- db-wg - mailman.ripe.net

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Sascha Luck [ml] 11 Oct '17

11 Oct '17

On Mon, Oct 09, 2017 at 02:49:39PM +0100, denis walker via db-wg wrote: > Question - Should the RIPE Database allow creation of ROUTE objects for non RIPE resources? Is an option D: create a central IRRDB with authentication hooks into all RIRs completely out of the question? It certainly sounds like the technologically most elegant answer. Modulo legacy resources, no unauthenticated irrdb objects should then have to exist. The trust root could be shared between the RIRs as is seemingly done with RPKI these days... cheers, Sascha Luck

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Job Snijders 11 Oct '17

11 Oct '17

On Tue, Oct 10, 2017 at 4:17 PM, Nick Hilliard via db-wg <db-wg(a)ripe.net> wrote: > ---------- Forwarded message ---------- > From: Nick Hilliard <nick(a)foobar.org> > To: Randy Bush <randy(a)psg.com> > Cc: Database WG <db-wg(a)ripe.net> > Date: Tue, 10 Oct 2017 15:16:41 +0100 > Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? > Randy Bush via db-wg wrote: >>> > Question - Should the RIPE Database allow creation of ROUTE objects >>> > for non RIPE resources? >> >> yes > > then how can we use the traditional irrdb to distinguish between address > blocks which have been authenticated by the ripe ncc and those which > have not. > > Nick I think this touches upon an incredibly important question: how do we distinguish between garbage and properly authenticated "route:" objects covering RIPE-managed space? It seems it would be low hanging fruit to use the "source:" tag to distinguish between objects that are authenticated and non-authenticated by using "source: RIPE" and "source: RIPE-NONAUTH". The above described small step bridges the needs to many who expressed opposing views in this thread: some want to be able to register anything in the RIPE DB and some want it to be pristine and purge all non-RIPE-managed space from the IRR DB. By decorating the two types of data with the appropriate "source:" attribute I think we are meeting in the middle. By using a different "source:" attribute for RIPE vs non-RIPE space it becomes easier for operators to cherry pick which data they want to use in the creation of their routing security filters. Should the group decide to proceed with option A or C (between which I don't see a difference), at the very least it should be visible to my tooling which objects represent what type of data. Kind regards, Job

2 1

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Horváth Ágoston János 11 Oct '17

11 Oct '17

On Wed, Oct 11, 2017 at 12:28 PM, Daniel Shaw via db-wg <db-wg(a)ripe.net> wrote: > On 11/10/2017, 14:09, Job Snijders via db-wg typed: >> You >> as network operator can easily poll the APNIC or AFRINIC database. >> There are even a number of "IRR aggregation services" such as NTTCOM >> and RADB which mirror a ton of IRRs for your querying convenience. > > Without commenting on the debate either way (in this mail, at this time), just a quick technical note: In fact, the RIPE DB mirrors the AFRINIC IRR data, so you at least as far as AFRINIC goes, provided there is IRR data in the AFRINIC DB, you can get it by querying the RIPE DB with the correct 'source:' Correct. But if RIPE allows the creation of objects for which it has no authority over, what are users supposed to do when they see the contradicting data coming from RIPE and AFRINIC (to follow your example)? That's also the reason for the existence of the --resource query flag. Question is, why would we keep data that is not authoritative (and not mirror) in the RIPE DB? Agoston On Wed, Oct 11, 2017 at 12:28 PM, Daniel Shaw via db-wg <db-wg(a)ripe.net> wrote: > > > ---------- Forwarded message ---------- > From: Daniel Shaw <daniel(a)afrinic.net> > To: Database WG <db-wg(a)ripe.net> > Cc: > Bcc: > Date: Wed, 11 Oct 2017 14:27:56 +0400 > Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? > On 11/10/2017, 14:09, Job Snijders via db-wg typed: >> You >> as network operator can easily poll the APNIC or AFRINIC database. >> There are even a number of "IRR aggregation services" such as NTTCOM >> and RADB which mirror a ton of IRRs for your querying convenience. > > Without commenting on the debate either way (in this mail, at this time), just a quick technical note: In fact, the RIPE DB mirrors the AFRINIC IRR data, so you at least as far as AFRINIC goes, provided there is IRR data in the AFRINIC DB, you can get it by querying the RIPE DB with the correct 'source:' > > Cheers, > Daniel > > >

