Challenges and uptake of modern Internet standards (including, but not limited to IPv6, DNSSEC, HTTPS, RPKI) – WS 11 2020
12 June 2020 | 11:30-13:00 | Studio Berlin | | |
Consolidated programme 2020 overview / Day 2
Get involved!
You are invited to become a member of the session Org Team! By joining a Org Team you agree to that your name and affiliation will be published at the respective wiki page of the session for transparency reasons. Please subscribe to the mailing list to join the Org Team and answer the email that will be send to you requesting your confirmation of subscription.
Implementing new technologies and changing standards has normally been met with debate and multiple concerns – whether technical, operational, financial, organisational, policy-related or an aversion to change. In this session there will be insightful analysis of the slow uptake or non-adoption of these consensual and agreed upon Internet standards, leading to a discussion on ways to encourage adoption.
Session description
The world is in constant change, and the Internet Community expects new technologies and engineering processes to meet growing demands (on capacity, functionality, security, privacy, etc.).
Internet Standards are normally approved with consensus from the technical community and other stakeholders, although some (like DoH - DNS over HTTPS) are controversial for different reasons.
It stands to reason that "consensual" new Standards implementation / deployment would be beneficial for the Internet Community, but for a multitude of reasons, many Standards have not been deployed as quickly as expected.
Some reasons for delay or deliberate non-adoption:
- Lack of demand by customers (most non-technical customers don't understand the implications);
- Decision makers and staff lack information and/or education/training (technical, security and privacy implications, costs versus benefits, capacity to understand the implications, etc.);
- Resistance to change (e.g. "currently working, changing may fail and put my job or bonus at risk", etc.);
- Financial reasons;
- Insufficient human resources to implement change.
Some reasons for forced adoption:
- Legal / regulation (e.g. Public institutions must comply with certain minimum standards);
- Pressure from big players (e.g. Google's forcing of HTTPS);
- Marketing / commercial (e.g. "Everyone now supports it, we'll look bad if we don't");
- Technical limitations (not enough IPv4 addresses, and more recently, exhausted);
In this session we'll:
- Identify the "consensual" modern Internet Standards that had / are having implementation problems;
- Implementation statistics;
- Critical cases (e.g. points of no return, impossibility to continue to provide services or provide them at reduced functionality/performance, etc.);
- Case studies for unsuccessful implementation, and respective reasons;
- Case studies for successful implementation, and how can these positive examples be used in unsuccessful cases;
- Consider how the strain in Internet and Cloud resources caused by COVID-19 has affected the perception of these problems, both on customer and provider perspectives ("Will this be an awareness turning point?").
The session discussion will feature multiple Key Participants (as well as Org Team members) representative of relevant stakeholders (technical community, Internet providers, political and regulatory, business and individual consumer groups, etc.).
Participation from the audience is encouraged.
Format
Scheduled: 2020-06-12 (Friday), 11:30 - 13:00 CEST (UTC+02)
Duration: 90 minutes
Agenda:
- Introduction:Scope of the session, list of standards, key people intro, etc. (moderator) [max.5 minutes]
- Statistics of standards adoption (Geoff Huston) [max.5 minutes]
- Highlights from "Setting the Standard For a more Secure and Trustworthy Internet" prepared for the IGF (Wout de Natris) [max.5 minutes]
- Interactive discussion (key participants + audience)
- Discussion will focus on case studies, scenarios of successful or unsuccessful implementation of current Internet Standards
- Q&A (ongoing)
- Messages (Ilona Stadnik), feedback and final notes [max.10 minutes]
People
Information about each person in this section is in the respective LinkedIn page.
