I like that idea. Lets try and gather some info before Helsinki and see if this is something we need to put time into and where our time is best spent.
-jg
On 27/05/2016, 13:55, "Niels ten Oever" <[log in to unmask]> wrote:
>Perhaps we can reach out to Michele and see where this is on their
>agenda? Shall I do so? Do other people share this concern?
>
>Cheers,
>
>Niels
>
>On 05/27/2016 02:38 PM, James Gannon wrote:
>> Agreed, so do I see you volunteering to lead this effort? =)
>> Happy to assist/help out where I can!
>>
>> -JG
>>
>>
>>
>> On 27/05/2016, 12:46, "NCSG-Discuss on behalf of Niels ten Oever" <[log in to unmask] on behalf of [log in to unmask]> wrote:
>>
>>> Hi Rafik,
>>>
>>> The DNSSEC for Everybody is great and fun, but it's more a very rough
>>> 101. The DNSSEC workshop is also great, but it doesn't help you when you
>>> are behind a production terminal. Good documentation is needed. Or we
>>> need to find out better why adoption levels are so low.
>>>
>>> Is this something we can bring up?
>>>
>>> I think this is especially an issue for the NCSG because NGO's,
>>> activists and individual users will greatly benefit from increased
>>> trust, and more protection against DNS poisoining. With the enormous
>>> success of Let's Encrypt (1 milltion certs distributed, covering >2.5
>>> million domains) DNSSEC is the next logical step, and adoption is still
>>> _very_ low.
>>>
>>> Cheers,
>>>
>>> Niels
>>>
>>>
>>> On 05/27/2016 01:34 PM, Rafik Dammak wrote:
>>>> Hi Niels,
>>>>
>>>> ICANN organizes regularly for many years now in each ICANN meeting 2
>>>> DNSSec sessions related:
>>>>
>>>> * DNSSEC Workshop
>>>> * DNSSEC for Everybody: A Beginner's Guide
>>>>
>>>> there are also also DNSSec session during conferences like African
>>>> Internet Summit (https://internetsummitafrica.org/programme/agenda),
>>>> https://nsrc.org/workshops/2013/nsrc-ati-tn-dnssec/ or ICANN DNS forum
>>>> . my understanding is that ICANN tech team helped some ccTLD
>>>> operators http://dnssec-africa.org/
>>>>
>>>> I don't think there are specific activities toward registrars per se.
>>>>
>>>> Best,
>>>>
>>>> Rafik
>>>>
>>>> 2016-05-27 20:21 GMT+09:00 Niels ten Oever <[log in to unmask]
>>>> <mailto:[log in to unmask]>>:
>>>>
>>>> Hi James,
>>>>
>>>> On 05/26/2016 12:12 PM, James Gannon wrote:
>>>> > No sorry what are the specific issues, i.e. In understanding the KSK
>>>> > and ZSK keys, in documentation etc? Do DNS engineers at hosting
>>>> > companies really not understand it?
>>>> >
>>>> > Because there is a large amount of documentation out there for
>>>> > example on configuring DNSSEC in Bind and while yes deploying at
>>>> > scale is a risk that registrars would need to analysise and take an
>>>> > internal risk position on Im not sure I understand the ‘even the most
>>>> > experienced engineers don’t understand it’ part of the question.
>>>> >
>>>> > The rest I do for sure, adoption of DNSSEC is a big topic, but there
>>>> > is huge amount son work going on in both ICANN and ISOC supporting
>>>> > registrars who wish to move down that path in a stable and secure
>>>> > path. ISOC has documentation specifically targeting at registrars
>>>> > http://www.internetsociety.org/deploy360/resources/dnssec-registrars/
>>>> > I know the RrSG has done some work for ones that are involved in
>>>> > that, there is also Deplay360 from ISOC
>>>> > http://www.internetsociety.org/deploy360/dnssec/ and a lot of
>>>> > community support behind it from a technical perspective for those
>>>> > interested.
>>>> >
>>>>
>>>> Have been clicking through the ISOC site, but I cannot find a proper
>>>> how-to or documentation for an indepdendent registrar anywhere.
>>>>
>>>> I think we should push harder for DNSSEC adoption, and ICANN can and
>>>> should play a role in this imho, why would it be more of an ISOC task
>>>> than a ICANN task?
