Subject: Re: A report on certain standards (was Re: United Nations report on Internet standards)

From: Wout de Natris <[email-masked]>
Date: Fri, 20 Mar 2020 10:57:31 +0000

Dear all,

Thank you for discussing the report in your community. As main author of the report. There are three things I would like to stress:

1) This is not a U.N. commissioned report, but a pilot within the Internet Governance Forum to test whether the IGF is able to accelerate a long lasting internet governance issue instead of debating it once a year and go home. To go beyond the "talkshop", a long held wish of representatives from the Dutch technical community. The topic of choice became deployment of internet standards: e.g. DNSSEC, RPKI and BCP38, but also the OWASP top 10, ISO 27001 and secure software;
2) The report does not focus on nor passes any judgement on IETF's or on any other standards bodies' internal procedures. It focuses on how to disseminate the outcomes better, spread knowledge in an understandable language for non-technicians and to deploy the widely agreed upon standards faster. The comments made about the IETF were made by individuals participating in IETF processes, thinking out loud about how the goal of the report could be achieved;
3) The recommendations and steps forward are aggregated opinions from the hundreds of people that took the questionnaire, participated in the break out sessions at the Berlin IGF, from interviews and desk research. From them the authors compiled what we called "pressure points".

Nearly 100% of participants, from all stakeholder communities, agreed that creating a law is not the answer to fast deployment. So we looked at alternatives and identified what we called pressure points in society where those that decide on deployment, usually senior management and higher, can be influenced and put under pressure to start deploying. We identified 25 such points, ranging from consumer product testing, to involving trade organisations, and parliamentarians asking questions in hearings, to research in media on the lack of deployment, and CISO management-handling training.

Others involve people with knowledge, i.e. your community, to assist in translating new standards into layman's speech and in dissemination to non-technical communities. To focus not only on the technicians that have to deploy physically, but on those who can influence decisions to deploy and those deciding on the financial and resource wherewithal to deploy. Many participants, including IETF active, agreed that steps outside of the technical realm are necessary for these standards -and not only the IETF ones as you could see- to be deployed in a serious way, making all internet users more secure immediately and indiscriminately. Ideally without primarily government involvement.

As authors we welcome your opinion, questions and suggestions. The plan is to take this one step further, to start getting messages out, attract missing stakeholders and work together towards solutions and agreed upon steps forward. And indeed, as someone mentioned, as one community. That is the goal. Therefore the next step must be to bring all involved on the same page, like you are for decades already within IETF.

Yours sincerely,

Wout de Natris

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
De Natris Consult

Kamerlingh Onnesstraat 43                                                        Tel: +31 648388813

2014 EK Haarlem                                                                          Skype: wout.de.natris

[email-masked]<mailto:[email-masked]>

http://www.denatrisconsult.nl

Blog http://woutdenatris.wordpress.com

---

From: "S. Moonesamy" <[email-masked]>
Date: Fri, 20 Mar 2020 21:45:29 -0700

Dear Mr de Natris,
At 03:57 AM 20-03-2020, Wout de Natris wrote:
>Thank you for discussing the report in your community. As main 
>author of the report. There are three things I would like to stress:
>
>1) This is not a U.N. commissioned report, but a pilot within the 
>Internet Governance Forum to test whether the IGF is able to 
>accelerate a long lasting internet governance issue instead of 
>debating it once a year and go home.. To go beyond the "talkshop", a 
>long held wish of representatives from the Dutch technical 
>community. The topic of choice became deployment of internet 
>standards: e.g. DNSSEC, RPKI and BCP38, but also the OWASP top 10, 
>ISO 27001 and secure software;
>2) The report does not focus on nor passes any judgement on IETF's 
>or on any other standards bodies' internal procedures. It focuses on 
>how to disseminate the outcomes better, spread knowledge in an 
>understandable language for non-technicians and to deploy the widely 
>agreed upon standards faster. The comments made about the IETF were 
>made by individuals participating in IETF processes, thinking out 
>loud about how the goal of the report could be achieved;
>3) The recommendations and steps forward are aggregated opinions 
>from the hundreds of people that took the questionnaire, 
>participated in the break out sessions at the Berlin IGF, from 
>interviews and desk research. From them the authors compiled what we 
>called "pressure points".

