Updating the list of public subnets

[DRE-Team]

Updating the list of authorized subnets to:

Subnet id	Subnet Type	Public	Description
2fq7c-slacv-26cgz-vzbx2-2jrcs-5edph-i5s2j-tck77-c3rlz-iobzx-mqe	Application	false	Subnet has more than 60000 canisters
3hhby-wmtmw-umt4t-7ieyg-bbiig-xiylg-sblrt-voxgt-bqckd-a75bf-rqe	Application	true ⇒ false	Subnet has more than 300 GiB state size
4ecnw-byqwz-dtgss-ua2mh-pfvs7-c3lct-gtf4e-hnu75-j7eek-iifqm-sqe	Application	true
4zbus-z2bmt-ilreg-xakz4-6tyre-hsqj4-slb4g-zjwqo-snjcc-iqphi-3qe	Verified Application	false ⇒ true
5kdm2-62fc6-fwnja-hutkz-ycsnm-4z33i-woh43-4cenu-ev7mi-gii6t-4ae	Verified Application	false	Subnet will be opened up soon
6pbhf-qzpdk-kuqbr-pklfa-5ehhf-jfjps-zsj6q-57nrl-kzhpd-mu7hc-vae	Application	true ⇒ false	Subnet has more than 300 GiB state size
bkfrj-6k62g-dycql-7h53p-atvkj-zg4to-gaogh-netha-ptybj-ntsgw-rqe	Application	false	Explicitly marked as non-public (European subnet)
brlsh-zidhj-3yy3e-6vqbz-7xnih-xeq2l-as5oc-g32c4-i5pdn-2wwof-oae	Application	true
csyj4-zmann-ys6ge-3kzi6-onexi-obayx-2fvak-zersm-euci4-6pslt-lae	Verified Application	false	Subnet will be opened up soon
cv73p-6v7zi-u67oy-7jc3h-qspsz-g5lrj-4fn7k-xrax3-thek2-sl46v-jae	Application	true
e66qm-3cydn-nkf4i-ml4rb-4ro6o-srm5s-x5hwq-hnprz-3meqp-s7vks-5qe	Application	true
ejbmu-grnam-gk6ol-6irwa-htwoj-7ihfl-goimw-hlnvh-abms4-47v2e-zqe	Verified Application	false	Subnet will be opened up soon
eq6en-6jqla-fbu5s-daskr-h6hx2-376n5-iqabl-qgrng-gfqmv-n3yjr-mqe	Verified Application	false	Subnet will be opened up soon
fuqsr-in2lc-zbcjj-ydmcw-pzq7h-4xm2z-pto4i-dcyee-5z4rz-x63ji-nae	Application	true
gmq5v-hbozq-uui6y-o55wc-ihop3-562wb-3qspg-nnijg-npqp5-he3cj-3ae	Application	true
io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe	Verified Application	false	Subnet will be opened up soon
jtdsg-3h6gi-hs7o5-z2soi-43w3z-soyl3-ajnp3-ekni5-sw553-5kw67-nqe	Application	true
k44fs-gm4pv-afozh-rs7zw-cg32n-u7xov-xqyx3-2pw5q-eucnu-cosd4-uqe	Application	false	Subnet has more than 300 GiB state size
lhg73-sax6z-2zank-6oer2-575lz-zgbxx-ptudx-5korm-fy7we-kh4hl-pqe	Application	false	Subnet has more than 300 GiB state size
lspz2-jx4pu-k3e7p-znm7j-q4yum-ork6e-6w4q6-pijwq-znehu-4jabe-kqe	Application	true
mpubz-g52jc-grhjo-5oze5-qcj74-sex34-omprz-ivnsm-qvvhr-rfzpv-vae	Application	true
nl6hn-ja4yw-wvmpy-3z2jx-ymc34-pisx3-3cp5z-3oj4a-qzzny-jbsv3-4qe	Application	true
o3ow2-2ipam-6fcjo-3j5vt-fzbge-2g7my-5fz2m-p4o2t-dwlc4-gt2q7-5ae	Application	true
opn46-zyspe-hhmyp-4zu6u-7sbrh-dok77-m7dch-im62f-vyimr-a3n2c-4ae	Application	true
pae4o-o6dxf-xki7q-ezclx-znyd6-fnk6w-vkv5z-5lfwh-xym2i-otrrw-fqe	Verified Application	false	Subnet will be opened up soon
pjljw-kztyl-46ud4-ofrj6-nzkhm-3n4nt-wi3jt-ypmav-ijqkt-gjf66-uae	Application	true
pzp6e-ekpqk-3c5x7-2h6so-njoeq-mt45d-h3h6c-q3mxf-vpeq5-fk5o7-yae	Application	false	Explicitly marked as non-public (Fiduciary subnet)
qdvhd-os4o2-zzrdw-xrcv4-gljou-eztdp-bj326-e6jgr-tkhuc-ql6v2-yqe	Application	true
qxesv-zoxpm-vc64m-zxguk-5sj74-35vrb-tbgwg-pcird-5gr26-62oxl-cae	Verified Application	false	Subnet will be opened up soon
shefu-t3kr5-t5q3w-mqmdq-jabyv-vyvtf-cyyey-3kmo4-toyln-emubw-4qe	Verified Application	false	Distrikt subnet cannot be public before migrating away from ICQC
snjp4-xlbw4-mnbog-ddwy6-6ckfd-2w5a2-eipqo-7l436-pxqkh-l6fuv-vae	Verified Application	false	Subnet will be opened up soon
tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe	System	false	System subnets should not have public access
uzr34-akd3s-xrdag-3ql62-ocgoh-ld2ao-tamcv-54e7j-krwgb-2gm4z-oqe	System	false	System subnets should not have public access
w4asl-4nmyj-qnr7c-6cqq4-tkwmt-o26di-iupkq-vx4kt-asbrx-jzuxh-4ae	Verified Application	false	Subnet will be opened up soon
w4rem-dv5e3-widiz-wbpea-kbttk-mnzfm-tzrc7-svcj3-kbxyb-zamch-hqe	System	false	System subnets should not have public access
x33ed-h457x-bsgyx-oqxqf-6pzwv-wkhzr-rm2j3-npodi-purzm-n66cg-gae	Application	false	Explicitly marked as non-public (SNS subnet)
yinp6-35cfo-wgcd2-oc4ty-2kqpf-t4dul-rfk33-fsq3r-mfmua-m2ngh-jqe	Application	true ⇒ false	Subnet has more than 300 GiB state size