Focal Point
- André Melancia - Technical community, Portugal
Organising Team (Org Team) (in joining order)
- Vittorio Bertola - Head of Policy & Innovation at Open-Xchange, Italy
- Eva Ignatuschtschenko - Department for Digital, Culture, Media and Sport (DCMS), United Kingdom
- Jan Zorz - VP of 6connect Labs at 6conect, Slovenia
- Carlos Friaças - Head of RCTS CERT at FCCN, Portugal
- Andrew Campling - Director at 419 Consulting, United Kingdom
- Wout de Natris - Owner/consultant De Natris Consult, Netherlands
- Denesh Bhabuta - Collaboration Enabler and Industry Unifier; DNS-OARC, UKNOF, PTNOG, Meidan Ventures, United Kingdom
- Eduardo Daurte - Technical Director DNS.PT, Portugal
- Roberto Gaetano - "Retired but active", Former Chair of the Board at Public Interest Registry, Austria
- Kris Shrishak - Researcher, Germany
Subject Matter Expert (SME)
- Polina Malaja - Policy Advisor at CENTR, Belgium
Key Participants
Key Participants are experts willing to provide their knowledge during a session – not necessarily on stage. Key Participants should contribute to the session planning process and keep statements short and punchy during the session. They will be selected and assigned by the Org Team, ensuring a stakeholder balanced dialogue also considering gender and geographical balance.
Key Participants and Org Team members are representative of the relevant stakeholder groups for this workshop (technical community, Internet providers, government, consumer groups, etc.)
- Caroline Greer - Head of European Public Policy at Cloudflare, Belgium
- João Damas - Senior Researcher at APNIC Labs, Spain
- Geoff Huston - Chief Scientist at APNIC, Australia
- Arda Gerkens - Member of the Senate (SP), Netherlands
- Wido Potters - Manager Support & Sales at BIT, Netherlands
- Martin Vliem - Microsoft, Netherlands
Moderator
The moderator is the facilitator of the session at the event. Moderators are responsible for including the audience and encouraging a lively interaction among all session attendants.
- André Melancia - Technical community, Portugal
Remote Moderator
Trained remote moderators will be assigned on the spot by the EuroDIG secretariat to each session.
- Lilian Weiche - Policy Fellow at German Informatics Society, Germany
Studio Host
- Elisabeth Schauermann - Policy & Communications Officer at German Informatics Society, Germany
Reporter
- Ilona Stadnik, Russia – Geneva Internet Platform
Captioner
- Rochelle H.
Current discussion, conference calls, schedules and minutes
See the discussion tab on the upper left side of this page.
This page includes Org Team and Key Participants meeting information, summaries of relevant mailing list mails and preparatory discussions.
Messages
A short summary of the session will be provided by the Reporter after the event.
Video record
Will be provided here after the event.
- Temporary live stream: https://youtu.be/DqAlPWMMcSg
Transcript
Will be provided here after the event.
- Temporary live transcript: https://www.streamtext.net/text.aspx?event=CFI-EuroDIG2
Chat log from the session is also available in the Discussion page.
Further reading
The list below included only some Standards, including respective case studies and comments.
- HTTPS
- Unsuccessful adoption for the majority of websites (1994 - 2018). Exceptions: e-government, e-commerce, e-banking, etc.;
- Successful: In 2018 Google "forced" adoption by downgrading the ranking of site inaccessible by HTTPS ( https://en.wikipedia.org/wiki/HTTPS#History );
- LetsEncrypt innitiative also helped!
- Comments:
- All browsers quickly supported HTTPS (several encryption protocols existed and most supported quickly - the famous green/red address bar), but website creators didn't support it;
- Some companies have IT policies forcing HTTPS only (no insecure HTTP traffic allowed except redirects);
- Rights and privacy organisations have supported using HTTPS;
- Some governments have legislated forcing HTTPS (NL - see further links below), while others insist on low encryption (justifying the need to for law enforcement to detect criminal and terrorist activities);
- Tools
- Further links:
- IPv6
- 1990s work, RFC published in 1998 ( https://tools.ietf.org/html/rfc2460 ). Academic adoption by many NRENs in mid 2000s decade;
- Comments:
- Most commercial providers mostly didn't adopt IPv6 yet;
- Most companies don't care about not having IPv6 until it becomes a problem;
- IPv6 adoption has been promoted by academia, NREN and niche companies (not too much luck spreading to the overall community);
- NL registy has an incentives programme: https://www.sidn.nl/en/news-and-blogs/registrar-scorecard-yields-great-results
- Any governments legislated forcing HTTPS?