Thank you for explanation about the report.  It is positive to see 
that the Dutch technical community is interested in taking matters 
beyond what is described as a "talkshop".  In my opinion, having a 
discussion venue where entities can openly explain the issues which 
they encountered has some value.  I had a few cordial discussions 
with parliamentarians during the Berlin Internet Governance Forum.

One of the issues which may affect deployment is how to get the 
agreement of entities, which are known as "network operators", to do 
something.  Another issue is the lack of evidence of the 
effectiveness of existing policies related to standards.

I was intrigued by the suggestion about a policy incubator.  Would 
that be a departure from the unique multistakeholder platform?

Regards,
S. Moonesamy

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 27 Mar 2020 09:10:20 +0100

On Fri, Mar 20, 2020 at 10:57:31AM +0000,
 Wout de Natris <[email-masked]> wrote 
 a message of 238 lines which said:

> The topic of choice became deployment of internet standards:
> e.g. DNSSEC, RPKI and BCP38, but also the OWASP top 10, ISO 27001
> and secure software;

Yes, the choice of ISO 27001 is strange. It is not an "Internet
standard" in any way, and it is just a set of bureaucratic rules,
without relationship with actual security.

> Others involve people with knowledge, i.e. your community, to assist
> in translating new standards into layman's speech and in
> dissemination to non-technical communities.

Many IETF participants already do it. The report contains zero idea on
how to do it better or more broadly. (The fact that the report does
not mention that outreach must be done in the local language is a
weakness.)

But the report has other weaknesses:

* there are several unsubstantiated claims such as "some standards,
e.g. DNSSEC, may not have been thought through sufficiently". But
there is no detail: which problems do you see with DNSSEC? How to
improve it? IETF would like to create a 4033-bis with problems fixed.

* the report uses the very common narrative "The protocols or internet
standards, in other words were created without security in mind. At
best it was considered, after which it was decided security would not
be a priority. All the standards that are discussed here can in a way
be seen as digital band aids, fixing what only in hindsight was
flawed." I suggest that you read RFC 5218 for a good criticism of the
cliché "protocole should be designed with security in mind". Even now,
with the knowledge we have, designing secure systems is hard.

* the report keeps to the very outdated claim that there are two sort
of standards, official ones and the others. It even pretends that ISO
is more "official". That's not true. Except for the rare cases where a
law mandates such or such standard (which is not the case of ISO
27001, at least in my country), whether a standard is issued by IETF,
W3C, ISO or whatever, it is a standard, period.

* the report contains several criticisms without any
counter-arguments. For instance, "None of these organisations [the
RIRs] have tools to retract these resources when abused or otherwise
used in wrong ways."  The report seems to ignore that it would be
pointless: a RIR can withdraw an allocation, it will still be used,
and impossible to re-allocate. (RPKI may change that.)

* another example where the report is technically questionable is when
it says "create a new internet. Work on this solution is actually
being carried out and published on". (Which is substantiated by a
reference to the Cerre report which, itself, mentions RINA and SCION,
which says a lot about its credibility.)

> To focus not only on the technicians that have to deploy physically,
> but on those who can influence decisions to deploy and those
> deciding on the financial and resource wherewithal to deploy. Many
> participants, including IETF active, agreed that steps outside of
> the technical realm are necessary for these standards -and not only
> the IETF ones as you could see- to be deployed in a serious way,
> making all internet users more secure immediately and
> indiscriminately. Ideally without primarily government involvement.

The report is also problematic in what it does not mention. It is
silent about political disagreements. If encryption took so long to be
deployed, it was not because of technical issues but because several
important stakehoders activery resisted, because they want to ability
do conduct surveillance. No amount of outreach will make people adopt
a technical standard which goes against their interests. The tussle is
unavoidable.