Proposal id 134334

[sat]

This proposal is in line with:

Suggested approach to make more compute capacity available on the IC

TL;DR Given the rapidly increasing load on the IC, we propose adding additional application subnets to provide developers with greater flexibility and choice when selecting a deployment environment. This expansion will increase the capacity of ICP and accommodate continued growth in the coming months. The following three step approach is proposed: Step 1: Expand the list of public subnets. This step has already been completed Step 2: Open subsets of the currently verified subnets to the commun…

Additional comment: @nikola-milosa in

feat(dre): incremental opening of verified subnets

added two features:

1. querying the CMC canister for the list of current public subnets, which allows the tooling to show the transition of the Public setting (e.g. false ⇒ true) based on the real setting at the time of the proposal submission
2. allows us to make 1 “verified” subnet at a time (naming is hard, let’s not talk about the choice of word “verified”)

The shefu subnet is not yet public, in line with the explanation in

feat: Restrict legacy ICQC code to one subnet (#2647)

[timk11]

Voted to adopt proposal 134334. This proposal changes the status of 3 subnets from public to non-public and 1 subnet from non-public to public. The content of the proposal matches the payload and the reasoning is sound, as explained in the table within the proposal and in the linked forum thread and additional links within this thread.

[stefan.schneider]

Eq6en also has more than 60000 canisters, but is marked as “subnet will be opened up soon”. I assume that’s just a typo in the table above?

[Lorimer]

Thanks @sat

4zbus-z2bmt-ilreg-xakz4-6tyre-hsqj4-slb4g-zjwqo-snjcc-iqphi-3qe is being made public. There was quite a lot of blow back from devs last time this sort of thing happened (devs with canisters residing on private subnets that were then made public, and then became super busy).

Do we know who owns those 103 canisters, and have they been consulted?

[sat]

@stefan.schneider

Eq6en also has more than 60000 canisters, but is marked as “subnet will be opened up soon”. I assume that’s just a typo in the table above?

Yes, apologies this is a bug in the table generation. That sentence is generic default.

[sat]

@Lorimer

There was quite a lot of blow back from devs last time this sort of thing happened

I haven’t been closely following, I missed that.

@Lorimer

Do we know who owns those 103 canisters

I’m not aware of any users other than DFINITY for scalability testing.

