Hi all, Wilfried asked me to forward this to the list, so here goes :-) 10x, Sincerely, \'"'/ Barak Engel ( o o ) ---------------------ooOO-^-oOOo--------------------------- barak@netvision.net.il Network Expert BE-RIPE BE174 Phone/Fax: +972 48 560600/551132 Cellular: +972 50 469 341 ----------------------------------------------------------- -----Original Message----- From: Barak Engel [mailto:barak@netvision.net.il] Sent: Tuesday, January 05, 1999 6:10 PM To: Wilfried Woeber, UniVie/ACOnet Subject: RE: Database security Wilfried hi, Many 10x. As I didnt see that this went to the list, Im not mailing my answer to the list too. See my comments in the text body. Barak

-----Original Message----- From: Wilfried Woeber, UniVie/ACOnet [mailto:woeber@cc.univie.ac.at] Sent: Tuesday, January 05, 1999 5:12 PM Subject: RE: Database security

First of all I'd like to start out by confirming, IMHO, the usefulness of this sort of on-line discussion.

Next, in order to balance what I'm going to add as my comments further downstream, I'd like to assure you that I *do* understand your concerns.

And on top of that, it might be useful to include the Local-IR WG...

Sorry :-) IL-NETVISION

=> Lets discuss, what measures should be taken to circumvent the situation you describe. => I can see the problem from two different point of views: => => 1) Yours. Then we have to close the database down, to a bare => documentation-tool for IP-Nets, accessible only by the registries. = = Thats not what I said. For example, the DB could only hide specific fields =behind a password. For example, the "descr" field which gives away the company =name.

There's two basic problems with that:

. I don't expect any agreement (soon) as to *which* fields should be hidden. We've been through that one recently - and painfully :-(

Alright, as I said, I wasnt here... sorry if its an old wound.

All of the fields have been invented and defined because there was a community consensus about the usefulness of that sort of *public* information. If we can identify attributes which we do not need any longer, let's scrap them rather sooner than later :-)

Agreed.

. The DB is not used by the operations folks exclusively, but also by the LIRs, I suppose, e.g. to cross-check the more complex IP-Address requests. Hiding descr: attributes would severly impede that possibility...

Hmm... well, this sort of functionality could be preserved by adding a new field, or doing the searches by netname instead of descr. I guess.

On a more general level, restricting access to "registries" doesn't get you anywhere. Re-living the scenary you describe, the new "nasty" new-comer would simply arrange for a service contract with the NCC, and off we go. The cost: according to ripe-188, it's 2.650,- + 2.100,- ECU. That sounds like a bargain. And doing so gives them access to pre-paid education by the NCC staff about the use of the DB ;-)

True. But this may require more knowlegde and research, and therefore might be missed by some. In any case, it is possible to restrict each object by password (i.e. add password field or whatever), which will solve this problem.

As long as I've been following the IANA/ICANN stuff recently, or have read some of the IETF drafts (rps-auth, rps-dist, amongst others), there's really no bottom to that pit we're supposed to dig...

Yes, I guess thats true... Im just trying to point everyone's attention to this issue, TBH. I dont have any magical solutions short of descussing the whole DB structure.

=> 2) Mine. I need the database to track technical problems and people who are =able to solve them. (hopefully, this view is shared by most of the people here =;)) = = Including myself. But on the other hand, there is a problem here which, I feel, =needs to be addressed. The database structure was implemented in times when the =Internet was not so business oriented as it is today. I think that it may need =some rethinking to fit the times, so to speak :-)

I fully agree with you that a fair amount of re-thinking is required during the immediate future. In particular about the usefulness of attempts to implement rules, BCPs, code of conduct and regulations by spending programming resources. It's not going to buy us anything.

=> The security mechanism, which is in place, is not technical, it is just =organisational. There is a copyright on the database. The uses, you describe, =are forbidden by this copyright. => => If someone violates this copyright, at least in Germany there are other =measures to forbid such a use of the database. = = Well, lucky for you in Germany :-) = Seriously, though, there is no way in which you could actually prove, in court, =the sort of thing I describe. I am talking from personal experience... *sigh*

Well... I suppose in many, if not most regions, there is *quite a lot* of interesting data accessible to the "public", which does indeed have commercial value.

For example in our old little country, it's access to

- a comrehensive register of real estate ownership (and the debts secured by that!),

- the official place of residence for an individual,

- an official registry for companies (including management strucure and directors,...) and for assocations,

- car ownership and license plates,

- phone books (and eventually we've got PNO regulation going!)

on and on... I could come up with zillions of good ideas to make use of that data.

And indeed some people do. Some of these attempts are legal, some others are frowned upon, the rest is illegal and triggers prosecution. This is real life.

Well, this is again true... but if we could find some ways to close the bigger loopholes, we may achieve most of what I feel we should be looking for.

I think we have to spend more effort in the future to work on the legal and social aspects, instead of on setting up technical "filters"....

Any arguments to the contrary appreciated!

Regards, Wilfried (DB-WG chair)

PS: Still the best way for keeping customers is offering "the" better service, whatever that is :-)

-------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber@CC.UniVie.ac.at Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Vienna University : Fax: +43 1 4277 - 9 140 Universitaetsstrasse 7 : RIPE-DB (&NIC) Handle: WW144 A-1010 Vienna, Austria, Europe : PGP public key ID 0xF0ACB369 --------------------------------------------------------------------------