- ncc-services-wg - mailman.ripe.net

Outage Report for RIPE Database Updates
by Agoston Horvath 22 Oct '10

22 Oct '10

[Apologies for duplicates] Dear colleagues, Between approximately 11:50 and 12:20 (UTC), 21 October 2010, we experienced an outage on the web server www.db.ripe.net. During this period it was not possible to connect to the syncupdates or webupdates services or use whois.cgi (the web-based GUI for whois queries). Services not depending on the HTTP protocol (whois queries, mailupdates) were not affected. We apologise for any inconvenience that this may have caused. Regards, Agoston Horvath Database Group RIPE NCC

1 0

personal data in the NCC
by Sergey Myasoedov 21 Oct '10

21 Oct '10

Hello, I would like to talk about personal data protection. After the audit process, NCC demands that we send them, together with the contract, the ID of person who signs the End User assignment contract (even if the contract is signed by a person on behalf of company). It seems strange: the CEO of company that wants IP resources signs the contract, probably stamps it and suddenly (!) RIPE NCC asks for the ID of CEO. We (LIR) have no choice on such operations - we should request ID or RIPE NCC will not assign resources for our customers. Even more, RIPE NCC requires scans of ID, and this action violates local laws in some countries (for example, CZ or RU). In Russia, personal data can be processed only after a special agreement (except some cases mentioned in the law), but we will send the ID images without any special agreements to the NCC. I tried to find some statements on data protection in the RIPE NCC or on any guarantee of confidentiality, but no such information found in the standard service agreement or any policy documents. On these grounds, I would like to initiate a change. RIPE NCC should have data protection procedures or RIPE NCC should not request personal IDs of third parties. -- Sergey

14 33

Optimize to be new LIR progress
by Shahin Gharghi 21 Oct '10

21 Oct '10

Dear Ripe NCC I am a LIR maintainer. I have a suggestion for you. would you make a checklist for peoples who are new to ripe and LIR? I mean make a checklist for all steps to be a LIR. from A to Z for example: 1. fill the First form <LINK> 2. receive a mail <when> 3. sign the papers 4. ... 5. ... 6. request a PA - by email: <sample form> - by webupdate <sample form> - by wizard <sample form> 20. ... 21. set the IPs on your machines I guess its better to understand for newbies. because they can see all of steps at first. and second suggestion: you can choose self candidate from old LIRs. and put their contact details on your website. and new users can talk to him in native language. It's allow users to exchange their experiences together. Thank you. -- Best Regards. Shahin Gharghi www.PersianAdmins.com www.Gharghi.ir Cell : +98 917 3009177

5 5

Re: Optimize to be new LIR progress (Shahin Gharghi)
by Shahin Gharghi 20 Oct '10

20 Oct '10

> Message: 5 > Date: Wed, 20 Oct 2010 11:25:35 +0200 > From: Sergey Myasoedov <sergey(a)devnull.ru> > To: ncc-services-wg(a)ripe.net > Subject: [ncc-services-wg] personal data in the NCC > > Hello, > > I would like to talk about personal data protection. After the audit proc= > ess, NCC demands > that we send them, together with the contract, the ID of person who signs= > the End User > assignment contract (even if the contract is signed by a person on behalf= > of company). > > It seems strange: the CEO of company that wants IP resources signs the co= > ntract, probably > stamps it and suddenly (!) RIPE NCC asks for the ID of CEO. We (LIR) have= > no choice on such > operations - we should request ID or RIPE NCC will not assign resources f= > or our customers. > > Even more, RIPE NCC requires scans of ID, and this action violates local = > laws in some > countries (for example, CZ or RU). In Russia, personal data can be proces= > sed only after a > special agreement (except some cases mentioned in the law), but we will s= > end the ID images > without any special agreements to the NCC. > > I tried to find some statements on data protection in the RIPE NCC or on = > any guarantee of > confidentiality, but no such information found in the standard service ag= > reement or any > policy documents. > > On these grounds, I would like to initiate a change. RIPE NCC should have= > data protection > procedures or RIPE NCC should not request personal IDs of third parties. > > > -- > Sergey > > > > > End of ncc-services-wg Digest > Hello I don't said to put all of private information of all LIRs on the web. I just mean there is some LIR maintainer in all cities that knows RIPE rules well. Some of them are free and they can answer the newbies questions in local language and condition. Thank you -- Best Regards. Shahin Gharghi www.PersianAdmins.com www.Gharghi.ir Cell : +98 917 3009177

1 0

New Resource Certification
by Mirjam Kuehne 15 Oct '10

15 Oct '10

[Apologies for duplicate emails] Dear colleagues, We just announced a new release of the RIPE NCC Resource Certification system. We are gearing up for the production release on 1 January 2011 and have implemented some critical changes and new features. Please find more details on RIPE Labs: http://labs.ripe.net/Members/AlexBand/new-release-of-the-resource-certifica… If you have any comments or questions, please do not hesitate to leave them under the article. Kind Regards, Mirjam Kuehne RIPE Labs

