Subject: [Newsclips] IETF SYN-ACK Newspack 2020-09-28

From: "David Goldstein" <[email-masked]>
Date: Mon, 28 Sep 2020 22:23:43 +1000

Dear IETF-ers,

Below is the latest IETF SYN-ACK Newspack. There’s been some good feedback – some has been implemented, some is being considered. One issue raised was the size of the font, which one has commented was too small. So today font size has gone from 9 to 11. The idea of the smaller font was to try and condense the length of the email, but of course, if the content can’t be read, that’s not much point. And we’re aware some people prefer plain text over what is below. The bolding of headings is intended to make it easier to read and for headings to stand out. “TLS” news is now in the “security and privacy” section too.

Please keep the suggestions coming. What one person raises is likely something that others are thinking. If we change something, it can be changed again! On the content, if people are aware of items or topics that relate to the IETF and should be included but aren’t, please let Greg and I know. But note, the news is meant to be content that is freely available, that is, without subscription.

Kind regards,

David

**********************

IETF IN THE NEWS

**********************

“New IP” and Global Internet Governance: Do we need a new generation of data communication protocols?

The Internet protocols were standardized in the early 1980s, roughly the same time as the first PCs and the first generation of analogue mobile phones. Although there have been many changes and improvements in IETF standards since then, the original IPv4 is still the world’s predominant data communication standard. TCP/IP was an extraordinary success at creating a scalable and globally interoperable data communications; so much so, that even its designated successor, IPv6, has struggled to replace it.

< <https://www.internetsociety.org/events/new-ip-and-global-internet-governance/> https://www.internetsociety.org/events/new-ip-and-global-internet-governance/>

Scaling the Root of the DNS by Geoff Huston

The DNS is a remarkably simple system. You send it queries and you get back answers. Within the system you see exactly the same simplicity: The DNS resolver that receives your query may not know the answer, so it, in turn, will send queries deeper into the system and collects the answers. The query and response process is the same, applied recursively. Simple. ... This approach has its drawbacks at the moment. It's clumsy to use. How do you know that the zone you are serving is the current genuine root zone? Yes, the zone is signed, but not every element in the zone is signed (NS records, for example), and the client is left with the task of performing validation of every digital signature in the zone, and at present, there are some 1,376 of them. Until the root zone is signed in its entirety (a proposal that is currently still a draft in the IETF process:

< <https://www.potaroo.net/ispcol/2020-09/root.html> https://www.potaroo.net/ispcol/2020-09/root.html>

< <http://www.circleid.com/posts/20200926-scaling-the-root-of-the-dns/> http://www.circleid.com/posts/20200926-scaling-the-root-of-the-dns/>

When Is World Standards Day

World Standards Day, also known as International Standards Day, is celebrated on October 14 each year. The day is marked to celebrate the contributions of experts and scientists across the world in developing voluntary standards within standards development organisation such as the International Organisation for Standards (ISO), International Electrotechnical Commission (IEC), American Society of Mechanical Engineers (ASME), International Telecommunication Union (ITU), Institute of Electrical and Electronics Engineers (IEEE), and Internet Engineering Task Force (IETF). The purpose of the day is to raise awareness about the importance of standardisation to the global economy among the consumers, regulators and industry.

< <https://www.business-standard.com/about/when-is-world-standards-day> https://www.business-standard.com/about/when-is-world-standards-day>

World Standards Day 2020: Protecting the planet with standards

Earth, a finite vessel of life in the vastness of our solar system. Life on earth depends on energy coming from the sun. However, over the last century human and large-scale industrial activities of our modern civilization have added to earth’s natural greenhouse gases. They negatively impact our climate and with it all forms of life. At the same time rapid population growth and broad urbanization call for the responsible use of limited resources. To reduce human impact on our planet, we need the political will, concrete action and the right tools. International standards are one such tool. The international standards prepared by IEC, ISO and ITU take into account tried and true solutions to technical challenges.

< <https://www.worldstandardscooperation.org/world-standards-day/world-standards-day-2020/> https://www.worldstandardscooperation.org/world-standards-day/world-standards-day-2020/>

How open-source software transformed the business world

... But, they're also trying to solve similar problems. By the 2000s, it was becoming crystal clear that the old client-server models would not be up to the challenge of hundreds of millions of mobile phone users constantly on the move. By 2004, the first work towards what would become Software-Defined Networking (SDN) would be underway with the IETF Request for Comment (RFC) 3746 Forwarding and Control Element Separation (ForCES) Framework.

