SIDN sponsors NLnet Labs for another five years

Research and operations partner

NLnet Labs acts as a research and operations partner for SIDN. Both organisations are engaged in research, including some joint projects. However, while SIDN Labs (SIDN's research division) focuses primarily on operations and deployment, NLnet Labs is more concerned with software development and standardisation. SIDN and NLnet Labs share a commitment to in-depth investment in innovation and new technologies that don't yield a direct financial return, but help to reinforce the security, stability and openness of the internet infrastructure. Examples include DNSSEC (now more than twenty years old) and RPKI (a relatively recent development). Another difference is that SIDN is a Dutch-centred organisation, even though the results of its research are universally available.

"Sponsorship is the best way for SIDN to contribute without affecting NLnet Labs' independence and unique character," says SIDN Operational Director Cees Toet, who represents SIDN in talks with NLnet Labs. "NLnet Labs is at the centre of a network of universities, internet technologies and organisations. For both SIDN and NLnet Labs, the openness, security and reliability of the internet's core are the main drivers. Nevertheless, it's better for the independence of NLnet Labs that we give them space. NLnet Labs is vital to the internet community, and we need to preserve the organisation's unique status."

Joint projects

While valuing their mutual independence, SIDN Labs and NLnet Labs do undertake joint projects, including deployment studies, measurements of the global Domain Name System (using the OpenINTEL platform) and research into future internet infrastructures (as part of the 2STiC project).

"Our organisations have important similarities, but also complementary, distinct characteristics," says Cristian Hesselman, Director of SIDN Labs and Chair of the NLnet Labs Board. "Both possess a wealth of knowledge about the internet's core systems. And both have a culture based on openness, sharing and flexibility, plus a flat organisational structure in which experts occupy centre stage. The specialists within the two organisations also know each other well."

"However, SIDN Labs focuses on the 'R' in R&D (measurement, design, prototyping, evaluation), whereas NLnet Labs is more about the 'D' (standardisation, product development, SLAs). So, for SIDN Labs, software development is a means of doing research (and subsequently transferring the software to SIDN's operations teams for production use), but for NLnet Labs software development is an end in its own right."

That difference in focus is reflected in the two organisations' contributions to two joint ICANN projects, for example. On the DNSSEC Deployment Metrics project [1, 2] SIDN Labs is the principal, while NLnet Labs is a partner. But, on the Technical Analysis of the Naming Scheme Used For Individual Root Servers project that's due to start soon, the relationship is reversed.

Self-sufficiency

SIDN's sponsorship of NLnet Labs began in 2012. After the NLnet Foundation lost its endowment in the financial crisis, NLnet Labs was forced to quickly find a way of fending for itself. SIDN stepped in with a five-year sponsorship package worth roughly €350,000 a year, or half of NLnet Labs' operating costs. The NLnet Foundation continued to cover the other half.

A concerted effort was also made to protect NLnet Labs' long-term continuity by putting the organisation on a sounder financial footing. The aim was to diversify the organisation's income sources, so that NLnet Labs wasn't permanently dependent on SIDN. In line with that goal, the second five-year sponsorship agreement provided for SIDN's support to be scaled back over the period 2017 to 2021, to its current level of €200,000 a year.

In those five years, NLnet Labs made significant progress towards financial diversification, securing project and service contracts with various industrial partners. The value of those contracts was sufficient to match the reduced support from the two main sponsors.

Sponsorship

Of the €220,000 a year that SIDN will continue providing to support NLnet Labs, roughly €125,000 will be in the form of sponsorship. That general contribution to the organisation's continuity will enable NLnet Labs to pursue DNS and routing technology innovations. It will pay for R&D projects that are directly relevant to the operational community, and for multi-year innovation programmes that do not yield a direct financial return but are vital for the security and stability of the internet five years from now. NLnet Labs' relevance as an R&D organisation depends on maintaining a lead role in such developments.

