2012-08 Discussion Period extended until 1 March 2013 (Publication of Sponsoring LIR for Independent Number Resources)
Dear Colleagues, The Discussion Period for the proposal 2012-08, "Publication of Sponsoring LIR for Independent Number Resources", has been extended until 1 March 2013. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2012-08 We encourage you to review this policy proposal and send your comments to <ncc-services-wg@ripe.net>. Regards, Emilio Madaio Policy Development Officer RIPE NCC
The Discussion Period for the proposal 2012-08, "Publication of Sponsoring LIR for Independent Number Resources", has been extended until 1 March 2013.
the proposal lists three supporting arguments:
This mechanism provides a simple means for End Users to identify with which sponsoring organisation they have a contractual link, in the case this information is unknown to the End User.
This appears overly artificial to me: why would an End User not know who they contracted with and why is a public listing of this information the appropriate cure? I do not buy this argument.
This policy simplifies the mechanism for verification and co-ordination between sponsoring organisations when an End User wishes to transfer resources from one sponsoring organisation to another.
This is a derivative of the first argument, even though it does not state the nature of the envisioned 'verification and co-ordination'. It is the End User's job to make available, where necessary, the supporting documentation. I do not buy this argument.
Publishing this information provides an additional means for tackling abuse issues on the Internet.
So, "if all else fails", we claim it will help fighting "abuse"? What is the underlying expectation here? Is a 'sponsoring LIR' in any way responsible for traffic generated (or sunk) at the 'sponsored' address space? I cannot buy this argument. Since the proposal does not list any valid supporting argument, I am opposed. -Peter
On Mon, 25 Feb 2013, Peter Koch wrote:
The Discussion Period for the proposal 2012-08, "Publication of Sponsoring LIR for Independent Number Resources", has been extended until 1 March 2013.
the proposal lists three supporting arguments:
This mechanism provides a simple means for End Users to identify with which sponsoring organisation they have a contractual link, in the case this information is unknown to the End User.
This appears overly artificial to me: why would an End User not know who they contracted with and why is a public listing of this information the appropriate cure? I do not buy this argument.
Well, you seem to be missing the point here. It is by no means artificial. We see it quite often. And the answer is that the sponsorships is rather an entry in some hidden RIPE db than a contract. When an end user is asked "Do you have a sponsoring LIR for this resource and if so, who is it?", the answer is usuallu "We have no idea". And the only way to be certain is to send an email to the RIPE hostmasters.
This policy simplifies the mechanism for verification and co-ordination between sponsoring organisations when an End User wishes to transfer resources from one sponsoring organisation to another.
This is a derivative of the first argument, even though it does not state the nature of the envisioned 'verification and co-ordination'. It is the End User's job to make available, where necessary, the supporting documentation. I do not buy this argument.
Let's say you do have the documents in the first situation. How do you know they are still valid? Yes, we used to be sponsor for this resource but how do we know that in RIPE:s point of view, we still are?
Publishing this information provides an additional means for tackling abuse issues on the Internet.
So, "if all else fails", we claim it will help fighting "abuse"? What is the underlying expectation here? Is a 'sponsoring LIR' in any way responsible for traffic generated (or sunk) at the 'sponsored' address space? I cannot buy this argument.
Since the proposal does not list any valid supporting argument, I am opposed.
-Peter
I am in favour. Regards, Daniel Stolpe _________________________________________________________________________________ Daniel Stolpe Tel: 08 - 688 11 81 stolpe@resilans.se Resilans AB Fax: 08 - 55 00 21 63 http://www.resilans.se/ Box 13 054 556741-1193 103 02 Stockholm
We see it quite often. And the answer is that the sponsorships is rather an entry in some hidden RIPE db than a contract. When an end user is asked "Do you have a sponsoring LIR for this resource and if so, who is it?", the answer is usuallu " We have no idea". And the only way to be certain is to send an email to
Hi Daniel, the RIPE hostmasters. If you don't know, check the LIR Portal to see the registered PI spaces you hold there. For the customer, there is no requirement (if they really don't know.. ) and not get an invoice from some LIR, so it is very easy to just transfer the resources to another LIR and that way you are both sure ...
Let's say you do have the documents in the first situation. How do you know they are still valid? Yes, we used to be sponsor for this resource but how do we know that in RIPE:s point of view, we still are?
