September 2017 - db-wg - mailman.ripe.net

re:[db-wg] violation of DB T&C by DB-WG co-chair, is it acceptable?
by Anne-vivien Paris 14 Sep '17

14 Sep '17

Hi Elvis, Regarding your claim that our company misuses operation emails, we would like to address the issue in the following as it deeply affects our company's image as well as customer's credibility for us: 1. Although David sent the email, he is not the one who decides the recipient list. This is decided by the marketing team. 2. As a company which fully upholds fairness and respects customers ‘privacy, Larus NEVER uses any operation emails or technical emails for commercial use. The emails we used for commercial purpose are only those that are open to public. Please let us know if there is any misunderstanding. 3. We also respect our customer's privacy by implementing a un-subscription policy. Customers can unsubscribe anytime at their liberty. Larus never sends spam emails to our customers nor misuse any operation emails. Every employee of Larus follows strictly this policy. We do not tolerate any improper behaviour within the company as well as any false claims. Please do not hesitate to contact us in private if you find an operation email is used for commercial purpose.

3 2

re:[db-wg] violation of DB T&C by DB-WG co-chair, is it acceptable?
by Anne-vivien Paris 13 Sep '17

13 Sep '17

Hi Elvis, Regarding your claim that our company misuses operation emails, we would like to address the issue in the following as it deeply affects our company's image as well as customer's credibility for us: 1. Although David sent the email, he is not the one who decides the recipient list. This is decided by the marketing team. 2. As a company which fully upholds fairness and respects customers ‘privacy, Larus NEVER uses any operation emails or technical emails for commercial use. The emails we used for commercial purpose are only those that are open to public. Please let us know if there is any misunderstanding. 3. We also respect our customer's privacy by implementing a un-subscription policy. Customers can unsubscribe anytime at their liberty. Larus never sends spam emails to our customers nor misuse any operation emails. Every employee of Larus follows strictly this policy. We do not tolerate any improper behaviour within the company as well as any false claims. Please do not hesitate to contact us in private if you find an operation email is used for commercial purpose.

1 0

Draft Agenda RIPE75 - Database Working Group
by William Sylvester 11 Sep '17

11 Sep '17

Dear all, Below is the draft outline for the Database Working Group agenda for RIPE75. If you have any questions or comments please let the chairs know. Best regards, William, David, Denis DB-WG Chairs A. Introduction - 5 min * Welcome * Scribe * Jabber * Agenda B. Operational Update RIPE Database - 40 mins Tim Bruijnzeels, RIPE NCC C. Update on DB-WG mailing list challenges - 5 mins D. NWI - Open Proposals - 10 mins E. Identifier Technology Health Indicators (ITHI) - 20 mins Alain Durand, ICANN Z) AOB (open discussion)

1 0

Re: [db-wg] RIPE Policy Proposal 2017-02 Validates Database Attributes
by Horváth Ágoston János 11 Sep '17