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Daniel Shaw 11 Oct '17

11 Oct '17

On 11/10/2017, 14:09, Job Snijders via db-wg typed: > You > as network operator can easily poll the APNIC or AFRINIC database. > There are even a number of "IRR aggregation services" such as NTTCOM > and RADB which mirror a ton of IRRs for your querying convenience. Without commenting on the debate either way (in this mail, at this time), just a quick technical note: In fact, the RIPE DB mirrors the AFRINIC IRR data, so you at least as far as AFRINIC goes, provided there is IRR data in the AFRINIC DB, you can get it by querying the RIPE DB with the correct 'source:' Cheers, Daniel

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Job Snijders 11 Oct '17

11 Oct '17

Hi Randy, On Tue, Oct 10, 2017 at 4:27 PM, Randy Bush via db-wg <db-wg(a)ripe.net> wrote: > From: Randy Bush <randy(a)psg.com> > To: Nick Hilliard <nick(a)foobar.org> > Cc: Database WG <db-wg(a)ripe.net> > Date: Tue, 10 Oct 2017 23:26:34 +0900 > Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? >>>>> Question - Should the RIPE Database allow creation of ROUTE objects >>>>> for non RIPE resources? >>> >>> yes >> >> then how can we use the traditional irrdb to distinguish between address >> blocks which have been authenticated by the ripe ncc and those which >> have not. > > as you said, it would be good to have an strongly authenticated > ownership which could assert routing. try the rpki; works across > all regions. You are right, RPKI does fit the bill in a number of ways, and I look forward to the operators taking advantage of the good bits. However this does not preclude the RIPE community from improving the quality of another commonly used source: IRR. As you know there are only 2 or 3 networks on this planet using RPKI in their operations, while I can point at many more networks using IRR to build their whitelists for provisioning. As you know there is a feature gap between IRR and RPKI. RPKI doesn't have an "AS-SET"-like replacement, and not all the RPKI TALs are as easy to obtain as their equivalent IRR data. > a least it's a more credible argument than thinking encouraging ipv4 > run-out will increase ipv6, as opposed to nat, uptake. < dripping > sarcasm > OK, this seems off topic. Kind regards, Job

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Job Snijders 11 Oct '17

11 Oct '17

On Tue, Oct 10, 2017 at 4:51 PM, Piotr Strzyzewski via db-wg <db-wg(a)ripe.net> wrote: > From: Piotr Strzyzewski <Piotr.Strzyzewski(a)polsl.pl> > To: Database WG <db-wg(a)ripe.net> > Date: Tue, 10 Oct 2017 16:50:45 +0200 > Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? > On Mon, Oct 09, 2017 at 07:43:13PM +0200, Gert Doering via db-wg wrote: >> On Mon, Oct 09, 2017 at 03:48:43PM +0200, denis walker via db-wg wrote: >> > Question - Should the RIPE Database allow creation of ROUTE objects for non RIPE resources? >> >> I wonder if this is the right question to ask, or we should step back >> and ask the question >> >> what can we do to provide a secure routing registry where people >> can document "this prefix will be announced by that AS" in a way >> that is a) strongly authenticated (= only the current holder of the >> address space can create such a route: object), and b) easy to use >> for people building filters (= not having to walk 5 different IRRDBs >> to find the set of prefixes announced by a possible customer)? >> >> instead? A, B or C may be a consequence of this. >> >> >> In any case, given that we have no proper global registry, and we have >> lots of cross-region routes ("addresses from RIR A, AS number from RIR B"), >> we need to find a way to document these properly. >> >> From a user perspective, I like to have all route: objects for my customers >> in a single place (RIPE BD, that is), so for me, "A" would be most convenient >> - but we need to add some sort of cross-RIR authentication layer. > > +1 > > Piotr Hi Piotr, Gert, Group, It seems strange to allow "route:' objects covering APNIC- or AFRINIC-managed space in the RIPE DB, just for your "convenience". You as network operator can easily poll the APNIC or AFRINIC database. There are even a number of "IRR aggregation services" such as NTTCOM and RADB which mirror a ton of IRRs for your querying convenience. The "convenience" argument seems a slippery slope: as your customer base grows, you'll be encouraging more and more non-RIPE space to end up in the RIPE database (even though it could be in an authenticated source such as APNIC). Why? To what benefit? Why would you be supportive of the continuation of type of pollution? Isn't a simpler solution to drop the "origin:" attribute verification and only authenticate against the "inetnum:" authentication hierarchy? This way an ARIN-managed ASN can easily register RIPE-managed space in the RIPE database and it would be strongly authentication against the "inetnum:" I think that RIPE managed space belongs in the RIPE database, however non-RIPE-managed space (APNIC, AFRINIC, ARIN, LACNIC, chunks of legacy) have no place here since we cannot authenticate them. Kind regards, Job