>>>>
>>>>
>>>> > My question would be what is the thing that needs to be done to
>>>> > promote adoption, and from what I have seen so far its usually risk
>>>> > aversion on the business side, and that’s not something that we can
>>>> > do much about from the ICANN side of things, something I feel ISOC
>>>> > should focus on more tho.
>>>>
>>>> Business aversion is also because it's hard, and thus will cost more
>>>> time. Also: more risk because it might break. This does not balance well
>>>> with the increased trust gained with DNSSEC. We can help tip this scale
>>>> by making implementation easier through good documentation, no? Looks
>>>> like an ICANN task par excellence to me!
>>>>
>>>> Cheers,
>>>>
>>>> Niels
>>>>
>>>>
>>>> >
>>>> > -J
>>>> >
>>>> >
>>>> >
>>>> >
>>>> > On 26/05/2016, 11:03, "Niels ten Oever"
>>>> <[log in to unmask] <mailto:[log in to unmask]>>
>>>> > wrote:
>>>> >
>>>> >> Do you mean you would like to hear names of registrars that are
>>>> >> not offering DNSSEC ? Am afraid it is the majority of the SME
>>>> >> registrars / hosting providers.
>>>> >>
>>>> >> Cheers,
>>>> >>
>>>> >> Niels
>>>> >>
>>>> >> On 05/26/2016 11:57 AM, James Gannon wrote:
>>>> >>> Have you got any specific examples?
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>> On 26/05/2016, 10:50, "NCSG-Discuss on behalf of Niels ten Oever"
>>>> >>> <[log in to unmask]
>>>> <mailto:[log in to unmask]> on behalf of
>>>> >>> [log in to unmask]
>>>> <mailto:[log in to unmask]>> wrote:
>>>> >>>
>>>> >>>> Hi all,
>>>> >>>>
>>>> >>>> I have been talking to several registrars (especially smaller
>>>> >>>> ones that provide a lot of support to NGOs), that do not
>>>> >>>> provide DNSSEC yet as part of their service.
>>>> >>>>
>>>> >>>> The story that I keep on hearing is that even the most
>>>> >>>> experienced engineers have issues with understanding the
>>>> >>>> configuration of the KSK and Zone signing keys and the key
>>>> >>>> rollover, inconsistencies in documentation and therefore lack
>>>> >>>> of adoption, because in case of a mistake this might seriously
>>>> >>>> impact the production environment.
>>>> >>>>
>>>> >>>> I think the adoption of DNSSEC is an issue we should care about
>>>> >>>> because it has the potential to radically increase trust in the
>>>> >>>> DNS system.
>>>> >>>>
>>>> >>>> Is this an issue you all recognize, and do you know how / if
>>>> >>>> ICANN makes (or can make) this easier?
>>>> >>>>
>>>> >>>> Best,
>>>> >>>>
>>>> >>>> Niels
>>>> >>>>
>>>> >>>>
>>>> >>>> -- Niels ten Oever Head of Digital
>>>> >>>>
>>>> >>>> Article 19 www.article19.org <http://www.article19.org>
>>>> >>>>
>>>> >>>> PGP fingerprint 8D9F C567 BEE4 A431 56C4 678B 08B5 A0F2 636D
>>>> >>>> 68E9
>>>> >>>>
>>>> >>
>>>> >> -- Niels ten Oever Head of Digital
>>>> >>
>>>> >> Article 19 www.article19.org <http://www.article19.org>
>>>> >>
>>>> >> PGP fingerprint 8D9F C567 BEE4 A431 56C4 678B 08B5 A0F2 636D
>>>> >> 68E9
>>>>
>>>> --
>>>> Niels ten Oever
>>>> Head of Digital
>>>>
>>>> Article 19
>>>> www.article19.org <http://www.article19.org>
>>>>
>>>> PGP fingerprint 8D9F C567 BEE4 A431 56C4
>>>> 678B 08B5 A0F2 636D 68E9
>>>>
>>>>
>>>
>>> --
>>> Niels ten Oever
>>> Head of Digital
>>>
>>> Article 19
>>> www.article19.org
>>>
>>> PGP fingerprint 8D9F C567 BEE4 A431 56C4
>>> 678B 08B5 A0F2 636D 68E9
>
>--
>Niels ten Oever
>Head of Digital
>
>Article 19
>www.article19.org
>
>PGP fingerprint 8D9F C567 BEE4 A431 56C4
> 678B 08B5 A0F2 636D 68E9
|