A further €60,000 of SIDN's annual input will take the form of funding for specific projects in which SIDN has a direct interest, more like a traditional service commission. The projects will involve specific improvements to OpenDNSSEC and CreDNS, for example. NLnet Labs will make the project output freely available to the wider community as open-source software. Each year, a set of projects will be identified for funding in the year ahead.

The budgets for the specified projects will be sufficiently generous to allow scope for extension and flexibility. Also, as part of the annual project selection process, any additional project funding or upscaling requirements will be considered (although additional resource allocations have never yet proved necessary).

The third and final component of SIDN's funding will take the form of an annual software support service fee. The support agreement between the two organisations will assure SIDN of proper support for the NLnet Labs software that SIDN uses.

Independence and diversification

NLnet Labs' transition to independent status has clearly been a success. Although under the new support agreement SIDN remains NLnet Labs' main sponsor, the organisation now has more than a dozen financial backers (all of whom use its software), plus several other partners that provide support in kind. The sponsor list includes familiar names such as Infoblox, Comcast, SURF, AWS, Mozilla, ISOC, DigitalOcean, Slack and GitHub.

NLnet Labs also has a growing portfolio of paying customers: organisations that have agreed maintenance and support contracts for the open-source software that they use. NLnet Labs now has thirty-plus SLAs in place. Other services that the organisation provides include consultancy (e.g. migration advice), training and bespoke (open-source) software development.

Only a quarter of NLnet Labs' income is now accounted for by general grants. The rest consists of funding for specific projects and commercial service contracts arranged by the foundation's wholly owned subsidiary company.

Expanding scope of activity

As well as diversifying its income sources, NLnet Labs has made considerable strides in expanding its product and service portfolio. Having once focused exclusively on the DNS, the organisation is now also active in the field of internet routing. NLnet Labs currently employs fourteen software and research engineers plus two managers, divided equally between the two fields.

OpenDNSSEC is a good example of how a technical development can now be commercialised to contribute to NLnet Labs' financial independence. Over the last several years, SIDN has provided considerable support for development of the package, which SIDN itself uses for signing the .nl zone. Now that the software is a mature product used by various major commercial players, the delivery of associated services through the NLnet Foundation's subsidiary company is a natural move. The arrangement ensures that SIDN is not effectively supporting the provision of services to large commercial users of NLnet Labs' software.

Technical innovation: Rust

One example of NLnet Labs' technical innovations is the use of a relatively new programming language called Rust. Derived partly from C and C++ (the standard languages for systems programming), Rust's main benefits are memory safety and thread safety.

"Software for the internet infrastructure must be secure, robust and fast," says Benno Overeinder, Director of NLnet Labs. "Where those qualities are concerned, Rust is on a par with C/C++, the language that most of our existing packages are written in. In 2018, we began by using Rust for a low-risk project to see what the language had to offer. Since then, a number of our libraries have been written in Rust, as have the RPKI applications Krill and Routinator, both of which serve as building blocks for securing the internet's routing system. For DNS, we now have the domain library: a library of DNS primitives that we're developing into a complete toolbox."

"It would be good if we could ultimately offer a name server and a resolver in Rust as well. However, it'll take some years of development before the software is mature and enjoys the same kind of reputation as our other products. The software has to prove itself before being put to large-scale use in the internet's critical core infrastructure."

Seen and recognised

According to Hesselman, there are also non-technical reasons for using Rust. "Attracting talent is a significant challenge in the current climate," he observes. "One talent supply line that NLnet Labs has tapped into is the flow of students from the University of Amsterdam (UvA), whose Faculty of Science is one of NLnet Labs' neighbours on Amsterdam Science Park. And those students are now learning to use Rust, not C/C++."

Being seen and recognised is one of the benefits of Hesselman's work at the University of Twente as well. "I teach Masters students at the university, so I get approached about final study projects. Various SIDN Labs team members have joined us via that route or other network pathways. However, now that there's a lot more home-based remote working, I'm pleased to say that it's become easier to get people from outside the region who have a passion for the internet interested in working for us. That's particularly important for an organisation like SIDN (Labs), which is based in Arnhem, not one of the country's biggest cities."