Dear Colleagues, please find below my report below. Have a nice day! Best, Matthias Publications: SAC132: The Domain Name System Runs on Free and Open Source Software (FOSS): Overview * The Domain Name System (DNS) is critical infrastructure, mapping names to IP addresses for nearly all online activity. * Research confirms the DNS overwhelmingly relies on FOSS. * 9 of 12 root server operators use FOSS exclusively. * 9 of the 10 largest TLD providers use FOSS. * FOSS dominance comes from its economic efficiency, transparency, collaborative security, and resilience. * FOSS is not inherently more or less secure than proprietary software; outcomes depend on processes and maintenance. * However, the FOSS development model differs fundamentally from proprietary supply chains, raising unique risks. * Introduction * Policymakers are increasingly intervening in software security (UK voluntary code, US attestation, EU Cyber Resilience Act and NIS2, China's IT plan). * Risk: regulations designed for proprietary models may harm critical Internet infrastructure if applied to FOSS without adaptation. * Aim: provide context to policymakers to recognize FOSS's role and avoid destabilizing interventions. * DNS Primer * DNS = "address book of the Internet." * Functions: * Registration: registries manage the authoritative database of domain names. * Publication: authoritative servers publish DNS records. * Resolution: resolvers fetch IP addresses for users. * Structure: Root → TLDs → individual domains. * Resolvers answer ~90% of queries from cache; authoritative servers publish definitive records. * The FOSS Model: Characteristics and Implications * Key roles: * Maintainers: guide project direction. * Contributors: submit code/docs/bug fixes. * Operators: deploy and run software. * Four freedoms: use, study, share, change. * Unique characteristics: * Global collaborative development. * No contractual relationships. * Funding decoupled from use. * Often no single responsible legal entity. * Proprietary systems also depend on FOSS components. * Strengths: * Transparency & collaborative security . * Stability & long-term support by non-profits/companies. * Resilience via software diversity. * Enabler of innovation and digital autonomy. * Risks : * Financial sustainability & maintainer burnout. * Shared dependency risks. * No warranties or support guarantees. * Operational risks in deployment. * Prevalence of FOSS in DNS * Registration: Platforms like FRED, Nomulus, CoCCA widely used. Large registries use proprietary extensions but built atop FOSS. * Publication: Root and TLD servers overwhelmingly use FOSS. 9 of 12 root operators rely on FOSS. * Resolution: BIND, Unbound, Knot Resolver, CoreDNS common. ISPs, enterprises, and cloud resolvers widely deploy FOSS. * Contemporary Cases in FOSS Regulation * Policymakers are adapting rules to reflect FOSS realities. * Examples: * US 2023 Cybersecurity Strategy: exempts volunteer maintainers; responsibility on deployers. * UK 2025 Code of Practice: voluntary guidance. * EU CRA/NIS2: introduces "FOSS steward" role, avoids treating maintainers as suppliers, harmonizes obligations. * Policy lessons: * Allocate responsibility to those best able to act. * Incentivize cross-industry collaboration on maintenance. * Avoid supply chain assumptions based on proprietary models. * Avoid conflicting regional obligations. * Key Findings * FOSS is the foundation of DNS; proprietary is the exception. * FOSS model is fundamentally different from proprietary software supply chains. * FOSS is not inherently more/less secure; security depends on processes. * DNS FOSS strengths: transparency, collaborative security, diversity, long-term stability. * Risks: sustainability, burnout, shared dependencies -- not solvable by proprietary regulations. * Traditional liability is ill-suited: imposing burdens risks discouraging maintainers and harming infrastructure. * FOSS enables autonomy and innovation: lowers entry barriers, supports local industry, diversifies markets, reduces cloud dependence. * Actionable Guidelines for Policymakers * Acknowledge the Critical Role of FOSS * Explicitly recognize in law/regulation that critical infrastructure depends on FOSS; treat it as a strength to preserve. * Consult the FOSS Community * Engage maintainers, contributors, non-profits, and companies in policymaking. * Make Use of Contemporary Cases * Apply lessons: responsibility on deployers not maintainers, support FOSS steward models, avoid proprietary assumptions, prevent conflicting regional regimes. * Incentivize FOSS Sustainability * Promote public/private funding of critical FOSS projects as investments in shared goods. * Address Systemic Risks Collectively * Fund ecosystem-wide resilience (dependency tooling, research, security initiatives) instead of overburdening individuals. Conclusion The SSAC concludes: The DNS runs on FOSS, a global public good central to Internet stability. * Policymakers must avoid treating FOSS with proprietary assumptions. * Following the five guidelines -- acknowledge, consult, learn, incentivize, collaborate -- ensures security and sustainability of DNS and the Internet as a whole. Link to the report: https://itp.cdn.icann.org/en/files/security-and-stability-advisory-committee.... Ongoing work parties: * DNSSEC Operational Considerations Work Party * Responsible Integration of External Technologies into the DNS Upcoming Work Parties: * DNS Abuse and Artificial Intelligence * DNS Transparency SSAC Membership Applications: The Membership Selection Committee has completed its selection and voting process. The selected members will be introduced to the SSAC members, who will then be asked whether they have any objections.