1 0

RIPE Access Account: Cannot change registered e-mail address back to previously one
by Christoffer Hansen 10 Oct '17

10 Oct '17

RIPE Database Working Group <db-wg(a)ripe.net> Am I the only one who have previously wondered about the following issue... (?) 1. Register a RIPE Access Account with [account_1(a)example.com] 2. is changed to [account_2(a)example.com] 3. later tries to change registered RIPE Access Account e-mail back to [ account_1(a)example.com]. I'am not allowed to do this. RIPE NCC's website simply does *not* allow me to do this. Refer to the following pictures for clarification. *Changing the e-mail address back to [account_1(a)example.com <account_1(a)example.com>]* *× * *Creating a new RIPE Access Account for [account_1(a)example.com <account_1(a)example.com>]* *× Trying the forgotten password function for [account_1(a)example.com <account_1(a)example.com>]* *× * Regards, Christoffer Hansen. gpg: c8b3 82a8 a1cd cdb7 71fe b24c c654 948f da86 becd

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Piotr Strzyzewski 10 Oct '17

10 Oct '17

On Mon, Oct 09, 2017 at 07:43:13PM +0200, Gert Doering via db-wg wrote: > On Mon, Oct 09, 2017 at 03:48:43PM +0200, denis walker via db-wg wrote: > > Question - Should the RIPE Database allow creation of ROUTE objects for non RIPE resources? > > I wonder if this is the right question to ask, or we should step back > and ask the question > > what can we do to provide a secure routing registry where people > can document "this prefix will be announced by that AS" in a way > that is a) strongly authenticated (= only the current holder of the > address space can create such a route: object), and b) easy to use > for people building filters (= not having to walk 5 different IRRDBs > to find the set of prefixes announced by a possible customer)? > > instead? A, B or C may be a consequence of this. > > > In any case, given that we have no proper global registry, and we have > lots of cross-region routes ("addresses from RIR A, AS number from RIR B"), > we need to find a way to document these properly. > > From a user perspective, I like to have all route: objects for my customers > in a single place (RIPE BD, that is), so for me, "A" would be most convenient > - but we need to add some sort of cross-RIR authentication layer. +1 Piotr -- Piotr Strzyżewski Silesian University of Technology, Computer Centre Gliwice, Poland

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Nick Hilliard 10 Oct '17

10 Oct '17

Randy Bush via db-wg wrote: >> > Question - Should the RIPE Database allow creation of ROUTE objects >> > for non RIPE resources? > > yes then how can we use the traditional irrdb to distinguish between address blocks which have been authenticated by the ripe ncc and those which have not. Nick

2 1

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Randy Bush 10 Oct '17

10 Oct '17

> But this time we do need numbers. voting, eh? > Question - Should the RIPE Database allow creation of ROUTE objects > for non RIPE resources? yes randy

