Vittorio Bertola

The European Union is working with great energy on new rules for digital markets, targetting first of all the big global Internet platforms. Building on the global impact of the GDPR, efforts like the Digital Services Act, the Digital Markets Act, the AI Regulation, the Data Governance Act and the GAIA-X initiative attempt to restrain the superpowers of the big American and Chinese companies and promote rights and opportunities for Europeans, restoring the EU's ability to control its own slice of the Internet and reducing the dependency on foreign products and services. Open source is one of the strategic tools for this objective, and open source projects and companies could be benefited by these changes. Watch the talk to learn what is happening!

The talk will start by recollecting how we started up with an open, interoperable Internet that allowed everyone to cooperate and deploy new content and services, and ended up with a concentration of money and power of unseen scale in the history of mankind. Technical and market developments are centralizing the Internet more and more into the hands of a few companies, very concentrated in terms of geography, jurisdiction, ownership and views of the world. We will discuss how the EU plans to counter these trends, what the various regulations and projects are, and how they would work.

We will then focus on how open source in Europe could be impacted by the new rules. Some of the provisions are particularly in line with an open, distributed Internet architecture, mandating the adoption of open standards and interoperability and preventing dominant players from advantaging their own applications and services over independent ones. Social media, instant messaging and mobile apps are three sectors that could be particularly affected.

In the end, the talk aims to create awareness in the European open source community around the changing regulatory scenario, so that we are ready for it.

Last year we introduced the reasons and the plans for the new Digital Markets Act of the European Union, regulating online markets to further more competition with the dominant gatekeepers. In 2021, the act was discussed and finally voted by the European Parliament, which expanded many of its provisions and strengthened the new rules. In 2022, the act will be negotiated again with member States and then, possibly, finally approved by the Parliament. In this update we will explain in details what has changed and where we are.

The Digital Markets Act introduces rules for "gatekeeper" digital companies, defining how to recognize them and setting obligations for them to fulfil. These obligations generally affect their business practices, such as the terms and conditions that they impose onto their business users and the consumers; the way they enter new markets and exploit their strength to conquer them; the opportunities that are left for users to choose competing services or move out of the walled gardens. Principles like unbundling and interoperability have been recognized as useful tools to promote competition.

It is still to be understood whether all these obligations will survive the negotiation phases and will be confirmed in the final act. However, discussions are also starting on how some of these new provisions may be implemented, and how to define the details and the technical standards. The talk will present the current situation and solicit feedback and comments from the community.

The Internet originally thrived on interoperable services - until the "walled gardens" came. The European Commission recently proposed new regulations (DSA/DMA/DGA) to protect democracy and restore openness and competition. The talk will introduce them and their economic and political background; it will then focus on a specific point, the requirement for dominant platforms to interoperate with third parties, though only in limited cases, using messaging and social media as example.

A few decades ago, the Internet was open, interoperable and based on federated services that allowed everyone to cooperate and deploy new content and services: email is the classic example. Then, consolidation happened: the talk will show a common European perspective of how we ended up with a concentration of money and power of unseen scale in the history of mankind, which perpetuates itself by adopting the "walled garden" service model. The best example of this model is instant messaging, where people have a hard time switching to different service providers as they need to be on a specific app to communicate with all the other users of the same app. This creates dominant positions that are often used to impose unfavourable terms and conditions onto users.

In the European political and regulatory scene, this has been increasingly perceived as a problem under many dimensions: tax revenue, privacy, national security, law enforcement, free speech, and even democracy. All these dimensions boiled down into a call for "digital sovereignty", meaning more autonomy and stronger reliance on EU-provided services that keep the wealth they produce local, but also more control and stronger capabilities to set and enforce European rules for the Internet in Europe, without having to negotiate them with the big American platforms.

Open source has been identified as a fitting software development model for Europe and increasingly supported. Open source development matches the "cooperation in diversity" that is required by the multinational, multicultural nature of the European Union, and naturally offers remedies to consolidation.

After quickly introducing the three regulatory proposals - the Digital Services Act, the Digital Markets Act and the Data Governance Act - the final part of the talk will focus on the DMA and on a specific topic: interoperability provisions. "Walled garden" instant messaging apps could be turned into open, federated email-style services by forcing dominant providers to open up and interoperate with potential competitors, so that users of one app could exchange messages with the users of all the other apps.

The current DMA proposal by the European Commission, however, only does this in part. The interoperability clause in Article 6.1(f) only covers ancillary services such as payments, advertising or identification, but not core services like messaging and social media; and only for business users. The "real time" data portability clause in Article 6.1(h) would not allow true interoperability and would still require users to hold an account on each service and accept its unilateral contractual terms.

The talk builds on the efforts of a coalition of open source software companies and digital rights NGOs that have been campaigning for full interoperability clauses in the DMA. It also builds on a technical policy paper that discusses the topic and that was submitted to the Commission during last summer's consultation. We hope to open up the debate, validate our ideas and build community discussion around this issue.

Online identities are the cornerstone on which data-based capitalism is built - so, Google, Facebook and other OTTs are trying to dominate them and close them into silos. The ID4me platform extends OpenID Connect to create an open and federated architecture that allows any number of providers to interoperate, and gives back control to users, and a role to community service providers.