- Facebook claims to have IPv6 only (not dual-stack) internal datacentres;
- Statistics:
- Current global adoption is around 30%. Depending on the country, from 0% to 58%. In Europe, top are Belgium with 55% followed by Germany. Bottom are Spain, Italy, Denmark, Sweden, all with less than 5%.
- https://www.akamai.com/us/en/resources/our-thinking/state-of-the-internet-report/state-of-the-internet-ipv6-adoption-visualization.jsp
- https://stats.labs.apnic.net
- https://www.internetsociety.org/deploy360/ipv6/statistics
- https://www.google.com/intl/en/ipv6/statistics.html
- https://www.facebook.com/ipv6/?tab=ipv6_country
- Tools
- Further info:
- https://go6.si/2010/08/suggestion-for-internet-search-engines-proposed-ipv6-impact-on-search-engine-scoring-algorithms
- https://www.ripe.net/publications/ipv6-info-centre/about-ipv6/decision-makers
- https://www.apnic.net/community/ipv6-program/ipv6-for-decision-makers
- Cloud providers are also not very advanced on this...
- Microsoft Azure has multiple requests to support IPv6 for the last 5+ years, but only around 2019-09 have they really started implementing IPv6. "General Availability" of IPv6 in Virtual Networks dates 2020-04-01 (not a joke! https://azure.microsoft.com/en-in/updates/ipv6-for-azure-virtual-network-is-now-generally-available-2/ ), but not services support it yet, especially serious when they have public IPs;
- https://feedback.azure.com/forums/217313-networking/suggestions/8399100-make-all-services-available-with-ipv6-addresses - Started being handled 4 years later;
- Microsoft Azure deployment in NL didn't meet requirements? (also for DNSSEC);
- DNSSEC
- https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en
- History: 1995 - 2005 (insecure). Slow gradual adoption for the next 10 years (?) mostly by TLDs. At present time, most TLDs except in Africa have DNSSEC ( https://www.internetsociety.org/deploy360/dnssec/maps/at ), but most providers don't yet sign the domains they host;
- Statistics
- Case studies:
- Microsoft has multiple requests to support DNSSEC since at least 2016, but haven't started yet ( https://feedback.azure.com/forums/217313-networking/suggestions/13284393-azure-dns-needs-dnssec-support )
- Microsoft Azure deployment in NL didn't meet requirements? (also for DNSSEC)
- NL registy has an incentives programme: https://www.sidn.nl/en/news-and-blogs/registrar-scorecard-yields-great-results
- Tools
- Further Links
- RPKI
- https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure
- Securing BGP with X.509 PKI certificates to prevent route hijacking (RFCs 6481 to 6495 date from 2012-02);
- Case studies:
- Tools:
- Further links:
- WCAG
- https://en.wikipedia.org/wiki/Web_Content_Accessibility_Guidelines
- WCAG 1.0 (1999) were made into LAW in some countries. In 2007 in Portugal, WCAG 1.0 became mandatory for any websites by public institutions (https://dre.pt/home/-/dre/642547/details/maximized ) and WCAG 2.0 became mandatory in 2012 (https://dre.pt/pesquisa/-/search/191863/details/maximized ). Still, not all public institutions enforced it, and a lot of website providers claiming the sites were WCAG accessible, while they were not;
- Mostly ignored by decision makers;
- Some governments legislated forcing WCAG for public sector. Maybe also for private sector?
- Tools
- Miscelaneous:
- SPF/DKIM/DMARC
- STARTTLS/DANE
- DoH/DoT have privacy and other issues
- Future (not now): https://www.huawei.com/en/industry-insights/innovation/new-ip
- Generic info
- RFC 5218 "What Makes for a Successful Protocol?"
- https://www.forumstandaardisatie.nl/sites/default/files/BFS/4-basisinformatie/publicaties/Ondersteunend/Handreiking_Governance_of_Open_Standards.pdf - A guide for CIO's on the the governance of standards