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Lu Heng 10 Oct '17

10 Oct '17

On Tue, Oct 10, 2017 at 18:33 Sander Steffann via db-wg <db-wg(a)ripe.net> wrote: > Hi, > > > In any case, given that we have no proper global registry, and we have > > lots of cross-region routes ("addresses from RIR A, AS number from RIR > B"), > > we need to find a way to document these properly. > > My preference would be to start such a global registry. I would love it if > at least RIPE, APNIC and AFRINIC (who all use very similar data models > IIRC) could combine databases. Having separate (but in reality partially > overlapping) databases for a global resource will always result in > discussions like we have had over the last two+ years IMHO. Let's make an > effort to form a single point of reference. > +1 > > Cheers, > Sander > > > -- -- Kind regards. Lu

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Sander Steffann 10 Oct '17

10 Oct '17

Hi, > In any case, given that we have no proper global registry, and we have > lots of cross-region routes ("addresses from RIR A, AS number from RIR B"), > we need to find a way to document these properly. My preference would be to start such a global registry. I would love it if at least RIPE, APNIC and AFRINIC (who all use very similar data models IIRC) could combine databases. Having separate (but in reality partially overlapping) databases for a global resource will always result in discussions like we have had over the last two+ years IMHO. Let's make an effort to form a single point of reference. Cheers, Sander

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Nick Hilliard 09 Oct '17

09 Oct '17

Clement Cavadore via db-wg wrote: > That one, but with a *strong* enhancement on a trust model for such > objects. We just cannot simply allow non-ripe route objects to be > inserted in the db without any legitimity checks. there is no way which non-ripe route objects can be subjected to legitimacy checks. It can't be done because several other RIRs don't provide the authentication hooks to be able to do this. On the question of this work item, what I would like is a mechanism to distinguish between route objects which have been verified using the trust grandfathering mechanism deployed by the RIPE NCC, and those which have not. There are many ways of doing this, e.g. 1. Option B: remove all non RIPE objects from the db. 2. use different source: tags to distinguish between ripe space and non ripe space. 3. leave whois.ripe.net as it is, and create a different database consisting of only authenticated route: objects. 4. leave whois.ripe.net as it is and create a different database view which, if queried, will return only objects which have been authenticated. Options for handling this might include: 4.1. same db on different hostname providing a different view 4.2. a new ripe-181++ tag identifying authenticated objects My preferences in order are: 2, then 4.2, then 4.1, then 3, then 1. No doubt there are plenty of other ways to crack this particular nut. Denis's description of Option C perpetuates what is a operational problem which has serious and ongoing consequences in the area of prefix hijacking. It would not be realistic to characterise the current situation as "if it ain't broke...", because it is identifiably broken, and it is this breakage which has led to this discussion. If we could solve this problem in a way which was operationally portable to other RIRs, that would be a bonus. Nick

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Gert Doering 09 Oct '17

09 Oct '17

Hi, On Mon, Oct 09, 2017 at 03:48:43PM +0200, denis walker via db-wg wrote: > Question - Should the RIPE Database allow creation of ROUTE objects for non RIPE resources? I wonder if this is the right question to ask, or we should step back and ask the question what can we do to provide a secure routing registry where people can document "this prefix will be announced by that AS" in a way that is a) strongly authenticated (= only the current holder of the address space can create such a route: object), and b) easy to use for people building filters (= not having to walk 5 different IRRDBs to find the set of prefixes announced by a possible customer)? instead? A, B or C may be a consequence of this. In any case, given that we have no proper global registry, and we have lots of cross-region routes ("addresses from RIR A, AS number from RIR B"), we need to find a way to document these properly. From a user perspective, I like to have all route: objects for my customers in a single place (RIPE BD, that is), so for me, "A" would be most convenient - but we need to add some sort of cross-RIR authentication layer. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Hank Nussbacher 09 Oct '17

09 Oct '17

On 09/10/2017 18:22, denis walker via db-wg wrote: C -Hank

1 0

Re: Foreign ROUTE objects in RIPE Database - final decision?
by Alexander Stranzky 09 Oct '17

09 Oct '17

personal opinion: I don't care as a programmer. company's opinion: A - all our network resources are routed solely through our RIPE-AutNum. -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * D-63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181 1898119 * http://www.velia.net Follow us on twitter: https://twitter.com/velia_net