[Lorimer]

@sat

I’m not aware of any users other than DFINITY for scalability testing

Given that the subnet has only been accessible for specific principals (which are known), is there a lookup table somewhere for all DFINITY team principals that can be used to check this?

Even better, is there a lookup for all priviledged principals on the various subnets? (to identify the team name and/or why they have that priviledge)

[sat]

@Lorimer

Even better, is there a lookup for all priviledged principals on the various subnets? (to identify the team name and/or why they have that priviledge)

Not that I am aware of, sorry. Would be nice if that existed but there was never strict control over who gets to install what canister where. And canisters are anonymous so…
I argued that it would be useful to have a memo field or contact or something in the canister metadata, bit that didnt get any traction. So here we are.

[Lorimer]

That’s unfortunate At least you tried That info would have been very useful for both the canister owners, and those making decisions about the subnets they’re in.

---

I’ve voted to adopt.

I’ve taken a look at verifying the claims in the proposal and independently reproduced one below, using data retrieved from the CMC and IC API. On the far right I’ve included a ‘Proposal Actions and Claims’ column (which copies the claims from the table in the proposal summary), and a ‘Review Comments’ column which hopefully is self explanatory.

Verification Table

Subnet id	Subnet Type	Public	Authorised Principals	Last Changed	Canisters	Memory Usage	Review Comments	Proposal Action and Claims
2fq7c	Application	false	tu45y		93,390	528.503 GB	Claims on the right checkout	Subnet Type: Application, Public: false, Description: Subnet has more than 60000 canisters
3hhby	Application	true	EVERYONE	2024-09-13 by 132409	27,751	447.334 GB	Claims on the right check out (subnet is being made private as it’s surpassed the memory usage threshold)	Subnet Type: Application, Public: true ⇒ false, Description: Subnet has more than 300 GiB state size
4ecnw	Application	true	EVERYONE	2024-09-13 by 132409	6,808	162.452 GB		Subnet Type: Application, Public: true,
4zbus	Verified Application	false	pr42y		104	0.002 GB	Subnet is being made public. It’s one of the smallest verified subnets, so seems like the lowest risk	Subnet Type: Verified Application, Public: false ⇒ true,
5kdm2	Verified Application	false	237hs		10,337	184.282 GB	There are lots of cansiters in here, and lots of priviledged principals (are they expecting this subnet to be made public soon?)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			3eyor
			55s5q
			5oynr
			7qgkj
			avesb
			csecq
			ewj4h
			krrme
			pr42y
6pbhf	Application	true	EVERYONE	2024-09-13 by 132409	34,729	346.706 GB	Claims on the right check out (subnet is being made private as it’s surpassed the memory usage threshold)	Subnet Type: Application, Public: true ⇒ false, Description: Subnet has more than 300 GiB state size
bkfrj	Application (European)	false			22,596	146.001 GB	Claims on the right check out	Subnet Type: Application, Public: false, Description: Explicitly marked as non-public (European subnet)
brlsh	Application	true	EVERYONE	2024-09-13 by 132409	32,788	61.778 GB	Claims on the right check out	Subnet Type: Application, Public: true,
			pr42y				← Redundant Authorisation?
csyj4	Verified Application	false	6yhjs		719	23.366 GB	There are lots of cansiters in here, and lots of priviledged principals (are they expecting this subnet to be made public soon?)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			a5oei
			ai7i2
			jjugn
			keqno
			p5c7b
			pr42y
			q4qi3
			tpzpj
			udh3l
			w5bpc
			ykpqe
			zo34z
cv73p	Application	true	EVERYONE	2024-09-13 by 132409	51,020	237.518 GB		Subnet Type: Application, Public: true,
e66qm	Application	true	EVERYONE	2024-09-13 by 132409	35,407	196.088 GB		Subnet Type: Application, Public: true,
ejbmu	Verified Application	false	2mgs2		252	4.878 GB	Lots of priviledged principals here (are they expecting this subnet to be made public soon?)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			3hlbk
			6i6gh
			l3x6q
			m7b5y
			oyryp
			pr42y
			ruurp
eq6en	Verified Application	false	347of		101,627	492.302 GB	This subnet has too many canisters and too much memory usage to be made public (@stefan.schneider has already identified this)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			dlsk6
			pr42y
			tsqwz
			tu45y
fuqsr	Application	true	EVERYONE	2024-09-13 by 132409	19,841	216.395 GB		Subnet Type: Application, Public: true,
