7 ms·

From what I read in the proposal the core idea of it is solid. DNS is a vital piece of infrastructure, and we should take steps to ensure it keeps working. Putt

From what I read in the proposal the core idea of it is solid. DNS is a vital piece of infrastructure, and we should take steps to ensure it keeps working. Putting together task forces to make sure it is secure therefore sounds like a very good idea. Root servers might be out of scope to some degree for this however. Interestingly enough the root servers also aren't mentioned in the proposal itself, nor in the annex listing essential services. They're only mentioned in the lead up, which is the argument for why it's needed. It somewhat feels like they left it in accidentally, especially with the parliament immediately amending to scrap it from the lead up as well.

ur-whale 5y ago
> DNS is a vital piece of infrastructure It is, and therefore it should be 100% decentralized, if only to keep it out of the grabby hands of governments, EU or otherwise.
- madeofpalk 5y ago
  Is the 12 root server organisations an example of decentralisation?
  - EricE 5y ago
    Yup. As well as the decentralization and diversity of the technical operations of each pool. Operational diversity can be as important or even more important than technical diversity since humans tend to be the weakest links in technical chains :p
  - deleted 5y ago
    [deleted]
  - ur-whale 5y ago
    > Is the 12 root server organisations an example of decentralisation? It isn't. Proof: the fact that US random three letter agencies can take down websites.
    - _-david-_ 5y ago
      It is impossible to build any website that cannot be taken down. The government could seize the physical servers if they wanted to. By your definition that means nothing is decentralized.
      - booleandilemma 5y ago
        This sounds like a problem to solve.
        _-david-_ 5y ago
        How? Even if you were to host a website on a satellite the government could launch a rocket and blow it up. If the website is hosted on Earth they could physically cut cables if they wanted to. There is no way to fully prevent the government from preventing access to a website. The internet is decentralized, but not fully immune from governments.
        jrockway 5y ago
        I mean, you can have more than one copy of the website. Maybe a government can send one satellite-destroying missile, but probably not thousands of them. Think about how many people have the Linux kernel Git repo cloned on their workstation. It would be essentially impossible for any government to destroy all copies.
      - Sargos 5y ago
        >It is impossible to build any website that cannot be taken down This is becoming less true each day, especially with the advent of IPFS and Ethereum. Uniswap's website will never go down. uniswap.org might be seized but uniswap.eth cannot be altered by anyone. In a few decades it will be normal for websites to be decentralized and permanent. It's actually quite needed for the robustness of critical internet architecture.
        _-david-_ 5y ago
- theshrike79 5y ago
  Hear me out: BLOCKCHAIN DNS! /s
  - watt 5y ago
    https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin all you want
  - twobitshifter 5y ago
    Aaron Swartz (edit) had the same idea http://www.aaronsw.com/weblog/squarezooko http://www.aaronsw.com/weblog/squarezooko
    - BugsJustFindMe 5y ago
      There's no ch in Swartz
  - Sargos 5y ago
    This ended with /s but DNS and other global namespace management systems are actually one of the problems blockchains solve perfectly. We all need to know what the value of some key->value pair is and have that information always available and easy to update. Blockchains handle data distribution natively, allow updates from authorized parties, and have 100% uptime. Transitioning DNS to something like ENS is something with lots of upsides and few downsides. Take a look at https://ens.domains/about https://ens.domains/about and https://handshake.org/ https://handshake.org/
- jonhearty 5y ago
  Handshake.org provides an alternate root zone that seems pretty relevant here
- salawat 5y ago
  No it isn't. It's a crutch, but also one of the most centralized, manipulable levers for controlling what is and isn't discoverable on the Net. Think about it. Domain names are seizable. IP's aren't. You can't stop someone with an IP from existing. Whenever someone talks about regulating DNS, it should translate to "We want to take control of Namespace management.
EricE 5y ago
The single biggest thing keeping the root servers working is the very model this law would disrupt. Indeed, you want ecosystem diversity. You don't want every operator of a pool of root servers doing everything the same way because if someone figures out how to disrupt those operations and if everyone is operating the same way then poof - they all fall down. Top down planning/regulation has it's place, but it's hardly the solution - and brings zero value to this topic. Indeed, in 40 years the model has worked just fine - surviving technical, political and legal challenges and no one was the wiser. There is zero in this law that would improve upon that record.
- anticristi 5y ago
  Devil's advocate here. The DNS root servers worked, but don't quite feel up to speed with regulations. AFAIU, the root servers still receive FQDN and IP, which is not GDPR-friendly and technically unnecessary. Also, I'm not sure what happens if a crazy US president decided to disrupt .eu. While regulating root DNS servers might be undesirable now, it sure feels like the right moment to start the conversation.
  - khuey 5y ago
    The US government is no longer in control of the root servers, and even if it were, I doubt .eu would be at the top of the target list.
    - deleted 5y ago
      [deleted]
  - _-david-_ 5y ago
    > AFAIU, the root servers still receive FQDN This part is solved with qname minimisation.
  - Denvercoder9 5y ago
    > AFAIU, the root servers still receive FQDN and IP, which is not GDPR-friendly and technically unnecessary. This is only a problem for a tiny fraction of queries. The records served by the root servers can be cached (e.g. .com has a TTL of 2 days), so most queries don't even hit the root servers. It's a much bigger problem for the registry nameservers.
fsckboy 5y ago
> Putting together task forces to make sure it is secure therefore sounds like a very good idea. the top comment on HN for topics like this frequently follows the format of your comment, saying something that sounds so reasonable, who could object? But the way the internet works didn't come about magically, it was planned and modified through trial and error by experts who, working together, can be seen as nothing other than a task force. So you are looking for a new task force to interrupt and disturb a task force that already exists. This will inevitably lead to the need for yet another new task force to look into what this task force has done...
wyager 5y ago
So, we take a system that has been working perfectly for 40 years, and throw some government “task forces” at it, and we hope this makes it work better?
- kuschku 5y ago
  Most of the internet worked fine for decades without encryption or access control as well, but the situation has changed

ur-whale 5y ago

> DNS is a vital piece of infrastructure It is, and therefore it should be 100% decentralized, if only to keep it out of the grabby hands of governments, EU or otherwise.