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Clement Cavadore 09 Oct '17

09 Oct '17

Hello Denis, WG On Mon, 2017-10-09 at 15:49 +0200, denis walker via db-wg wrote: > A: Yes the RIPE Database should allow creation of ROUTE objects for > non RIPE resources. If this is the answer then we can look at how to > make the data more trusting in the short term (and there may be ways > to do that). That one, but with a *strong* enhancement on a trust model for such objects. We just cannot simply allow non-ripe route objects to be inserted in the db without any legitimity checks. -- Clément Cavadore

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Sascha Luck [ml] 09 Oct '17

09 Oct '17

Denis, On Mon, Oct 09, 2017 at 02:49:39PM +0100, denis walker via db-wg wrote: >Question - Should the RIPE Database allow creation of ROUTE >objects for non RIPE resources? > >A: Yes the RIPE Database should allow creation of ROUTE objects >for non RIPE resources. If this is the answer then we can look >at how to make the data more trusting in the short term (and >there may be ways to do that). > >B: No the RIPE Database should not allow creation of ROUTE >objects for any non RIPE resource. If this is the answer then >maybe we need to look at a project to remove all non RIPE >resource related ROUTE(6)/AUT-NUM objects from the RIPE Database >and disable the feature. But that needs to look at what to do >with ROUTE objects for prefixes from one region and ASNs from a >different region. > >C: Just leave things as they are. Don't promote the service but >no projects to remove any data from the RIPE Database either. >Just drift along on the principle "if it ain't broken, don't fix >it". This also means document this as the answer to this >question and no more discussions. Of course any problems >associated with this feature don't go away. Either A or C, insofar as they are different. Not allowing "foreign" resources in the ripedb denies the reality that there will always be RIPE-allocated prefixes originated from non-RIPE-assigned ASNs and vice versa. One could make an argument for not allowing route: objects where both the prefix and ASN are from outside RIPE. This would complicate (or make impossible) any attempt at automating acceptance filters, unless and until this information is available from other (trusted?) sources. As it currently stands, this would, on balance, be worse for the "good of the internet". cheers, Sascha Luck

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Lu Heng 09 Oct '17

09 Oct '17

A On Mon, Oct 9, 2017 at 21:48 denis walker via db-wg <db-wg(a)ripe.net> wrote: > Colleagues > > This has been discussed many times with many views expressed. We are sure > lots of you are bored with commenting on this issue. Unfortunately no > consensus has yet been found. So we would like to take it back to the basic > question and see if we can get a conclusive answer. This is not a question > specifically about the Afrinic homing project. It's a more general question > about the RIPE Database providing this 'feature'. Even if you have > commented before, please do so once more so we can get a definitive answer > to this question. I know there is a tendency to say nothing if someone else > has made the point you support. But this time we do need numbers. So even > if what you are thinking has been said, please at least add a +1 so we know > you also agree with that point. > > Question - Should the RIPE Database allow creation of ROUTE objects for > non RIPE resources? > > We see three most likely answers to this question. Each possible answer > does have consequences. > > A: Yes the RIPE Database should allow creation of ROUTE objects for non > RIPE resources. If this is the answer then we can look at how to make the > data more trusting in the short term (and there may be ways to do that). > > B: No the RIPE Database should not allow creation of ROUTE objects for any > non RIPE resource. If this is the answer then maybe we need to look at a > project to remove all non RIPE resource related ROUTE(6)/AUT-NUM objects > from the RIPE Database and disable the feature. But that needs to look at > what to do with ROUTE objects for prefixes from one region and ASNs from a > different region. > > C: Just leave things as they are. Don't promote the service but no > projects to remove any data from the RIPE Database either. Just drift along > on the principle "if it ain't broken, don't fix it". This also means > document this as the answer to this question and no more discussions. Of > course any problems associated with this feature don't go away. > > > I will briefly review the discussions over the last 2 years: > > At the update given at RIPE 72 for the removal of the data starting with > the Afinic homing project, there was no consensus and a call for more > comments on the mailing list. A discussion continued on the mailing list > until October. There was both support and opposition to removing these > objects from the RIPE Database. One point raised during this discussion > regarding the Afrinic homing project was, "I believe that what is needed > here most of all is a clear message from both communities that it is > desirable to have the ROUTE(6) objects for AFRINIC space in the AFRINIC IRR > where the registered resource holders can properly authorise objects." No > one has yet referred to a declared consensus of opinion by the Afrinic > community to the removal of these objects from the RIPE Database. Also > during this discussion Afrinic said that they have not yet worked out all > the fine details of the proposed move of this data. Several issues were > raised on the technicalities of moving this data and it was said in the > discussion that no one has yet even done the analysis to see if any of > these conditions exist (like duplicate, but different data in both > databases). > > At the update given at RIPE 73, there was still no consensus. The RIPE NCC > and Afrinic were asked to do a check on what could go wrong and who members > could contact in the event of things going wrong. This doesn't seem to have > been done. The RIPE NCC suggested they may be able to produce a video or > webinar about the transfer. This doesn't seem to have been done either. The > call was again made that both the RIPE and Afrinic communities re-state > that they both want this project to go forward. That has not happened. It > was said that Afrinic is the first of many RIRs that may want data > transferred out of the RIPE Database. Is it the RIRs or the communities > that want this? The only question raised in the meeting was opposed to the > transfer. No discussion followed on the mailing list. > > At RIPE 74 there was no update on this issue. > > The next discussion wasn't until July 2017. In this discussion there was > mention of developing a global IRR database with a couple of supporters. We > all know such ideas often take years to be agreed on, designed and > implemented as a practical solution. We want to answer this question in > relation to the situation today. There were some pointers made back to > previous mailing list discussions, but nothing else new was said. > > cheers > denis > co-chair DB WG > -- -- Kind regards. Lu