gmq5v	Application	true	EVERYONE	2024-09-13 by 132409	33,562	155.243 GB		Subnet Type: Application, Public: true,
			pr42y				← Redundant Authorisation?
io67a	Verified Application	false	pr42y		141	0.526 GB	Another small verified application subnet (seems like a preferable candidate for being made public soon compared to the larger ones)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			wyzjx
			xiwzc
jtdsg	Application	true	EVERYONE	2024-09-13 by 132409	26,766	211.069 GB		Subnet Type: Application, Public: true,
			pr42y				← Redundant Authorization?
k44fs	Application	false	pr42y		30,039	421.945 GB	Claims on the right check out	Subnet Type: Application, Public: false, Description: Subnet has more than 300 GiB state size
lhg73	Application	false	pr42y		25,958	545.584 GB	Claims on the right check out	Subnet Type: Application, Public: false, Description: Subnet has more than 300 GiB state size
lspz2	Application	true	EVERYONE	2024-09-13 by 132409	39,427	139.112 GB		Subnet Type: Application, Public: true,
			pr42y				← Redundant Authorisation?
mpubz	Application	true	EVERYONE	2024-09-13 by 132409	54,937	290.793 GB		Subnet Type: Application, Public: true,
			pr42y				← Redundant Authorisation
nl6hn	Application	true	EVERYONE	2024-09-13 by 132409	31,132	231.95 GB		Subnet Type: Application, Public: true,
o3ow2	Application	true	EVERYONE	2024-09-13 by 132409	56,203	271.3 GB		Subnet Type: Application, Public: true,
opn46	Application	true	EVERYONE	2024-09-13 by 132409	39,400	282.24 GB		Subnet Type: Application, Public: true,
			pr42y				← Redundant Authorisation?
pae4o	Verified Application	false	hepun		2,892	16.135 GB	There are lots of cansiters in here, and lots of priviledged principals (are they expecting this subnet to be made public?)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			ilqei
			m3m6n
			mcoor
			pr42y
			wl2xv
			y5mgz
pjljw	Application	true	EVERYONE	2024-09-13 by 132409	31,728	224.531 GB		Subnet Type: Application, Public: true,
			pr42y				← Redundant Authorisation?
pzp6e	Application (Fiduciary)	false			719	23.149 GB	Claims on the right check out	Subnet Type: Application, Public: false, Description: Explicitly marked as non-public (Fiduciary subnet)
qdvhd	Application	true	EVERYONE	2024-09-13 by 132409	52,412	51.137 GB		Subnet Type: Application, Public: true,
			pr42y				← Redudant Authorisation?
qxesv	Verified Application	false	2yjpj		142	0.346 GB	Another small verified application subnet (seems like a preferable candidate for being made public soon compared to the larger ones)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			hepun
			ilqei
			m3m6n
			mcoor
			pr42y
			y5mgz
shefu	Verified Application	false	65bcw		592	86.91 GB	Interesting that this concession needs to be made for a known team on this verified subnet. What about the numerous unkown principals on the verified subnets that will be made public soon (or the one being made public in this proposal?)	Subnet Type: Verified Application, Public: false, Description: Distrikt subnet cannot be public before migrating away from ICQC
			76do6
			aotw3
			auw2h
			bn6wo
			bxywk
			cuih4
			dwfft
			mrnwe
			ow6ai
			pr42y
			yv2jo
snjp4	Verified Application	false	bl7vf		157	3.988 GB	Lots of priviledged principals here (are they expecting this subnet to be made public soon?)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			hepun
			ilqei
			kr2dh
			m3m6n
			mcoor
			pr42y
			y5mgz
			zcmil
tdb26	System	false			14	20.272 GB	Claims on the right check out	Subnet Type: System, Public: false, Description: System subnets should not have public access
uzr34	System	false			7	14.735 GB	Claims on the right check out	Subnet Type: System, Public: false, Description: System subnets should not have public access
w4asl	Verified Application	false	pr42y		168	0.002 GB	Another small verified application subnet (seems like a preferable candidate for being made public soon compared to the larger ones)	Subnet Type: Verified Application, Public: false, Description: Subnet will be opened up soon
			qdjzi
w4rem	System	false			6	306.916 GB	Claims on the right check out	Subnet Type: System, Public: false, Description: System subnets should not have public access
x33ed	Application	false			231	33.845 GB	Claims on the right check out	Subnet Type: Application, Public: false, Description: Explicitly marked as non-public (SNS subnet)
yinp6	Application	true	EVERYONE	2024-09-13 by 132409	4,207	308.197 GB	Claims on the right check out. Subnet is being made private as it’s crossed the memory usage threshold	Subnet Type: Application, Public: true ⇒ false, Description: Subnet has more than 300 GiB state size

