[cooperation-wg] DNS4EU - proposal for a community response - draft

Desiree,

Thank you for this proposal!

On 03/02/2022 20.16, Desiree Miloshevic wrote:
> 
> We’d like to know if there is some support from members for having a 
> RIPE community response on this proposal?

I think that a RIPE community response makes sense.

> We would really appreciate your feedback or any comments you’d wish to 
> make or if you'd like us to work further on this.

I have some feedback, inline below.

> Proposed DNS4EU RIPE community statement comments
> 
> 
>  1.
>     RIPE community believes that governance of the DNS resolution chain,
>     which is such an important element of everybody's Internet
>     connectivity, should involve all stakeholders and can not solely
>     rely on legislation and regulatory oversight.

I think we should be careful with this. For me, it's not really 
important that everyone who could conceivably be considered a 
stakeholder to be involved in governance of DNS resolution. Do we really 
think it is important if bodies like GEMA or other intellectual property 
organizations are part of this (to pick one of many possible groups who 
could claim to be a stakeholder)?

If the goal is to provide the best system for EU citizens and residents, 
then that should be the focus. Certainly access providers and other DNS 
operators can proxy their users' interests, and have a lot of expertise, 
and should be involved though.

>  2.
> 
>     RIPE Community hopes that any winning bidder will adhere to what we
>     see as a fundamental property of the Internet, with a diverse and
>     competitive landscape, anchored on the principles of
>     multistakeholder Internet governance.

"bidders"? Or do expect that any contracts awarded would be to a single 
organization?

>  3.
>     RIPE Community believes that the responsibility of well-functioning
>     Internet access including the DNS resolution is with the access
>     providers. We believe it should stay that way.

Should it? Do access providers want this? Is this really the best way to 
provide performant, reliable, and secure DNS to users?

I think the market forces do not line up properly with recurvive DNS at 
the provider level... I doubt many customers choose a provider based on 
their high-quality DNS service, and so it becomes something that 
companies must provide even though it doesn't make them money. It's a cost.

Public DNS resolvers make recursive DNS pay for itself, either by 
donations (as in the case of Quad9), paid subscriptions (as in the case 
of OpenDNS), or using the data gained for some other purpose in their 
operations (presumably the case for Google and Cloudflare). So money 
spent is improving their actual service; that is, a benefit.

>  4.
>     We understand that to be able to minimise some risks when the end
>     user selects a random DNS resolver, a possible and feasible solution
>     is to have the access provider run their local DNS resolvers and/or
>     an additional DNS resolver as a back-up.

I guess this means that when an end users picks a DNS resolver that 
there is a back-up. Probably that's fine, although more and more this is 
not the user picking, but rather their browser picking some DNS over 
HTTP (DoH) server. Also, note that this is not standard practice 
today... I don't think that I have ever seen a configuration for 
resolution that asks for backup servers.

>  5.
> 
>     We hope that the EU could allocate DNS4EU funds to the local
>     Internet community and encourage Internet access providers to run
>     their local DNS resolvers. Additionally, the funds can be also used
>     towards the development of open source software for better and
>     affordable DNS resolution services.

I'm all for this! There are plenty of companies both for-profit and 
non-profit in the EU that write DNS open source software and provide 
free DNS services.

Cheers,

--
Shane
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x3732979CF967B306.asc
Type: application/pgp-keys
Size: 11617 bytes
Desc: OpenPGP public key
URL: </ripe/mail/archives/cooperation-wg/attachments/20220207/18b04da4/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: </ripe/mail/archives/cooperation-wg/attachments/20220207/18b04da4/attachment.sig>