Re: DANTE CERT Service

[Peter2 <]

Since I have personally been deeply involved in setting up the European
CERT co-ordination service through ConCERT-in-E, I might as well let you
know my personal opinions in this matter:

> >   ...well, from the point of view of the customers "asking" DANTE to
> >   provide this service, it's probably a coordinated action, isn't it?
> If this is the case, that's fine with me. However, I've spoken to too
> many people being surprised by the DANTA announcement, so it didn't
> appear *that* coordinated.

It was co-ordinated between a very limited number of customers and
DANTE. Not between the European CERTs, who were co-ordinating very
well through the ConCERT-in-E task force, or between that task force 
and DANTE.

> >   However the trust aspect and confidentiality somehow contradicts the
> >   idea of putting up a (commercial) tendering process..
> 
> It's not necessarily more commercial than the DANTE offering. At least,
> it will give interested parties a chance to participate on equal terms.

We were, through ConCERT-in-E, trying to get together as many
interested parties in Europe and leave it up to them what the funding
model would look like and who would provide the service in the end.
That way, even if in the end DANTE would have been chosen to provide
the service, everyone would at least have had a say in that
decision....

Plus all parties would have been able to determine what exactly the
service would consist of.

> >   Or have TERENA do the "tendering" (more like asking for qualified
> >   volunteers) and then provide the financial clearinghouse? 

That was another option that could have been chosen by the participating
parties.

> That's what I thought would happen, and such a Call for Tender has indeed 
> been prepared by TERENA, as far as I know,  which has given me the feeling
> that the TERENA activity in that area was pre-empted by DANTE's announcement 
> of a service. Maybe somebody from TERENA and/or DANTE cares to comment about 
> that? At least one of your customers is a bit confused about these semi- or
> fully-parallel CERT/CC activities, so please clarify the situation!

The only advantage that I personally see in the latest DANTE approach
is speed. Consortium establishment is not done overnight. But the
trade-off may very well be that a lot of countries that don't choose to
buy the service via DANTE will still need some form of ConCERT-in-E.
Result: at least two European CERT co-ordination services.

I think (and I know many other parties think) that we were on the best
possible way through ConCERT-in-E, and I was rather negatively surprised
by this announcement (for which I do not blame DANTE at all BTW).

I'll leave it to our member networks to convince each other that one
approach is better than the other, or even to continue with both. That's
not my job. I can give you my personal opinion though: I am still
convinced that ConCERT-in-E is the right way to do this, even if it will
take a bit more time and effort to establish the service.

At the same time, we cannot forbid DANTE to offer this service of
course. They do need more than 2 customers though for it to succeed....

Cheers,
 JH
-//-