Subject: [perpass] Steer 750 million euro at the EC for 'future internet' the right way

From: Michiel Leenaars <[email-masked]>
Date: Fri, 8 Apr 2016 16:18:22 +0200

Hi all,

I just wanted to flag this very interesting opportunity to decide on the
fate of 750 million euro to be spent on the 'future of the internet',
which might be interested to the folks in perpass because this is such a
hard topic to get funding for. The source of this money is the European
Commission's Net Futures directorate which was established to pioneer
and coordinate research, innovation, and policy initiatives on what lies
beyond the current Internet architecture, software and services.

In its own words: it is now "updating its vision for the area,
identifying key technological challenges and research priorities, and
establishing a research and innovation agenda for the coming years". But
it doesn't mention the whole surveillance crisis which seems like
something that should be the number one priority.

The fact that they put up an open consultation is the opportunity to
change that lack of awareness. Any input can have a noticeable impact,
because (as astounding as it is) for that huge budget only a few dozen
responses are expected. Any response pointing to the need to invest in
fixing the broken parts of the internet and its accumulated technical
debt first, therefore makes a *real* difference.

I've written up some background at the NLnet foundation website:

            https://nlnet.nl/people/leenaars/ec

The deadline is April 10th, which is insanely fast. But then again,
responses need not be too long - a few lines will do as long as the
submission flags somewhere that there can be only one real priority,
which is to harden the internet and repair the fundamental design issues
of the core of the internet in the post-Snowden era.

Thanks for your help, and have a great weekend!

Best,
Michiel Leenaars

(and apologies I've you've already received mail through some other
channel, it is just such a unique opportunity that it touches many
different issues)

---

From: Harry Halpin <[email-masked]>
Date: Fri, 8 Apr 2016 11:35:33 -0400

FYI,

I'm speaking to the European Commission at their NetFutures conference
on this very subject in 2 weeks, where I will try to convince them to
focus on funding security, privacy, funding open-source, and working
with standards bodies such as the IETF. If you know any particular
efforts that need to be highlighted, just ping me and I'll highlight
them. Otherwise, I was going to focus on success stories of TLS 1.3,
CertTrans, OAuth, WebCrypto and future work like  Humans Rights Protocol
Consideration IRTF task force, CFRG + postquantum, and
WebAuth/FIDO/Token-Binding. Rather than say, attempting to invent a new
network stack ran by a proprietary company, which is what some in the EC
would due if left to its own devices.

  cheers,
      harry

On 04/08/2016 10:18 AM, Michiel Leenaars wrote:
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Watson Ladd <[email-masked]>
Date: Fri, 8 Apr 2016 09:34:05 -0700

On Fri, Apr 8, 2016 at 8:35 AM, Harry Halpin <[email-masked]> wrote:
> FYI,
>
> I'm speaking to the European Commission at their NetFutures conference on
> this very subject in 2 weeks, where I will try to convince them to focus on
> funding security, privacy, funding open-source, and working with standards
> bodies such as the IETF. If you know any particular efforts that need to be
> highlighted, just ping me and I'll highlight them. Otherwise, I was going to
> focus on success stories of TLS 1.3, CertTrans, OAuth, WebCrypto and future
> work like  Humans Rights Protocol Consideration IRTF task force, CFRG +
> postquantum, and WebAuth/FIDO/Token-Binding. Rather than say, attempting to
> invent a new network stack ran by a proprietary company, which is what some
> in the EC would due if left to its own devices.

I don't think any of these are "success stories", especially WebCrypto
(theoretically useless) and the CFRG (only success was in wasting 2
years of my life). $750 million to stop people writing in C would have
a much bigger impact. A fraction of that to build distributed systems
where all actions are tied to user identities, instead of the current
mishmash of technologies on the web which opens the door to all sorts
of attacks, would have a big impact.

There are fundamental architectural issues with Internet and Web
security that cannot be fixed, only patched around.

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Michiel Leenaars <[email-masked]>
Date: Fri, 8 Apr 2016 21:29:16 +0200

Hi Harry, Watson,

> security that cannot be fixed, only patched around.

I've spoken to the EC as well, in fact I was one of the ten invited
experts attending the closed workshop they organised some weeks ago.
Within the EC there does not seem to be much awareness let alone a
sense of great urgency in the way that the internet technical community
and in particular the people on this list feel it. None of their plans
mention surveillance, or Edward Snowden, or even the words security and
privacy.

And that is the reason why I'm informing people about this consultation
and the opportunity to get across how necessary a large investment is.
Without simple and unambiguous input from many people that we need to
free as much of this budget as possible to revisit every nook and cranny
of the design of the internet, the money will evaporate. It is the
bigger picture that is missing, and I agree with Watson that we should
not be happy with the breadcrumbs and the small wins - this 750 million
euro is exactly what is needed to address things properly. At the
standards side, at the open source side and at the practical deployment
side. Of course the NSA and its many counterparts have much much bigger
budgets, but if the EC money is used to empower the right  ideas from
the community we have a fighting chance.

We don't need to settle or even debate the technical course at this
moment, it is important now to get enough money allocated to solving the
problems of the real internet instead of surfing the hype curve with
huge projects that fail horribly. And step two is turning around the
processes at the EC, and making them compatible with the way the
internet operates - smaller, more agile, bottom up. These budgets have
been around for a long time, but I cannot name a single real success
story despite billions and billions put in - and to a large degree that
is the fault of working with a few very large consortia that suffer from
inbreeding.

To summarize: I don't think we should settle for 'patches' here and
there, we deserve a thoughtful and thorough sanitisation of the whole
architecture of the internet and of the web (issues like Rowhammer.js to
me are the beginning of the end of the Javascript era).

Anyway: hope many of you will respond. The questionnaire is here:

https://ec.europa.eu/eusurvey/runner/nextgen-internet

And I suggest to keep it simple - the more obscure and technical your
comments, the less likely it is to be included in the outcome. Simple
wording (the internet is broken, please fix it) might be the most
strategic option, although looking at the length of this mail alone I'm
afraid that it is very tempting to violate this principle.

Best,
Michiel Leenaars

---

From: Hugo Maxwell Connery <[email-masked]>
Date: Sun, 10 Apr 2016 10:43:13 +0000

Hi,

Thanks Michael.

I have uploaded a blurb with 4 sugestions, the summary of which is:

* distributed systems (e.g FreedomBox, Diaspora) and data sovereignty

* Free Software

* Cryptography and digital signatures (e.g OpenPGP) for identity management
and secure communications

* Education about anonymity preserving communications (e.g Tor)

I hope the rest of this community have provided the European Commission
with their thoughts on the topic at hand.

Regards,  Hugo Connery