1 0

Foreign ROUTE objects in RIPE Database - final decision?
by denis walker 09 Oct '17

09 Oct '17

Colleagues This has been discussed many times with many views expressed. We are sure lots of you are bored with commenting on this issue. Unfortunately no consensus has yet been found. So we would like to take it back to the basic question and see if we can get a conclusive answer. This is not a question specifically about the Afrinic homing project. It's a more general question about the RIPE Database providing this 'feature'. Even if you have commented before, please do so once more so we can get a definitive answer to this question. I know there is a tendency to say nothing if someone else has made the point you support. But this time we do need numbers. So even if what you are thinking has been said, please at least add a +1 so we know you also agree with that point. Question - Should the RIPE Database allow creation of ROUTE objects for non RIPE resources? We see three most likely answers to this question. Each possible answer does have consequences. A: Yes the RIPE Database should allow creation of ROUTE objects for non RIPE resources. If this is the answer then we can look at how to make the data more trusting in the short term (and there may be ways to do that). B: No the RIPE Database should not allow creation of ROUTE objects for any non RIPE resource. If this is the answer then maybe we need to look at a project to remove all non RIPE resource related ROUTE(6)/AUT-NUM objects from the RIPE Database and disable the feature. But that needs to look at what to do with ROUTE objects for prefixes from one region and ASNs from a different region. C: Just leave things as they are. Don't promote the service but no projects to remove any data from the RIPE Database either. Just drift along on the principle "if it ain't broken, don't fix it". This also means document this as the answer to this question and no more discussions. Of course any problems associated with this feature don't go away. I will briefly review the discussions over the last 2 years: At the update given at RIPE 72 for the removal of the data starting with the Afinic homing project, there was no consensus and a call for more comments on the mailing list. A discussion continued on the mailing list until October. There was both support and opposition to removing these objects from the RIPE Database. One point raised during this discussion regarding the Afrinic homing project was, "I believe that what is needed here most of all is a clear message from both communities that it is desirable to have the ROUTE(6) objects for AFRINIC space in the AFRINIC IRR where the registered resource holders can properly authorise objects." No one has yet referred to a declared consensus of opinion by the Afrinic community to the removal of these objects from the RIPE Database. Also during this discussion Afrinic said that they have not yet worked out all the fine details of the proposed move of this data. Several issues were raised on the technicalities of moving this data and it was said in the discussion that no one has yet even done the analysis to see if any of these conditions exist (like duplicate, but different data in both databases). At the update given at RIPE 73, there was still no consensus. The RIPE NCC and Afrinic were asked to do a check on what could go wrong and who members could contact in the event of things going wrong. This doesn't seem to have been done. The RIPE NCC suggested they may be able to produce a video or webinar about the transfer. This doesn't seem to have been done either. The call was again made that both the RIPE and Afrinic communities re-state that they both want this project to go forward. That has not happened. It was said that Afrinic is the first of many RIRs that may want data transferred out of the RIPE Database. Is it the RIRs or the communities that want this? The only question raised in the meeting was opposed to the transfer. No discussion followed on the mailing list. At RIPE 74 there was no update on this issue. The next discussion wasn't until July 2017. In this discussion there was mention of developing a global IRR database with a couple of supporters. We all know such ideas often take years to be agreed on, designed and implemented as a practical solution. We want to answer this question in relation to the situation today. There were some pointers made back to previous mailing list discussions, but nothing else new was said. cheers denis co-chair DB WG

