<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-IE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Why would an “end user” care? Why would anyone want to make it more complicated and scary to get online? Surely this is an issue for industry and not the “end user”?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Most of the DNS abuse issues at the moment are due to providers not looking after their own networks / devices or acting on abuse reports.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">It’s not a coincidence that we end up having to block entire countries from our network on a regular basis<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">While the goal of Barrack’s proposal might be honourable I don’t think it’s particularly practical or realistic<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">To use an analogy.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">You can train someone to check the oil in their car, which in the DNS space could be akin to making sure that software was kept up to date<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">But pushing DNS abuse knowledge would be like expecting me to be able to strip my car down<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Michele<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">--<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Mr Michele Neylon<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Blacknight Solutions<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Hosting, Colocation & Domains<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">https://www.blacknight.com/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">https://blacknight.blog/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Intl. +353 (0) 59 9183072<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Direct Dial: +353 (0)59 9183090<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Personal blog: https://michele.blog/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Some thoughts: https://ceo.hosting/
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">-------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-GB" style="color:black">Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845</span><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Barrack Otieno <otieno.barrack@gmail.com><br>
<b>Reply to: </b>"africann@afrinic.net" <africann@afrinic.net><br>
<b>Date: </b>Friday 10 January 2020 at 14:21<br>
<b>To: </b>"el@lisse.NA" <el@lisse.NA><br>
<b>Cc: </b>Afri-Discuss <afri-discuss@atlarge-lists.icann.org>, "africann@afrinic.net" <africann@afrinic.net><br>
<b>Subject: </b>Re: [AfrICANN-discuss] [AFRI-Discuss] Call for topics: Joint AFRALO-AfrICANN meeting for ICANN67<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Good points Mark and El, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think the end user has been missing in the DNS Security conversation yet they are actually the ones who speak with their pockets, if i may use a Kenyan Proverb. An enlightened end user is an empowered end user. As we bring the next billion
users online cases of DNS abuse will definately increase. If governments feel that industry players have not control they will definately step in and thats what we are avoiding.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regards<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, 10 Jan 2020, 4:55 pm Dr Eberhard W Lisse, <<a href="mailto:el@lisse.na">el@lisse.na</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal">Gabdibé,<br>
<br>
drafting a resolution (beforehand), or even debating a resolution, is <br>
going to achieve absolutely nothing.<br>
<br>
Mark,<br>
<br>
50% lookups is actually almost worth than zero :-)-). <br>
<br>
And how many of those hit infrastructure actually in South Africa?<br>
Does the figure include the public ones from Google and Cloudflare?<br>
<br>
My view is that this only works All-or-Nothing, because noncompliant<br>
commercial resolver operators have a commercial advantage over<br>
complaint ones.<br>
<br>
Financial incentives may work as may financial or other sanctions.<br>
<br>
One could even make it part of the Accreditation that DNSSEC must be<br>
offered by the Registrars.<br>
<br>
But while the Registrars are usually the entities operating the DNS<br>
and as such have control over the end-user's DNS anyway, the chain<br>
of trust should go up to the end user and not just the Registrar.<br>
<br>
Talking to the banks has so far not been very effective, they are<br>
happy with HTTPS even though they forget to renew their certificate<br>
on a regular basis, never mind the expense.<br>
<br>
I don't have the answer either.<br>
<br>
If anyone has a technical "solution" or project going on, and is coming <br>
to Cancun, please feel free to propose a presentation at TechDay on the <br>
Monday.<br>
<br>
greetings, el<br>
<br>
On 10/01/2020 15:26, Mark Elkins wrote:<br>
> I also like the sound of Barrack's proposal. What exactly does "DNS<br>
> Abuse" mean though?<br>
> <br>
> If it is to try and get all important Domains DNSSEC Signed and for<br>
> all DNS Resolvers to become DNSSEC aware - that would be a winner in<br>
> my book!<br>
> <br>
> Incidentally - about 50% of all DNS lookups in South Africa are DNSSEC<br>
> aware. That's actually the easy bit. Just have the Internet<br>
> Connection suppliers enable DNSSEC on their resolvers.<br>
> <br>
> Getting the bulk or at least the important Domains DNSSEC Signed will<br>
> be a bit more challenging but is quite possible; e.g. any domain for a<br>
> website which may involve a financial transaction or deal with<br>
> personal information.<br>
> <br>
> On my Domain Registration and Hosting Platform, if I am running the<br>
> Registrants DNS (Zone file), DNSSEC is simply an option the Registrant<br>
> can switch on. I could change that and simply enable it for everyone.<br>
> However, if the Domain is then moved to a Registrar that does not<br>
> support DNSSEC - there would be issues for the new Registrar.<br>
> <br>
> On 2020/01/10 14:20, Gabdibé GAB-HINGONNE wrote:<br>
>> Dear All,<br>
>> I support Barrack's proposal.<br>
>> Building the capacity of African end users on the general question<br>
>> related to the DNS is very important.<br>
>> Kind regards<br>
>> Gabdibé<br>
>><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>