My main comments are:

• I’ve verified the threshold claims made about the 3 subnets that are being made private In each case memory usage is above 300 GB

• The verified application subnet being made public (4zbus) is one of the small ones, so seems like one of the lowest risk subnets (there’s also only one principal with authorisation at the moment - pr42y-f6vp7-lbhgk-qt4oq-524yv-yabkq-6bhr7-nludh-bbbpj-aiuhu-xqe, so all in all seems like a low risk subnet to make public)

• There are numerous cases of redundant authorisation (principals that have explicit authorisation for subnets that are actually public anyway). Not really as issue with this proposal as such, but would be good to tidy up in a future proposal.

The legacy code for ICQC (inter-canister query calls), aka predecessor of composite queries, is still enabled in system and verified application subnets. There’s only one actual user of this legacy feature and it’s Distrikt

• The fact that a concession is being made for the new Distrikt team is interesting, given that there are lots of unknown principals (with unknown dapps) in the various verified system subnets. Given that, how can we be sure their dapps don’t have this dependency too?

[sat]

@Lorimer

there are lots of unknown principals (with unknown dapps) in the various verified system subnets. Given that, how can we be sure their dapps don’t have this dependency too?

Based on the replica metrics, only distrikt uses this functionality. Buy you are right, the absence of usage in a particular time period is not a proof of absence in general. So some functions on some canisters may stop working. We’ll see next week, during the rollout of the new GuestOS version.

[ZackDS]

Voted to adopt proposal #134334.

So while this proposal makes sense and it is so called “in line” with “adding additional application subnets” and it follows proposal# 132409 , I find the addition of the “Subnet Type” column in the summary very much appreciated, I still think that verifying this proposal is a bit complicated for new ppl.

Simply put:

• using the IC Dashboard one can check for eg subnet 4zbus the TYPE (Application), number of Canisters(103) and State size(1.82 MiB).
• a quick search for “subnet info” takes us to using just ic-admin
  ~$ ./ic-admin --nns-url=https://ic0.app get-subnet 4zbus-z2bmt-ilreg-xakz4-6tyre-hsqj4-slb4g-zjwqo-snjcc-iqphi-3qe gives quite a detailed list of info including in our example "subnet_type": "verified_application"
• while actually using $ dre update-authorized-subnets does recreate propose-to-set-authorized-subnetworks to update the list including the payload so we can reproduce the proposal (ofc using dry-run and such should be known).

Anywho the TLDR of my rambling is including a short info/description on how to check/verify would be useful to have in the summary for future proposals, IMHO.

BTW the addition of 349c2a5 is great, really like that there is a check on how many VerifiedApplication subnets can pass.

Other thoughts:

• side note about “District”
  https://nuance.xyz/oif/11630-434go-diaaa-aaaaf-qakwq-cai/distrikt-update-connections
  
  

They will be fine

[rbole]

What does this mean for the European Subnet ?

[Lorimer]

It’s a private subnet according to the cycles minting canister. It will also be private after this proposal (that subnet isn’t targeted).

[wpb]

@ZackDS

side note about “District”

It always amazes me how up to date you are on how changes affect different projects in the ecosystem. Thank you.

[ZackDS]

To be fair Dfinity does a great job documenting every change, as does the DRE team to highlight them when that is the case, it just takes a bit of time to go and read it. Eg here the very detailed description provided in commit 826d9a5 and seeing the added line for subnet shefu with “Distrikt subnet cannot be public before migrating away from ICQC” to the non_public_subnets.csv file in 349c2a5 shines a light on what is going on.

[LaCosta]

Voted to adopt proposal 134334. The proposal changes the Public status of 4 subnets making three of them private due to having more than 300 GiB state size which can be verified in the Dashboard and one of them public following as part of Step 2 in an approach to increase the capacity of ICP.

[Lorimer]

@LaCosta

The proposal changes the Public status of 4 subnets making two of them private due to having more than 300 GiB state size which can be verified in the Dashboard and two of them public

Which is the second subnet that’s being made public - did I miss something?

There were 3 subnets being made private when I checked.

[LaCosta]

Thanks for the reply. You are right it was a typo on my part. I have updated the review.