< <https://www.zdnet.com/article/how-open-source-software-transformed-the-business-world/> https://www.zdnet.com/article/how-open-source-software-transformed-the-business-world/>

We Can’t Let The Open Web Become A ‘Tragedy Of The Commons’

... We need more disciplines to be involved, a view shared by Mark Nottingham, co-chair of the IETF and QUIC Working Groups and a member of the Internet Architecture Board. In a recent blog post exploring why IETF decisions should favor internet end users in conflicts between the interests of end users and other parties, Nottingham says that the internet’s challenges require input from policymakers, civil society, citizens, businesses and technologists.

< <https://www.adexchanger.com/data-driven-thinking/we-cant-let-the-open-web-become-a-tragedy-of-the-commons/> https://www.adexchanger.com/data-driven-thinking/we-cant-let-the-open-web-become-a-tragedy-of-the-commons/>

What is DNS Security?

... When the IETF was put together three years later in 1986, the DNS became one of the very first Internet Standards. Its large-scale implementation made the Word Wide Web significantly more user-friendly and easier to navigate. ... The DNSSEC is the cornerstone of achieving DNS security. First released by the IETF in 1997, they came as supplementary specifications that help secure the DNS. DNSSEC ensures the confidentiality of your data online, which is something that the DNS did not previously handle on its own.

< <https://www.itproportal.com/features/what-is-dns-security/> https://www.itproportal.com/features/what-is-dns-security/>

« La surveillance est un mode du capitalisme » – Entretien avec Christophe Masutti ["Surveillance is a mode of capitalism" - Interview with Christophe Masutti]

... C.M. – Je ne vois pas seulement des alternatives, mais des choses qui sont déjà là depuis longtemps. Par exemple, l’Internet Engineering Task Force (IETF) qui élabore les standards d’Internet sur un mode participatif et ouvert (les RFC, requests for comments). Tant que cela existera, le web n’appartiendra pas seulement à des firmes. Il y a aussi le web fédératif en P2P (peer-to-peer), le fédiverse  : c’est le réseau de services de blogs, de partage d’images et de vidéos, d’organisation d’événements, etc. construits avec des logiciels libres et décentralisés. La normalisation de protocoles comme ActivityPub, un standard ouvert pour les réseaux sociaux décentralisés, contribue à ça sur un mode éminemment collectif.

< <https://lvsl.fr/aux-sources-du-capitalisme-de-surveillance-entretien-avec-christophe-masutti/> https://lvsl.fr/aux-sources-du-capitalisme-de-surveillance-entretien-avec-christophe-masutti/>

Минцифры хочет запретить передовые технологии шифрования [The ministry wants to ban advanced encryption technologies]

...  DNS поверх HTTPS (DoH) — протокол для выполнения разрешения DNS по протоколу HTTPS. Целью этого метода является повышение конфиденциальности и безопасности пользователей путём предотвращения перехвата и манипулирования данными DNS с помощью атак типа «Человек по середине». По состоянию на март 2018 года, Google и Mozilla Foundation тестируют версии DNS по протоколу HTTPS. Опубликован IETF в RFC 8484 в октябре 2018 года.

< <https://www.securitylab.ru/news/512312.php> https://www.securitylab.ru/news/512312.php>

Спецификация HLS с низкой задержкой приближается к завершению [Low latency HLS specification nearing completion]

... У Пантоса уже более десяти лет существует спецификация IETF по HLS в виде проекта. Первая спецификация HLS, датированная 1 мая 2009 года, была разработана им и с тех пор ласково называлась «спецификацией Пантоса» как сокращение для рекомендаций HLS и передовых практик по доставке потоков HLS на Apple, Android и других телевизионных приставках.

< <http://broadcast.net.ua/ru/technologies-infrastructure/3135-spetsifikatsiya-hls-s-nizkoj-zaderzhkoj-priblizhaetsya-k-zaversheniyu> http://broadcast.net.ua/ru/technologies-infrastructure/3135-spetsifikatsiya-hls-s-nizkoj-zaderzhkoj-priblizhaetsya-k-zaversheniyu>

IPv6新技術聯合實驗室工作會議在南京召開 [IPv6 New Technology Joint Laboratory Working Conference was held in Nanjing]

... 聯合實驗室成立在一年的時間裏，取得了累累碩果。中國電信研究院IPv6技術專家，據實驗室總工解衝鋒博士介紹，截止目前，聯合實驗室已經牽頭提交國際IETF文稿3篇；制定並發布歐洲ETSI IPv6白皮書及IPv6安全報告；並在2019、2020連續發布《IPv6支持度白皮書》；提交專利6項；在2020年7月全球IPv6峰會上，共同發布《推進IPv6規模部署向純IPv6發展的聯合宣言》。

