<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dear colleagues,</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you all very much for your constructive comments. Please make sure you contribute in the document itself, so our experts can take your views into account when finalising the document.</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof"><span style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">As an explanation. IS3C focuses on the deployment of all security-related Internet standards and ICT best practices. See e.g. the list
of 23 Internet standards (of which one is a best practice) we developed recently that all organisation can use when procuring ICTs. The alternative narrative we are working on now, can be used for all standards and best practices (for more information, see
is3coaltion.org). Also, we make a clear distinction between organisations that need to take action themselves and organisations that need to demand this level of security to be built in by design when procuring ICTs, by adding them to their procurement demands.
The arguments most likely will vary between the two. Please keep this in mind.</span></div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Why DNSSEC and RPKI? Among IS3C's members the desire arose to have one Working Group focus on two standards only. Consensus led to DNSSEC and RPKI, which led to natural partners. Where your concerns on DNSSEC are concerned, please add them in the doc so that
they can be added into the final document. Also, please add the solution, so it can be taken into account as well.</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Should you be interested to participate in our work in the future, please let me know and I will guide you to our membership list. Finally, I am reaching out to you as the Dynamic Coalition's coordinator.</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you again, as your comments are very valuable to us.</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kind regards,</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Wout de Natris</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 14pt; color: rgb(237, 92, 87);">IS3C: Making the Internet more secure and safer</span><span style="font-size: 12pt;"><br>
<br>
</span></div>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of anti-abuse-wg-request@ripe.net <anti-abuse-wg-request@ripe.net><br>
<b>Sent:</b> Tuesday, March 12, 2024 9:57 AM<br>
<b>To:</b> anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net><br>
<b>Subject:</b> anti-abuse-wg Digest, Vol 145, Issue 7</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Send anti-abuse-wg mailing list submissions to<br>
anti-abuse-wg@ripe.net<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mailman.ripe.net/">https://mailman.ripe.net/</a><br>
or, via email, send a message with subject or body 'help' to<br>
anti-abuse-wg-request@ripe.net<br>
<br>
You can reach the person managing the list at<br>
anti-abuse-wg-owner@ripe.net<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of anti-abuse-wg digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: IS3C public consultation on an alternative narrative to<br>
deploy Internet standards (David Conrad)<br>
2. Re: IS3C public consultation on an alternative narrative to<br>
deploy Internet standards (John Levine)<br>
3. Re: IS3C public consultation on an alternative narrative to<br>
deploy Internet standards (Alessandro Vesely)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Mon, 11 Mar 2024 19:55:17 +0000<br>
From: David Conrad <drc@virtualized.org><br>
To: Wout de Natris <denatrisconsult@hotmail.nl><br>
Cc: "anti-abuse-wg@ripe.net" <anti-abuse-wg@ripe.net><br>
Subject: Re: [anti-abuse-wg] IS3C public consultation on an<br>
alternative narrative to deploy Internet standards<br>
Message-ID: <3D269691-628C-49B5-B173-B01518B92EB9@virtualized.org><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hi,<br>
<br>
I've focused my comments specifically on the section entitled "The Alternative Narrative, a Call To Action for Leaders?.<br>
<br>
While I understand the desire to encourage DNSSEC and RPKI deployment at the leadership level, however if you??re targeting policy makers and C-levels, I would strongly encourage a balanced, honest approach, one that highlights both the benefits as well as
risks. From experience, I believe focusing only on (alleged) benefits and stretching applicability (almost beyond recognition) can be quite counter-productive when the inevitable failures (e.g.,
<a href="https://ianix.com/pub/dnssec-outages.html">https://ianix.com/pub/dnssec-outages.html</a>,
<a href="https://packetvis.com/blog/rpki-trust-anchor-malfunctions/)">https://packetvis.com/blog/rpki-trust-anchor-malfunctions/)</a> occur.