madeofpalk 5y ago
Is the 12 root server organisations an example of decentralisation?
- EricE 5y ago
  Yup. As well as the decentralization and diversity of the technical operations of each pool. Operational diversity can be as important or even more important than technical diversity since humans tend to be the weakest links in technical chains :p
- deleted 5y ago
  [deleted]
- ur-whale 5y ago
  > Is the 12 root server organisations an example of decentralisation? It isn't. Proof: the fact that US random three letter agencies can take down websites.
  - _-david-_ 5y ago
    It is impossible to build any website that cannot be taken down. The government could seize the physical servers if they wanted to. By your definition that means nothing is decentralized.
    - booleandilemma 5y ago
      This sounds like a problem to solve.
      - _-david-_ 5y ago
        How? Even if you were to host a website on a satellite the government could launch a rocket and blow it up. If the website is hosted on Earth they could physically cut cables if they wanted to. There is no way to fully prevent the government from preventing access to a website. The internet is decentralized, but not fully immune from governments.
        jrockway 5y ago
        I mean, you can have more than one copy of the website. Maybe a government can send one satellite-destroying missile, but probably not thousands of them. Think about how many people have the Linux kernel Git repo cloned on their workstation. It would be essentially impossible for any government to destroy all copies.
    - Sargos 5y ago
      >It is impossible to build any website that cannot be taken down This is becoming less true each day, especially with the advent of IPFS and Ethereum. Uniswap's website will never go down. uniswap.org might be seized but uniswap.eth cannot be altered by anyone. In a few decades it will be normal for websites to be decentralized and permanent. It's actually quite needed for the robustness of critical internet architecture.
      - _-david-_ 5y ago
theshrike79 5y ago
Hear me out: BLOCKCHAIN DNS! /s
- watt 5y ago
  https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin all you want
- twobitshifter 5y ago
  Aaron Swartz (edit) had the same idea http://www.aaronsw.com/weblog/squarezooko http://www.aaronsw.com/weblog/squarezooko
  - BugsJustFindMe 5y ago
    There's no ch in Swartz
- Sargos 5y ago
  This ended with /s but DNS and other global namespace management systems are actually one of the problems blockchains solve perfectly. We all need to know what the value of some key->value pair is and have that information always available and easy to update. Blockchains handle data distribution natively, allow updates from authorized parties, and have 100% uptime. Transitioning DNS to something like ENS is something with lots of upsides and few downsides. Take a look at https://ens.domains/about https://ens.domains/about and https://handshake.org/ https://handshake.org/
jonhearty 5y ago
Handshake.org provides an alternate root zone that seems pretty relevant here
salawat 5y ago
No it isn't. It's a crutch, but also one of the most centralized, manipulable levers for controlling what is and isn't discoverable on the Net. Think about it. Domain names are seizable. IP's aren't. You can't stop someone with an IP from existing. Whenever someone talks about regulating DNS, it should translate to "We want to take control of Namespace management.

EricE 5y ago

The single biggest thing keeping the root servers working is the very model this law would disrupt. Indeed, you want ecosystem diversity. You don't want every operator of a pool of root servers doing everything the same way because if someone figures out how to disrupt those operations and if everyone is operating the same way then poof - they all fall down. Top down planning/regulation has it's place, but it's hardly the solution - and brings zero value to this topic. Indeed, in 40 years the model has worked just fine - surviving technical, political and legal challenges and no one was the wiser. There is zero in this law that would improve upon that record.

anticristi 5y ago
Devil's advocate here. The DNS root servers worked, but don't quite feel up to speed with regulations. AFAIU, the root servers still receive FQDN and IP, which is not GDPR-friendly and technically unnecessary. Also, I'm not sure what happens if a crazy US president decided to disrupt .eu. While regulating root DNS servers might be undesirable now, it sure feels like the right moment to start the conversation.
- khuey 5y ago
  The US government is no longer in control of the root servers, and even if it were, I doubt .eu would be at the top of the target list.
  - deleted 5y ago
    [deleted]
- _-david-_ 5y ago
  > AFAIU, the root servers still receive FQDN This part is solved with qname minimisation.
- Denvercoder9 5y ago
  > AFAIU, the root servers still receive FQDN and IP, which is not GDPR-friendly and technically unnecessary. This is only a problem for a tiny fraction of queries. The records served by the root servers can be cached (e.g. .com has a TTL of 2 days), so most queries don't even hit the root servers. It's a much bigger problem for the registry nameservers.

fsckboy 5y ago

> Putting together task forces to make sure it is secure therefore sounds like a very good idea. the top comment on HN for topics like this frequently follows the format of your comment, saying something that sounds so reasonable, who could object? But the way the internet works didn't come about magically, it was planned and modified through trial and error by experts who, working together, can be seen as nothing other than a task force. So you are looking for a new task force to interrupt and disturb a task force that already exists. This will inevitably lead to the need for yet another new task force to look into what this task force has done...

wyager 5y ago

So, we take a system that has been working perfectly for 40 years, and throw some government “task forces” at it, and we hope this makes it work better?

kuschku 5y ago
Most of the internet worked fine for decades without encryption or access control as well, but the situation has changed