< <http://big5.xinhuanet.com/gate/big5/www.js.xinhuanet.com/2020-09/25/c_1126541399.htm> http://big5.xinhuanet.com/gate/big5/www.js.xinhuanet.com/2020-09/25/c_1126541399.htm>

TWNIC推動RPKI建置三部曲 杜絕BGP路由劫持威脅 [TWNIC pushed RPKI to build a trilogy to eliminate the threat of BGP routing hijacking]

... 對此，網際網路工程任務組(IETF)透過制定資源公鑰基礎建設(Resource Public Key Infrastructure；RPKI)標準來強化路由安全。而台灣經過2年推廣，目前超過98%的IPv4位址均已簽署RPKI ROA，在全球IPv4位址數量前百大國家中排名第一。

< <https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=13&id=0000594369_2SN2XMIG7SOP7U8J5ZEE4> https://www.digitimes.com.tw/iot/article.asp?cat=130&cat1=40&cat2=13&id=0000594369_2SN2XMIG7SOP7U8J5ZEE4>

TWNIC推動RPKI 2週年 協助46家業者啟動來源驗證 [TWNIC promotes the 2nd anniversary of RPKI and assists 46 companies to start source verification]

（台北訊）今年4月發生一起包含Google、Amazon、Cloudflare、Go Daddy、Line等在內全球200家內容傳遞網路（Content Distribution Network，CDN）業者遭BGP劫持事件，原本該流向其網站的流量被導向俄羅斯。為了杜絕BGP劫持事件，網際網路工程任務組（IETF）透過制定資源公鑰基礎建設（Resource Public Key Infrastructure，RPKI）標準來強化路由安全。

< <https://times.hinet.net/news/23064542> https://times.hinet.net/news/23064542>

**********************

SECURITY & PRIVACY

**********************

SSL vs TLS: What's the Difference

Making websites more secure is no small task, but there are a whole host of technical experts and internet enthusiasts who have willingly accepted the burden. The development of protocol specifications by the Internet Engineering Task Force (IETF) continues unabated and IETF writers have left us a clear paper trail that lays out their thoughts on the subject.

< <https://www.cbtnuggets.com/blog/certifications/security/ssl-vs-tls-whats-the-difference/> https://www.cbtnuggets.com/blog/certifications/security/ssl-vs-tls-whats-the-difference/>

Have your say on Dynamic Coalition for Internet Standards, Security and Safety

A new Dynamic Coalition (DC) will be announced at the upcoming Internet Governance Forum (IGF 2020), which aims to create recommendations, work plans and actions to deploy Internet standards and ICT best practices in more rapid ways. We are calling on the community to fill in a five-minute survey to help us prioritize its work. We invite everyone to join this effort.

< <https://blog.apnic.net/2020/09/25/have-your-say-on-dynamic-coalition-for-internet-standards-security-and-safety/> https://blog.apnic.net/2020/09/25/have-your-say-on-dynamic-coalition-for-internet-standards-security-and-safety/>

eu: Cybersecurity in Healthcare: Online Conference Series to Address Sector’s Key Cyber Challenges

Tomorrow, the EU Agency for Cybersecurity (ENISA) and The Danish Health Data Authority will launch the 6th annual eHealth Security Conference: “Working together towards secure eHeath”. This year’s programme consists of a series of panel discussions about the major cyber challenges facing Europe’s healthcare sector. The series will span three months, with each month exploring a different cybersecurity topic of eHealth. The conferences will be in a virtual format.

< <https://www.enisa.europa.eu/news/enisa-news/cybersecurity-in-healthcare-online-conference-series-to-address-sector2019s-imminent-cyber-challenges> https://www.enisa.europa.eu/news/enisa-news/cybersecurity-in-healthcare-online-conference-series-to-address-sector2019s-imminent-cyber-challenges>

eu: Ninth ENISA-EC3 Workshop on CSIRTs-LE Cooperation: standing shoulder-to-shoulder to counter cybercrime

On 16 September 2020, the European Union Agency for Cybersecurity, ENISA and the European Cybercrime Center, EC3 organised the 9th annual workshop for CSIRTs – in particular national and governmental (n/g) CSIRTs – and their LE (law enforcement) counterparts.

< <https://www.enisa.europa.eu/news/enisa-news/ninth-enisa-ec3-workshop-on-csirt-le-cooperation-standing-shoulder-to-shoulder-to-counter-cybercrime> https://www.enisa.europa.eu/news/enisa-news/ninth-enisa-ec3-workshop-on-csirt-le-cooperation-standing-shoulder-to-shoulder-to-counter-cybercrime>

us: Cyber Threats to Voting Processes Could Slow But Not Prevent Voting

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are issuing this announcement to inform the public that attempts by cyber actors to compromise election infrastructure could slow but not prevent voting.