11 Sep '17

Hi all, Agreed that a yearly email ping-pong is not really a good verification of abuse contact address. It's trivial to let RIPE NCC mails through and throw away the rest. But, one might ask, what's the point of a database if the data is not reliable? What's the point of all that contact info if we can't trust it? Why would we want to store (and serve) data that is not correct? Data validation is standard industry practice, pretty much everywhere. You can't even buy a bar of chocolate without validating your email address. One might ask, why would RIPE NCC not follow even the most basic industry practices while validating data of this importance? Cheers, Agoston On Thu, Sep 7, 2017 at 6:54 PM, Sascha Luck [ml] via db-wg <db-wg(a)ripe.net> wrote: > > > ---------- Forwarded message ---------- > From: "Sascha Luck [ml]" <dbwg(a)c4inet.net> > To: db-wg(a)ripe.net > Cc: anti-abuse-wg(a)ripe.net > Bcc: > Date: Thu, 7 Sep 2017 17:54:04 +0100 > Subject: Re: [db-wg] RIPE Policy Proposal 2017-02 Validates Database Attributes > All, > > I will discuss this here as I do not accept the Anti-Abuse WG as > a forum for this proposal. For one thing, this proposal affects > every ripedb user - in fact, as this entails changes to how the > NCC provides services, the services-wg would be an even better > venue. For another, given the "population" and culture of > "debate" on the AAWG, any "consensus" reached there would be so > worthless as to be farcical. (If anyone wants amplification on > this, https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/ > provides ample evidence. > > To the meat of the proposal: > > Firstly, this proposal conflicts somewhat with NWI-7 in this very > WG. (Another reason why it should have gone here in the first > place) With the upcoming possibility of delegating abuse-c: to > (customers') resource objects, who bears any consequences of > these customers not replying to this proposed email? >> >> Rationale >> a. Arguments supporting the proposal > > >> Accurate and validated information in the RIPE Database is >> essential to establish a trusted and transparent environment in >> which all network operators can operate safely. > > > abuse-c: is a contact object, just as admin-c: or tech-c: and > (correct me if I'm wrong) audited at the same time as the rest of > the contact information. What makes it so unique that this > verification is not enough? > >> Accurate and >> validated information helps Internet troubleshooting at all >> levels, but it also helps to attribute malicious online >> activities that undermine this trusted environment. > > > See above. > >> The lack of reliable accurate and validated information in the >> database negatively impacts legitimate uses of the RIPE Database, >> including: > > > An *email adress* that doesn't reply once a year does NOT equate > to a "lack of reliable accurate and validated information". I > find this statement somewhat insulting to the NCC team who do > make the effort to keep the ripedb data accurate and do audit > resource holders. > There is an issue with the reliability of out-of-region and > legacy resource data but as the NCC has no "enforcement" powers > over these resource holders, in these cases this proposal > snatches at thin air. >> >> Assuring the security and reliability of the network by >> identifying points of contact for IP addresses for network >> operators, ISPs, and certified computer incident response teams; > > > "org:", "admin-c:", "tech-c:", "mnt-by:" and, yes, "abuse-c:" exist. > >> Ensuring that IP address holders are accountable, so individuals, >> consumers and the public are empowered to resolve abusive >> practices that impact safety and security; >> Assisting businesses, consumer groups, healthcare organisations >> and other organisations that are combating fraud (some of which >> have mandates to electronically save records) to comply with >> relevant legal and public safety safeguards; > > > The contact object that does (or *should*) stand for the person(s) who > can speak for a LIR, legally, is "admin-c:". "abuse-c:" is some role > account in a NOC or even a ticket system unlikely to have any > decision-making power. An attempt to make these roles (perhaps > even personally) responsible for the behaviour of a LIR and its > customers is counter-productive. I for one would flatly refuse to > do any abuse report handling under these circumstances. > >> Complying with national, civil and criminal due process laws in >> support of investigations and providing justice for victims. > > > Would the proposers please amplify exactly which law or due > process is violated by the NCC not sending an email once a year > to an abuse-c:? Myself, and I'm sure the NCC legal team, would be > interested to know. > > On a technical note, email is neither a secure nor a reliable > transport for such verification. In the day of blocklists and > large email providers imposing arbitrary restrictions on email > senders it is not guaranteed that a verification email reaches > the intended address or that a reply reaches the sender. The NCC > ARC procedure, however employs both email and personal contact > via telephone to verify the accuracy of the ripedb information. > > In toto, this proposal would impose unneccessary work on LIRs and > the NCC, using unsuitable means to rectify a non-existing issue, and I therefore oppose it. > >

1 0

Re: [db-wg] RIPE Policy Proposal 2017-02 Validates Database Attributes
by Sascha Luck [ml] 10 Sep '17