<br>
<br>
FWIW.<br>
<br>
Regards,<br>
-drc<br>
Partner/CTO, Layer 9 Technologies (layer9.tech <<a href="http://layer9.tech/">http://layer9.tech/</a>>)<br>
<br>
> On Mar 11, 2024, at 2:58?AM, Wout de Natris <denatrisconsult@hotmail.nl> wrote:<br>
> <br>
> Dear colleagues,<br>
> <br>
> IGF DC IS3C invites you to participate in the consultation on positively enhancing the deployment of two Internet standards: DNSSEC and RPKI. You are invited to answer either of these questions: Do the arguments used to favor a positive decision, convince
you to order deployment within your organisation or from your service provider? / Do they assist you to convince decision takers in your organisation to invest in security by design? You are invited to share your views and arguments with IS3C?s expert team
and have been granted commenting rights in this document to do so. The consultation runs from 11 March to 12PM UTC, Friday 5 April 2024. Your contribution will be taken into consideration when finalising the text before publication this spring. Here is the
link to the Google Doc:<br>
> <br>
> <a href="https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing">
https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing</a><br>
> <<a href="https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing">https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing</a>>
<br>
> IS3C WG 8 work document <<a href="https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing">https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing</a>><br>
> docs.google.com <<a href="http://docs.google.com/">http://docs.google.com/</a>><br>
> We hope to receive your views so we can present the most convincing arguments to deploy DNSSEC, RPKI and all other security-related Internet standards and ICT best practices. (FYI, this project is sponsored by ICANN and RIPE NCC.)<br>
> <br>
> Kind regards,<br>
> <br>
> Wout de Natris<br>
> <br>
> IS3C: Making the Internet more secure and safer<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="/ripe/mail/archives/anti-abuse-wg/attachments/20240311/55076bbb/attachment-0001.html">/ripe/mail/archives/anti-abuse-wg/attachments/20240311/55076bbb/attachment-0001.html</a>><br>
-------------- next part --------------<br>
A non-text attachment was scrubbed...<br>
Name: signature.asc<br>
Type: application/pgp-signature<br>
Size: 249 bytes<br>
Desc: OpenPGP digital signature<br>
URL: <<a href="/ripe/mail/archives/anti-abuse-wg/attachments/20240311/55076bbb/attachment-0001.sig">/ripe/mail/archives/anti-abuse-wg/attachments/20240311/55076bbb/attachment-0001.sig</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: 11 Mar 2024 17:30:26 -0400<br>
From: "John Levine" <johnl@taugh.com><br>
To: anti-abuse-wg@ripe.net<br>
Cc: michele@blacknight.com<br>
Subject: Re: [anti-abuse-wg] IS3C public consultation on an<br>
alternative narrative to deploy Internet standards<br>
Message-ID: <20240311213026.EA5F584E0F56@ary.local><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
It appears that Michele Neylon - Blacknight via anti-abuse-wg <michele@blacknight.com> said:<br>
>-=-=-=-=-=-<br>
>-=-=-=-=-=-<br>
><br>
>Serge<br>
><br>
>Several ccTLD registries have given discounts for DNSSEC.<br>
><br>
>What is unclear is how many of the domains with DNSSEC enabled are in active use, so the lack of ?problems? could be simply down to a complete lack of us / ignorance that the technology was enabled.<br>
><br>
>My main issue with focus on DNSSEC is that it is seen being a ?good use? of resources, so small registries who should invest in other things that are fundamentally more important feel obliged to enable<br>
>it. There?s also the entire ?I?ve got DNSSEC so now my domain / site / service is secure? belief. Much like people who think that smacking an SSL cert on their site magically renders it secure.<br>
<br>
It makes sense if you're likely to be a phish target or you're<br>
sophisticated enough to use DANE. DNSSEC works pretty well for Comcast.<br>
<br>
I agree that for random little private domains the benefit is marginal.<br>
<br>
R's,<br>
John<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Tue, 12 Mar 2024 09:57:49 +0100<br>
From: Alessandro Vesely <vesely@tana.it><br>
To: anti-abuse-wg@ripe.net<br>
Subject: Re: [anti-abuse-wg] IS3C public consultation on an<br>
alternative narrative to deploy Internet standards<br>
Message-ID: <c40c80ee-ada0-496c-acde-2623f13a19a9@tana.it><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
On 11/03/2024 22:30, John Levine wrote:<br>
> It appears that Michele Neylon - Blacknight via anti-abuse-wg <michele@blacknight.com> said:<br>
>><br>
>> Several ccTLD registries have given discounts for DNSSEC.<br>
>><br>
>> What is unclear is how many of the domains with DNSSEC enabled are in active use, so the lack of ?problems? could be simply down to a complete lack of us / ignorance that the technology was enabled.<br>
>><br>
>> My main issue with focus on DNSSEC is that it is seen being a ?good use? of resources, so small registries who should invest in other things that are fundamentally more important feel obliged to enable<br>
>> it. There?s also the entire ?I?ve got DNSSEC so now my domain / site / service is secure? belief. Much like people who think that smacking an SSL cert on their site magically renders it secure.<br>
> <br>
> It makes sense if you're likely to be a phish target or you're<br>
> sophisticated enough to use DANE. DNSSEC works pretty well for Comcast.<br>
> <br>
> I agree that for random little private domains the benefit is marginal.<br>
<br>
<br>
DNSSEC everywhere would make more sense than HTTPS everywhere, which <br>
instead won the hype. Being sure to connect to the IP designated by the <br>
domain is essential, while encrypting every page of sites like, say, <br>
wikipedia is just wasting cycles.<br>
<br>
<br>
Best<br>
Ale<br>
-- <br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
-- <br>
<br>
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit:
<a href="https://mailman.ripe.net/">https://mailman.ripe.net/</a><br>
<br>
<br>
------------------------------<br>
<br>
End of anti-abuse-wg Digest, Vol 145, Issue 7<br>
*********************************************<br>
</div>
</span></font></div>
</body>
</html>