< <https://www.ic3.gov/media/2020/200924.aspx> https://www.ic3.gov/media/2020/200924.aspx>

us: Foreign Actors and Cybercriminals Likely to Spread Disinformation Regarding 2020 Election Results

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are issuing this announcement to raise awareness of the potential threat posed by attempts to spread disinformation regarding the results of the 2020 elections.

< <https://www.ic3.gov/media/2020/200922.aspx> https://www.ic3.gov/media/2020/200922.aspx>

White Paper on China’s Cybersecurity Industry (2020)

This white paper is the sixth time that China Academy of Information and Communications Technology has released the research results on China’s cybersecurity industry. In 2020, China Academy of Information and Communications Technology closely followed the development trends of the cybersecurity industry at home and abroad, focusing on the comprehensive status of the industry, analyzes the current situation of China’s industrial development in combination with hot events such as the COVID-19 epidemic, and makes an outlook on the future development of cybersecurity technology and industry.

< <http://www.caict.ac.cn/english/research/whitepapers/202009/t20200923_347292.html> http://www.caict.ac.cn/english/research/whitepapers/202009/t20200923_347292.html>

Protecting Computers and People From Viruses

The COVID-19 pandemic highlights the virus analogy that gave rise to the use of the word "virus" from biology, to label a malicious program that attacks computer systems. The situation moves us to look into that, as another way to compare nature and artifact, and as an excuse to raise more abstract questions.

< <https://cacm.acm.org/magazines/2020/10/247583-protecting-computers-and-people-from-viruses/fulltext> https://cacm.acm.org/magazines/2020/10/247583-protecting-computers-and-people-from-viruses/fulltext>

Report: German hospital cyberattack trail leads to Russia

IT experts investigating a cyberattack that paralyzed computer systems at a major hospital in western Germany say one of the trails they are following leads to Russia, German media reported Tuesday.

< <https://apnews.com/70c68ff7a21364c74e6bdcff55d7bde5> https://apnews.com/70c68ff7a21364c74e6bdcff55d7bde5>

4 Phishing Attacks Making Waves Targeting VPNs and Brokers

Threat actors have no want of creativity when it comes to phishing scams. They look for new lures, new subjects and new targets as a means of preying upon organizations and users.

< <https://securityintelligence.com/news/phishing-scams-throughout-vpns-brokers/> https://securityintelligence.com/news/phishing-scams-throughout-vpns-brokers/>

India's Cybercrime and APT Operations on the Rise

Growing geopolitical tensions with China in particular are fueling an increase in cyberattacks between the two nations, according to IntSights.

< <https://www.darkreading.com/threat-intelligence/indias-cybercrime-and-apt-operations-on-the-rise/d/d-id/1338999> https://www.darkreading.com/threat-intelligence/indias-cybercrime-and-apt-operations-on-the-rise/d/d-id/1338999>

**********************

INTERNET OF THINGS

**********************

uk: The ‘Internet of Things’ helping to provide key evidence in criminal trials

Digital devices like smart doorbells, dashcam footage, car GPS systems and even Amazon Alexas are providing increasingly more evidence in criminal trials, the Director of Public Prosecutions (DPP) said in a speech today. Addressing the Westminster Policy Forum this morning on the challenges of prosecuting crime in 2020, Max Hill QC spoke about how developments in digital technology are driving significant changes in the way evidence is collected and used in court.

< <https://www.cps.gov.uk/cps/news/internet-things-helping-provide-key-evidence-criminal-trials> https://www.cps.gov.uk/cps/news/internet-things-helping-provide-key-evidence-criminal-trials>

**********************

OTHERWISE NOTEWORTHY

**********************

On Digital Diplomacy By Vinton G. Cerf

The term digital diplomacy might have two interpretations. One is the conduct of diplomacy through digital means. The other is diplomacy concerning digital technologies. Both interpretations are addressed in this column. Interestingly, the term protocol in the computer communication sense was adopted from its use in diplomatic terms. Protocols are practices, procedures, and forms in the diplomatic world. In the world of computing, they are procedures and formats for information exchange.

< <https://cacm.acm.org/magazines/2020/10/247582-on-digital-diplomacy/fulltext> https://cacm.acm.org/magazines/2020/10/247582-on-digital-diplomacy/fulltext>

What Do Agile, Lean, and ITIL Mean to DevOps? by Stuart Galup, Ronald Dattero, Jing Quan

The metaphor of development teams throwing applications over a wall to the operations group for deployment is often used to vividly illustrate that development and operations operate as silos. The DevOps movement was started in 200817 to try and break down these barriers between the development and operations groups.

