impossible in the way DNS works, the next best solution would be to put ICANN under the UN, not the US. One letter, big consequences :)

@jwildeboer "ICANN is the master.". Technically/theoretically just a technical coordinator implementing policies discussed and decided among all stakeholders (including governments with in theory again all the same power, but also other orgs) :-) Yes, no need to point out the difference between theory and practice and who captures what and how much.

@pmevzek It's a discussion I'd rather have over a long evening with food and drinks. 500 character messages are limiting. Could there be a more decentralised way for trust establishment? Yes. I think there is. It's what the ICAO (a UN agency) has established for travel documents. Which relies on a bilateral system of agreements, not a centralised one. See ICAO 9303 part 12 https://www.icao.int/publications/doc-series/doc-9303

@jwildeboer You are comparing something that is relevant only between governments (how they trust each other regarding travel documents) with something that has a public reach and needs a consensus, of not just governments but every single party online (who exactly controls .com or any other TLD?). You could mention as well how most BGP peering are set (over a beer 🙂 ?). But otherwise agree on the fact that the topic is far too broad for a thread here 🙂

@pmevzek I come from the times where you called someone in Dortmund at the university to add your .de domain in the right way, so yes, I am old and biased. I am also one of those that understand the complexity of reliability where centralisation is the obvious choice and decentralisation is an explosion of questions. Right now we can live reasonably well with centralisation on the DNS level but my risk assessment puts doubts on this. What next? That's the question. No real answers.