10 Sep '17

All, I will discuss this here as I do not accept the Anti-Abuse WG as a forum for this proposal. For one thing, this proposal affects every ripedb user - in fact, as this entails changes to how the NCC provides services, the services-wg would be an even better venue. For another, given the "population" and culture of "debate" on the AAWG, any "consensus" reached there would be so worthless as to be farcical. (If anyone wants amplification on this, https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/ provides ample evidence. To the meat of the proposal: Firstly, this proposal conflicts somewhat with NWI-7 in this very WG. (Another reason why it should have gone here in the first place) With the upcoming possibility of delegating abuse-c: to (customers') resource objects, who bears any consequences of these customers not replying to this proposed email? >Rationale >a. Arguments supporting the proposal >Accurate and validated information in the RIPE Database is >essential to establish a trusted and transparent environment in >which all network operators can operate safely. abuse-c: is a contact object, just as admin-c: or tech-c: and (correct me if I'm wrong) audited at the same time as the rest of the contact information. What makes it so unique that this verification is not enough? >Accurate and >validated information helps Internet troubleshooting at all >levels, >but it also helps to attribute malicious online >activities that undermine this trusted environment. See above. >The lack of reliable accurate and validated information in the >database negatively impacts legitimate uses of the RIPE Database, >including: An *email adress* that doesn't reply once a year does NOT equate to a "lack of reliable accurate and validated information". I find this statement somewhat insulting to the NCC team who do make the effort to keep the ripedb data accurate and do audit resource holders. There is an issue with the reliability of out-of-region and legacy resource data but as the NCC has no "enforcement" powers over these resource holders, in these cases this proposal snatches at thin air. >Assuring the security and reliability of the network by >identifying points of contact for IP addresses for network >operators, ISPs, and certified computer incident response teams; "org:", "admin-c:", "tech-c:", "mnt-by:" and, yes, "abuse-c:" exist. >Ensuring that IP address holders are accountable, so individuals, >consumers and the public are empowered to resolve abusive >practices that impact safety and security; >Assisting businesses, consumer groups, healthcare organisations >and other organisations that are combating fraud (some of which >have mandates to electronically save records) to comply with >relevant legal and public safety safeguards; The contact object that does (or *should*) stand for the person(s) who can speak for a LIR, legally, is "admin-c:". "abuse-c:" is some role account in a NOC or even a ticket system unlikely to have any decision-making power. An attempt to make these roles (perhaps even personally) responsible for the behaviour of a LIR and its customers is counter-productive. I for one would flatly refuse to do any abuse report handling under these circumstances. >Complying with national, civil and criminal due process laws in >support of investigations and providing justice for victims. Would the proposers please amplify exactly which law or due process is violated by the NCC not sending an email once a year to an abuse-c:? Myself, and I'm sure the NCC legal team, would be interested to know. On a technical note, email is neither a secure nor a reliable transport for such verification. In the day of blocklists and large email providers imposing arbitrary restrictions on email senders it is not guaranteed that a verification email reaches the intended address or that a reply reaches the sender. The NCC ARC procedure, however employs both email and personal contact via telephone to verify the accuracy of the ripedb information. In toto, this proposal would impose unneccessary work on LIRs and the NCC, using unsuitable means to rectify a non-existing issue, and I therefore oppose it.

4 3

Re: [db-wg] RIPE Policy Proposal 2017-02 Validates Database Attributes
by William Sylvester 08 Sep '17

08 Sep '17

DB WG Members, We understand there are many opinions on this proposal. We encourage everyone to discuss this request on the anti-abuse mailing list. We have been coordinated with the AA-WG chairs on this and would appreciate expressing your support or objections in the AA-WG as that is the forum this proposal was raised. If you have any questions or concerns please contact the db-wg chairs. Thanks, William, Denis, and David Database WG Chairs On Sep 7, 2017, at 1:05 PM, Marco Schmidt via db-wg <db-wg(a)ripe.net<mailto:db-wg@ripe.net>> wrote: <mime-attachment>

1 0

RIPE Policy Proposal 2017-02 Validates Database Attributes
by Marco Schmidt 08 Sep '17

08 Sep '17

Dear colleagues, We just published RIPE Policy proposal, 2017-02, "Regular abuse-c Validation", to the Anti-Abuse Working Group mailing list. The goal of this proposal is to give the RIPE NCC a mandate to regularly validate "abuse-c:" information, and to follow up in cases where contact information is found to be invalid. As this proposal relates to contact information put into the RIPE Database, we would like to notify the Database Working Group specifically. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2017-02 We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 6 October 2017. Regards, Marco Schmidt Policy Development Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

2 2

Re: Last Call for Agenda Items DB-WG Meeting - RIPE75 - Dubai, UAE
by William Sylvester 01 Sep '17

01 Sep '17

Dear DB-WG Members, This is the last call for agenda items for the DB-WG Meeting at RIPE75 at the Conrad Dubai in Dubai, UAE. Due to restrictions by UAE law we will not be able to add last minute presentations. Please submit your proposals to the working group chairs as soon as possible not later than September 6, 2017. Please submit agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net<mailto:db-wg-chairs@ripe.net> The DB-WG Meeting is scheduled for Wednesday, October 25th, starting at 14:00 local time, after lunch and before the coffee break. The length of our timeslot is 90 minutes. For the overall RIPE 74 meeting plan please refer to its most up-to-date version at https://ripe75.ripe.net/programme/meeting-plan/ Note: due to UAE law, confirmed speakers will need to submit a copy of their passport and contact information in advance of the meeting. More details are available here: https://ripe75.ripe.net/attend/dctm-requirements We are looking forward to another successful meeting in Dubai. Kind regards, William, Denis, & David DB WG Chairs

1 0