< <https://cacm.acm.org/magazines/2020/10/247595-what-do-agile-lean-and-itil-mean-to-devops/fulltext> https://cacm.acm.org/magazines/2020/10/247595-what-do-agile-lean-and-itil-mean-to-devops/fulltext>

Russia Is Trying Something New to Isolate Its Internet From the Rest of the World

Another component of internet-browsing is about to become criminal in Russia. On Sept. 21, Russia’s Ministry of Digital Development, Communications, and Mass Media (Minkomsvyaz) released a draft law that would criminalize the use of internet protocols that, in its words, encrypt a website name. The specific protocols the law is targeting are a jargony alphabet soup: TLS 1.3, ESNI, DNS over HTTPS (DoH), and DNS over TLS (DoT). But they’re important encryption techniques that are already, to varying degrees, deployed online, including in Russia.

< <https://slate.com/technology/2020/09/russia-internet-encryption-protocol-ban.html> https://slate.com/technology/2020/09/russia-internet-encryption-protocol-ban.html>

Internet Society: Russia’s Proposal Would Weaken the Internet, Make It Less Secure

Media reports that proposed Russian legislation would ban certain kinds of encrypted Internet connections are part of a worrying trend of banning new open security standards; standards which were developed to make the Internet more safe and secure. The proposed ban would prohibit the use of any encryption protocol that hides the name or identifier of a destination web page or site. This would affect connections such as HTTPS (web) connections using Transport Layer Security (TLS) version 1.3 that also use a setting called encrypted server name indication (ESNI), as well as protocols such as DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) – which encrypt DNS queries.

< <https://www.internetsociety.org/news/statements/2020/internet-society-russias-proposal-would-weaken-the-internet-make-it-less-secure/> https://www.internetsociety.org/news/statements/2020/internet-society-russias-proposal-would-weaken-the-internet-make-it-less-secure/>

Russia wants to ban the use of secure protocols such as TLS 1.3, DoH, DoT, ESNI

The Russian government is working on updating its technology laws so it can ban the use of modern internet protocols that can hinder its surveillance and censorship capabilities. According to a copy of the proposed law amendments and an explanatory note, the ban targets internet protocols and technologies such as TLS 1.3, DoH, DoT, and ESNI.

< <https://www.zdnet.com/article/russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh-dot-esni/> https://www.zdnet.com/article/russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh-dot-esni/>

87 percent of websites are tracking you. This new tool will let you run a creepiness check.

How bad has privacy become on the World Wide Web? Really bad, a new audit shows. At least 87 percent of the world’s most-popular Web domains engage in some form of digital tracking without you ever signing in, according to investigative journalism nonprofit the Markup. Many, it found, even covertly record the way you move your mouse or type. This is the hidden tech that lets companies learn who you are, what you like and even the secrets you look at online so they can tailor what you see, make ads follow you around — or even sell your information to others.

< <https://www.washingtonpost.com/technology/2020/09/25/privacy-check-blacklight/> https://www.washingtonpost.com/technology/2020/09/25/privacy-check-blacklight/>

The old telly that brought down a Welsh village's broadband

For 18 months, at precisely 7am every day, the broadband signal in the tiny Welsh village of Aberhosan simply vanished. ... The resident, who has asked not to be identified, turned his secondhand television on each day at 7am. It created a burst of “electrical noise” that brought down the neighbourhood’s broadband.

< <https://www.theguardian.com/uk-news/2020/sep/22/the-old-telly-that-brought-down-a-welsh-villages-broadband> https://www.theguardian.com/uk-news/2020/sep/22/the-old-telly-that-brought-down-a-welsh-villages-broadband>

Research Report on Industry SLA Requirements for E2E 5G Network Slicing

Network slicing is one of the most promising and powerful 5G technologies, capable of addressing the diversifying service needs of enormous industries and fast tracking the digital transformation of society in general.

< <http://www.caict.ac.cn/english/research/whitepapers/202009/t20200923_347294.html> http://www.caict.ac.cn/english/research/whitepapers/202009/t20200923_347294.html>

------

David Goldstein

email:  <mailto:[email-masked]> [email-masked]

web:  <http://goldsteinreport.com/> http://goldsteinreport.com/

Twitter:  <https://twitter.com/goldsteinreport> https://twitter.com/goldsteinreport

phone: +61 418 228 605 - mobile; +61 2 9663 3430 - office/home