1 0

Work Items, Ideas & Documentation
by Brian Nisbet 04 Oct '17

04 Oct '17

Colleagues, At RIPE74 I (foolishly?) agreed to spend a bit of time trying to come up with a proposal on how to try to better document and record the decisions made in regards to ideas or work items brought to the WG. This was especially in relation to ideas that the WG may not be enthusiastic about. There is something potentially simple (and I understand the issues even with saying that) which is just an extension of/adherence to a process that's already in place. There is already a new thread started for any NWI, but a lot of these are left hanging with no new inputs. So perhaps it's as easy as saying that the Chairs, sorry folks, need to make sure those loops are closed. They can be closed with "the Working Group did not feel the proposal should be carried forward" but maybe something more. I am sensitive to the delicate nature of some of this and I hope we could maybe put in more detail to fend off the habit of returning to the same points? If a proposal doesn't even become an NWI maybe a reference in the WG Meeting minutes is enough, or maybe a quick separate mail would be useful (and might generate conversation). I know some of this is contained in the minutes but I'm not foolish enough to believe that everyone reads them (nor am I claiming I always do). So what I'm proposing is that there is an action on the Chairs to make sure an NWI thread is closed with some type of conclusion and that other proposals are extracted from the minutes and a clear result (even if there are scant details) is recorded. I'm not sure if this deals with Denis' issues, but it seems reasonably straight forward to implement and may help. Brian -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [db-wg] violation of DB T&C by DB-WG co-chair, is it acceptable?
by Randy Bush 04 Oct '17

04 Oct '17

> I haven't seen any reply to Nick's email from either David or any of > the co-Chairs. Now maybe lots is going on in the background, but that > would seem strange. > > I find the situation concerning, but what I find even more concerning > is the complete lack of response from any of the WG Chairs. <aol> barring self correction, alternative actions seem a bit strong for the culture. but that is where it seems to be heading. sad. randy

1 0

Re: [db-wg] violation of DB T&C by DB-WG co-chair, is it acceptable?
by Brian Nisbet 03 Oct '17

03 Oct '17

Afternoon, I haven't seen any reply to Nick's email from either David or any of the co-Chairs. Now maybe lots is going on in the background, but that would seem strange. I find the situation concerning, but what I find even more concerning is the complete lack of response from any of the WG Chairs. Can I ask if there are plans to address this in any way shape or form and, if not, why not? Thanks, Brian Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 On 25/09/2017 12:51, Nick Hilliard via db-wg wrote: > It would be good if David took the opportunity to explain what he did > and how / whether it's compatible with being co-chair of DBWG. David, It's been two weeks since someone alleged that you were sending spam. Do you have any plans to address this issue? Nick

1 0

Fw: [db-wg] Fw: NWI-7: abuse-c implementation plan modification
by denis walker 03 Oct '17