1 0

Mandatory maintainer on PERSON and ROLE objects
by Denis Walker 13 Oct '10

13 Oct '10

[Apologies for duplicate emails] Dear Colleagues Some time ago, the RIPE Data Protection Task Force recommended that all RIPE Database objects should have a mandatory "mnt-by:" attribute. This is to prevent easy corruption of data, either accidentally or maliciously. There were three object types where this attribute was optional. DOMAIN objects have already been changed to make this attribute mandatory. The RIPE NCC is now ready to deploy mandatory "mnt-by:" attributes on PERSON and ROLE objects. A test server was made available in February with this feature. Details can be found in the mail archive at: http://www.ripe.net/ripe/maillists/archives/db-wg/2010/msg00084.html This feature will be deployed during the week commencing 18 October 2010. Initially, the only impact on maintainers of data in the RIPE Database will be when PERSON or ROLE objects are created or modified. These operations will fail if the data is not maintained. Additional warning messages will be generated when other objects are modified that reference unmaintained data. These warnings will not cause any database operations to fail. For new users of the RIPE Database, there is a start-up application to create the first pair of PERSON/MNTNER objects available at: http://apps.db.ripe.net/startup/ This is now the only way to create the first set of data objects in the RIPE Database. Note the URL is different to the one in the mail archive message above. Regards Denis Walker Business Analyst RIPE NCC Database Group

1 0

Active Measurements Network - Call for Sponsors
by Mirjam Kuehne 11 Oct '10

11 Oct '10

[Apologies for duplicate emails] Dear colleagues, The next article in the Active Measurements series has been published on RIPE Labs: Wanted: Partners to Sponsor "RIPE Atlas" Effort http://labs.ripe.net/Members/dfk/active-measurements-sponsorship It describes sponsorship benefits, but also some more details about the measurement network, including a time line. Please also note the three related articles published earlier: - Active Measurements Need More Vantage Points https://labs.ripe.net/Members/dfk/active-measurements-need-more-vantage-poi… - Active Measurements - A Small Probe https://labs.ripe.net/Members/dfk/a-small-probe-for-active-measurements?sea… - Active Measurements - Hosting a Probe https://labs.ripe.net/Members/dfk/active_measurements/hosting-a-probe-for-a… Kind Regards, Mirjam Kuehne https://labs.ripe.net

1 0

Call For Agenda Items RIPE 61
by Bijal Sanghani 06 Oct '10

06 Oct '10

Dear NCC-Services WG, RIPE 61 in Rome is approaching fast and we are looking at putting the agenda together for the NCC Services WG. This is your opportunity to let the RIPE NCC know what you want from them, if you would like to suggest a presentation or raise a topic for discussion please let me know. Kind regards, Bijal Sanghani RIPE NCC Services WG Co-Chair The information contained in this e-mail message is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient, you should return it to the sender immediately. Please note that while we scan all e-mails for viruses we cannot guarantee that any e-mail is virus-free and accept no liability for any damage caused by any virus transmitted by this email.

1 0

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Owen DeLong 05 Oct '10

05 Oct '10

> >> I'll go a step further and say that the resource holder should be >> the ONLY holder of the private key for their resources. >> >> Owen > > If you're saying that ISPs can only participate in an RPKI scheme if they > run their own Certificate Authority, then I think that would practically > ruin the chances of Certification actually ever taking off on a large > scale. > > -Alex No... I'm saying that if ISPs aren't the only entities that hold their private keys, then they aren't the only entities that can sign their resources. If you choose to delegate the CA role for signing your resources to someone else, then, obviously, you have to give them a valid private key with which to sign those resources. However, in doing that, you've created a situation where your signature is now much easier to forge. Kind of like automatic signing machines for checks. Benefit: The accounting department can sign thousands of checks and the CFO doesn't have to. Draw-back... The accounting department can sign thousands of checks without the CFO knowing they did so. Owen

4 5

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Alex Band 04 Oct '10

04 Oct '10

On Mon, October 4, 2010 04:38, Owen DeLong wrote: > > On Oct 3, 2010, at 7:26 PM, Randy Bush wrote: > >>> Do you think there is value in creating a system like this? >> >> yes. though, given issues of errors and deliberate falsifications, i am >> not entirely comfortable with the whois/bgp combo being considered >> formally authoritative. but we have to do something. But blindly considering whois/BGP authoritative is not what I am proposing. I want to confront the network operator with what is registered in the IRR and what is seen in BGP, and let the human element make decisions and corrections, improving data quality in the process. >>> Are there any glaring holes that I missed >> >> yes. the operator should be able to hold the private key to their >> certificate(s) or the meaning of 'private key' and the security >> structure of the [ripe part of the] rpki is a broken. >> >> randy In the hosted implementation the RIPE NCC currently has, only a registered contact for an LIR with whom we have a business relationship has access to the secured LIR Portal in which the Certification system is embedded. The reason to offer a hosted system initially, is to take away the burden from an LIR of having to run their own Certificate Authority. We offer a service that makes the entry barrier for Certification as low as possible. Properly running your own CA, with all the crypto aspects, is no small feat for a lot of LIRs (technically, but perhaps more psychologically). You may argue that it's easy and cheap to do yourself, but just look at adoption rates and levels of IPv6 and DNSSEC *at an LIR level* to see what reality is like. After the production launch on 1 January 2011, the next step we will take is to implement the up/down protocol, allowing people to run their own Certificate Authority if they choose to do so. We plan to roll this out in the first half of 2011. We'll go one step further by having our software certified by an external independent company, and releasing it as open source to the Community, so they can be sure they adopt a robust system if they choose our package. So in the end our implementation is not 'broken' as you say, it is in he middle of a planned, phased approach. Not everything is possible yet and that is a deliberate decision. > I'll go a step further and say that the resource holder should be > the ONLY holder of the private key for their resources. > > Owen If you're saying that ISPs can only participate in an RPKI scheme if they run their own Certificate Authority, then I think that would practically ruin the chances of Certification actually ever taking off on a large scale. -Alex

1 0