Title: Formalizing Dependence of Web Infrastructure
Authors: Rumaisa Habib, Kimberly Ruth, Gautam Akiwate, Zakir Durumeric (Stanford University)
Scribe: Xiaoqiang Zheng (Xiamen University)
Introduction
This paper studies the growing issue of Internet centralization, where essential web infrastructure such as hosting, DNS, and certificate authorities become concentrated among a few dominant providers. While centralization improves performance and security in some respects, it also threatens competition, resilience, and user privacy. Existing studies have mostly relied on ad-hoc descriptive metrics, such as market share of top providers, which fail to capture distributional nuances and make cross-country or longitudinal comparisons difficult. This work addresses the gap by proposing rigorous, formal metrics to quantify Internet centralization and related forms of dependence.
Key idea and contribution
The authors’ central idea is to formalize centralization as the statistical distance between observed provider distributions and a fully decentralized reference distribution. They propose using Earth Mover’s Distance (Wasserstein distance) to capture both the concentration and distribution of providers in one principled score.
Beyond centralization, the paper introduces complementary metrics—usage, endemicity, and insularity—that together capture the geopolitical context of “regionalization,” or cross-country dependencies.
Using these metrics, the authors conduct a large-scale measurement study across 150 countries, analyzing hosting providers, DNS infrastructure, and certificate authorities. The study uncovers important insights, such as cases where regional providers drive as much dependence as global hyperscalers, and how geopolitical ties (e.g., CIS countries relying on Russian providers, or African countries depending on European ones) shape Internet resilience and privacy risks.
Evaluation
The evaluation relies on data from the Chrome User Experience Report and active measurements, covering millions of websites across multiple infrastructure layers. Results show that centralization is not uniform: Southeast Asia is among the most centralized, Europe among the least, and certificate authorities exhibit consistently high centralization globally. Importantly, the findings reveal that centralization and regionalization interact in ways overlooked by prior research. This result is significant because it provides the community with a rigorous, quantitative toolkit to reason about Internet dependence, enabling fairer comparisons across time, regions, and infrastructure layers.
Personal thoughts
I appreciate that the paper moves the discussion of centralization beyond descriptive statistics to a rigorous, interpretable metric. The integration of centralization with regionalization is particularly valuable, as it reflects the real-world power dynamics shaping Internet dependence. The comprehensive dataset across 150 countries provides an excellent empirical foundation for future work.
That said, I see some limitations. The study focuses heavily on Chrome-based telemetry, which may bias results in regions with lower Chrome adoption. Also, while the metrics are powerful, they remain descriptive; understanding causal drivers of dependence (e.g., provider incentives, regulatory factors, or user behavior) remains an open question. Future work could explore traffic-weighted centralization, causal inference, and the interplay between technical and political factors.