[kictanet] Kenya IGF 2010, Discussions :Day 4 of 8 Theme : Critical Internet Resources

[Michuki Mwangi]

Hi Judy, et al,

McTim wrote:
>> 1)  DNSSEC
>>
>> Definition:  introduces security at the infrastructure level through a
>> hierarchy of cryptographic signatures attached to the DNS records.  

DNSSEC is Security Extensions of the DNS system (DNS protocol). Am not
particularly in favor of using the terms infrastructure level since
being a techie it means at layer 2.


>> The stability, reliability and security of DNS data is paramount to any Top
>> level domain (TLD)
>>
>> In non- technical terms, what is in it for Kenya? why should we discuss it?
> 
> There is nothing in it for Kenya that does not hold true for Internet
> users from other nations. I really don't understand why we try to use
> a nation state POV in Internet Governance, it is not at all helpful
> IMHO.
> 
> We should discuss it to make folk aware that it is there if they
> should choose to use it, but also to make them aware that if it is not
> implemented, then we are just using the current "vanilla" DNS.  Some
> have thought that if the root zone is signed AND we do NOT implement
> DNSSEC, then we will be "offline".
>

With a significant push for online services mainly banks and e-Govt, i
would want to believe that the recent phishing scams experienced by some
 of the local banks would be sufficient enough for this to be considered.

Well if you may, let me indulge you with my personal experience with my
bank regarding online transactions.

My bank approached me with a new service called email authorization.
Which means that i can send an email to authorize transactions from my
account. Well as exciting as this may sound, i asked how would they be
in a position to validate that am the sender. At that point the bank had
no way to do so.

All the same, i went ahead and said, i have a PGP key, would you be
willing to exchange keys with me so that you have a way of validating
that am the sender i.e encrypt my messages or digitally sign them for
security purposes. At that point it was clear that such a feature did
not exist.

I have to give credit to my bank for taking the bold step of introducing
such a service. I would however have been even more glad if they
supported digital email signatures or PGP for email authorizations. But
then again, how many people actually use this?.

>> 2)      IPV6 –
>>
>>
>> a)      Regulatory-
>>
>> Last year, there was a suggestion that KEBS or KRA should ensure that no
>> hardware or software should be allowed into the country that is not IPV6
>> compliant.
>>
>> Any updates on that? Who should be in-charge?
> 
> I am of the opinion that if a person or org wants to live in a v4
> world, then a nation state sholdn't preclude them from doing that.
> Having said that, I think it would be useful to point out that most
> (if not all) kit imported (new and used) is either v6 ready or with a
> few software changes, can be made v6 ready.
>

My concerns is if a majority is buying from ISP lists (used hardware)
the upgrade path to V6 is non-existent for some (because the are end of
life products) or far too expensive to make a business case.


>> b)      How prepared are we (Kenya) any statistics?
> 
> 
> I challenge all listers to ask for native v6 service from their provider.
>
> Milestone:
> 
> When everyone on this list has turned on Ipv6 on their Windows
> machines AND gotten a (free) IPv6 tunnel from a tunnel broker service,
> that will be a real Milestone.  I did both of those things ~7 years
> ago.  It's really not rocket science.
> 
>

Maybe its a high time we changed the perception here. All users want is
the "Internet" v4 or v6 thats not for them to care about. All i want is
my internet to work period. If you think about it a significant number
of us have one time or another used a USB Dongle for IP connectivity.
This service often assigns IPs dynamically hence a significant
percentage of subscribers will not have the interest to change the IP's
if the "internet is working". Unless they are technically inclined and
know what they need to do (read awareness).

As such, making the providers understand the pros and cons of early
adoption would be IMHO a more significant approach. The following are
some of my opinions as to why early adoption maybe valuable to service
providers.

1) Gain operational experience. - There's limited operational experience
in the v6 world. As such the earlier you can get involved with it the
better. This recent event titled Google IPv6 Implementors conference
shed some light on what the early implementors experiences -
http://sites.google.com/site/ipv6implementors/2010/agenda


2) With IPv6 resources currently free to all AfriNIC members, it
probably worth acquiring the resources now to build that operational
experience. There's a growing amount of content available on IPv6 and
going forward building transition mechanisms (IPv4 to access IPv6 only
content) will be adding significant costs and complexities on the
network than having native IPv6 running. As such a phased adoption
strategy/plan is more financially friendly than one thats driven by
demand - as things cost alot more then.

my 2 cents.

Michuki.