03 Oct '17

Hi Tim, colleagues No one has expressed any serious concerns over this small change. I think we can safely go ahead and only send the one email notification in these cases when you change the objects. cheersdenisco-chair DB-WG ----- Forwarded Message ----- From: denis walker via db-wg <db-wg(a)ripe.net> To: Database WG <db-wg(a)ripe.net> Sent: Wednesday, 27 September 2017, 11:55 Subject: [db-wg] Fw: NWI-7: abuse-c implementation plan modification Colleagues I think the suggestion below from Tim is OK. There seems little point sending notifications to users about changes they don't need to take action on of data that is redundant. So if anyone has any strong objections please let us know by the end of this week. Otherwise we can give Tim the go ahead to this modification to the implementation plan. cheersdenisco-chair DB-WG From: Tim Bruijnzeels via db-wg <db-wg(a)ripe.net> To: "db-wg(a)ripe.net" <db-wg(a)ripe.net> Sent: Wednesday, 30 August 2017, 21:32 Subject: Re: [db-wg] NWI-7: abuse-c implementation plan Dear working group, We have a proposed timeline for the implementation. Let me quote the proposal sent out on 28 June here, and comment in-line: > 3) Clean up of “abuse-mailbox:” on PERSON (89k cases), MNTNER (2500 cases) and IRT (238 cases) > > In these cases we propose to send a warning email to the holders of these objects with the following main message: > > “The “abuse-mailbox:” is deprecated on these object and will be removed in 4 weeks, if you want to set up abuse contact information on your resource objects you can do so by having a default “abuse-c:” on your ORGANISATION referenced by your resource objects, or possibly overriding that default with a specific “abuse-c:” reference on applicable resource objects." > > And then 4 weeks later we will preform the clean-up and refer back to this communication. On further reflection we would prefer to alter the plan, and just a single clean-up of these objects on Monday 30 October as well. This way the clean-up process will be consistent across all object types. Furthermore, there is no action to be taken on these objects and “abuse-mailbox:” on these objects is ignored in the Abuse Finder. In short there does not seem to be a strong motivation for bothering the holders of these objects twice.

2 1

Re: [db-wg] Fw: NWI-7: abuse-c implementation plan modification
by Peter Hessler 27 Sep '17

27 Sep '17

My traditional response to any modification of the database: As long as a notification that the objects were modified is sent, I have no objections. On 2017 Sep 27 (Wed) at 09:56:09 +0000 (+0000), denis walker via db-wg wrote: :Date: Wed, 27 Sep 2017 09:44:42 +0000 (UTC) :From: denis walker <ripedenis(a)yahoo.co.uk> :To: Database WG <db-wg(a)ripe.net> :Subject: Fw: [db-wg] NWI-7: abuse-c implementation plan modification : :Colleagues : : :I think the suggestion below from Tim is OK. There seems little point sending notifications to users about changes they don't need to take action on of data that is redundant. So if anyone has any strong objections please let us know by the end of this week. Otherwise we can give Tim the go ahead to this modification to the implementation plan. :cheersdenisco-chair DB-WG : : From: Tim Bruijnzeels via db-wg <db-wg(a)ripe.net> : To: "db-wg(a)ripe.net" <db-wg(a)ripe.net> : Sent: Wednesday, 30 August 2017, 21:32 : Subject: Re: [db-wg] NWI-7: abuse-c implementation plan : :Dear working group, : :We have a proposed timeline for the implementation. Let me quote the proposal sent out on 28 June here, and comment in-line: : : :> 3) Clean up of “abuse-mailbox:” on PERSON (89k cases), MNTNER (2500 cases) and IRT (238 cases) :> :> In these cases we propose to send a warning email to the holders of these objects with the following main message: :> :> “The “abuse-mailbox:” is deprecated on these object and will be removed in 4 weeks, if you want to set up abuse contact information on your resource objects you can do so by having a default “abuse-c:” on your ORGANISATION referenced by your resource objects, or possibly overriding that default with a specific “abuse-c:” reference on applicable resource objects." :> :> And then 4 weeks later we will preform the clean-up and refer back to this communication. : :On further reflection we would prefer to alter the plan, and just a single clean-up of these objects on Monday 30 October as well. This way the clean-up process will be consistent across all object types. Furthermore, there is no action to be taken on these objects and “abuse-mailbox:” on these objects is ignored in the Abuse Finder. In short there does not seem to be a strong motivation for bothering the holders of these objects twice. :

1 0