This talk was promoted from a lightning talk because unfortunately the talk "P2P how and Kademlia" by Kishan Sagathiya has to be cancelled due to administrative issues. It is moved from 09:10 to 11:00 and becomes a 30 min lecture.

In the last years, the Internet has been increasingly centralized into the hands of GAFAM and other over-the-top companies that built walled gardens in fields like messaging and social networks. More and more of these companies have user data monetization and targeted advertising as a core revenue stream; thus, tracking people across their Internet activities is necessary to their existence.

This is why they have also built closed identity systems that supply single-sign-on and very easy sign up for new websites and services, at the expense of privacy and user control. As managing hundreds of separate accounts is inconvenient and insecure, and as alternatives such as password managers are not easy enough for the average Internet user, clicking on “sign in with Google” or “sign in with Facebook” has become a very common choice.

We think that this is bad for the Internet in general, and thus we are creating a platform that allows anyone to provide identities, creating an open, public and federated single-sign-on and data management system. We are extending OpenID Connect just a bit, the bit that is necessary to break the silos and allow interoperability; and we are basing the system on the DNS, the widely available and already federated naming directory of the Internet.

The talk will explain how the system works and encourage participation and contributions.

The DNS was born as a directory for hosts, but shouldn't it also be a directory for people? As Internet-scale single sign-on and identity management platforms multiply, each enclosed in its own private namespace, there is a need to federate them and make them interoperable in an open and standard manner. We will discuss why the DNS is the best tool for that, compare it with trendy but less suitable alternatives (e.g. blockchains), and summarize the workings and the status of existing projects (ID4me).

The talk starts by discussing why a standard identity layer for the Internet is necessary and how it could work. It then discusses the possible options to build a distributed and federated database of existing identities, which is necessary for any such layer to work; and shows why the DNS is the best option currently available, when compared to Web-based protocols (e.g. Webfinger) and to blockchains. The talk then presents the architecture of the ID4me project, an attempt to build an open and public standard for Internet single sign-on based on the DNS; since the project was already partially presented in last edition's DNS devroom but has accomplished several new steps, it then gives an update on its status.

An earlier version of this talk was already presented at the 2018 DNS Symposium organized by ICANN in Montreal last July (the slides from that talk are attached as a sample). This version will include an updated second part with some more details on the architecture and recent developments of the ID4me project.

Mozilla's announced deployment model for DNS-over-HTTPS made some properties of this protocol apparent to everyone, stirring a lot of discussion. Specifically, DoH could promote a collective switch from local resolvers to a few global public services, and make each application independent from the user's preferences in the operating system. This could provide more privacy and less censorship, or less privacy and more censorship, depending on how it is deployed and who gets to control the resolvers. What would be the advantages and disadvantages of a broad adoption of DoH by Web browsers, and its likely long-term effects?

The talk will start with a general introduction to DoH, stressing its main architectural features: hiding DNS queries inside Web traffic in an unblockable way, moving DNS resolution to the application layer, and putting application makers (especially browser makers) in charge for DNS settings.

It will then discuss all the things that are broken by mass-scale deployment of DoH under this paradigm, including DNS-based security mechanisms and access control services, local and national content filtering policies, and network monitoring tools. It will also discuss in which use cases DoH creates advantages for the user (i.e. more privacy and freedom of expression) and in which others it creates disadvantages (i.e. less privacy and more control). Finally, it will discuss the changes to the Internet's original principles that would derive from the centralization that DoH could induce, by providing an additional control point to a few of the usual big over-the-top companies from the GAFAM club.

We also look forward to a final discussion to listen to more opinions (including those that disagree with us) and allow participants to learn more about the issue and make up their mind - or, perhaps, end up with more questions than they had in the beginning.

PLEASE NOTE THAT THIS TALK HAS BEEN CANCELLED.

Online identities are the cornerstone on which data-based capitalism is built - so, Google, Facebook and other OTTs are trying to dominate them and close them into silos. The ID4me platform extends OpenID Connect to create an open and federated architecture that allows any number of providers to interoperate, and gives back control to users, and a role to community service providers.

In the last years, the Internet has been increasingly centralized into the hands of GAFAM and other over-the-top companies that built walled gardens in fields like messaging and social networks. More and more of these companies have user data monetization and targeted advertising as a core revenue stream; thus, tracking people across their Internet activities is necessary to their existence.

This is why they have also built closed identity systems that supply single-sign-on and very easy sign up for new websites and services, at the expense of privacy and user control. As managing hundreds of separate accounts is inconvenient and insecure, and as alternatives such as password managers are not easy enough for the average Internet user, clicking on “sign in with Google” or “sign in with Facebook” has become a very common choice.

We think that this is bad for the Internet in general, and thus we are creating a platform that allows anyone to provide identities, creating an open, public and federated single-sign-on and data management system. We are extending OpenID Connect just a bit, the bit that is necessary to break the silos and allow interoperability; and we are basing the system on the DNS, the widely available and already federated naming directory of the Internet.

The talk will explain how the system works and encourage participation and contributions.