Again, check the LIR portal for the registered PI resources under your LIR account. If there are company changes for the registered resources, inform the RIPE NCC that that is the case, send them the old info and the new info and if needed you will be requested additional paperwork of information. Typically, it is a 10 minute fix for a contact or address change. That is what it means to be a LIR, too many people see being an LIR as a way to get resources for themselves. We have customers that we provide RIPE Administration services for, they are an LIR themselves, but stay away from the actual administration or registration part. If an End-Customer wants a more formal registration service instead of a 'sponsoring LIR, could you do me a favor' kind of service, you should transfer the resources of that customer to your LIR within a blink of an eye ... Don't you think ? Publishing the information who the registration LIR is, doesn't fix the fact that information might not be correct. Go through the process of a PI transfer as an actual LIR and then decide if this is still something that is required. Regards, Erik Bais
On Mon, 25 Feb 2013, Erik Bais wrote:
Hi Daniel,
We see it quite often. And the answer is that the sponsorships is rather an entry in some hidden RIPE db than a contract. When an end user is asked "Do you have a sponsoring LIR for this resource and if so, who is it?", the answer is usuallu " We have no idea". And the only way to be certain is to send an email to the RIPE hostmasters.
If you don't know, check the LIR Portal to see the registered PI spaces you hold there.
Well, not if it's legacy space, apparently. But it is an improvement that at least RIPE space is visable there now. As far as I can recall that wat not the case not very long ago. If you could really see everything via the LIR portal, then I agree the need for publication would be much smaller. Regards, Daniel Stolpe _________________________________________________________________________________ Daniel Stolpe Tel: 08 - 688 11 81 stolpe@resilans.se Resilans AB Fax: 08 - 55 00 21 63 http://www.resilans.se/ Box 13 054 556741-1193 103 02 Stockholm
Hi Daniel, On Mon, Feb 25, 2013 at 02:56:53PM +0100, Daniel Stolpe wrote:
contract. When an end user is asked "Do you have a sponsoring LIR for this resource and if so, who is it?", the answer is usuallu "We have no idea". And the only way to be certain is to send an email to the RIPE hostmasters.
So send them an email.
Let's say you do have the documents in the first situation. How do you know they are still valid? Yes, we used to be sponsor for this resource but how do we know that in RIPE:s point of view, we still are?
It'll be in your LIRportal account under "Independent resources". And a 50 Euro item on your bill (although, IIRC, that isn't broken down by resource) cheers, Sascha Luck
Peter makes some very good points here. If the End User doesn't know who their Sponsoring LIR is, there is nothing keeping them from transferring the resource to another LIR. You would be surprised how may LIR's are sponsoring PI space without any contract or charge to their customers of 8 years ago ... and those LIR's still keep paying the bill to RIPE. Last year I cleaned up an LIR of 25+ PI resources of former customers. If the LIR themselves is unaware of the situation or simply don't care and the customer never receives any invoice for resources. Who are we to decide to publish this information. The last argument, that it would make abuse easier ... /sigh. Being a sponsoring LIR has nothing to do with abuse management. Being an LIR has nothing to do with having a network or route packets. Being / running an LIR doesn't mean you have your own network .. nor does it say that you are an ISP .. or a hoster. You are running a resource registration office. Yes we register PI space for end-users, even if they are not consuming our network services. We charge end-users for that service, we provide RIPE with all the required paperwork and handle the PI request, but if someone is routing some "bad" packets on the IP's we registered for them in the past, why would it help abuse if someone knows who registered the PI space in the first place? It is not that we can put a null-route for the IP's or 'drop the BGP announcement' as they are not in our network. Perhaps the name 'Sponsoring LIR' is a bit tricky as it might give the impression it is for free. But registration of resources (PI space, AS numbers etc) is just like any other kind of registration services, it takes time to provide the service and we charge for the time. So, perhaps a bit longer story than what Peter said, but the result it the same. Not in favor for this policy. Regards, Erik Bais A2B Internet
Peter, Erik, The main reason for this policy proposal is to ensure transparency throughout the RIR-LIR-End User chain - one of the core principles of the RIPE community. It's a core principle because transparency creates the conditions where trust can arise, and the RIPE community requires trust to function. Conversely, lack of transparency creates an environment where people are left wondering, and this engenders mistrust. We need trust because we are asking a bureaucracy (the RIPE NCC) to manage a monopoly (number resources), and we know from overwhelming third party experience that enforcement of transparency is one of the only ways to ensure that a bureaucracy a) maintains the trust of its constituents and b) is forced and is seen to act in a way which is consistent with its own principals. We have very good transparency on what address space is assigned or allocated to whom (all of which provides information on existing contractual relationships) and the RIPE community agrees that this is a good thing. Not only do we have it, but we also agree as a community that this is valuable enough that we ask the RIPE NCC to conduct periodic audits to ensure that the data is accurate - without which the transparency would be useless. We already have the precedent to tell us that transparency is the right thing to do as a policy objective because we implicitly have this information for every other resource allocation type. This policy is an acknowledgement of this position. Nick
Hi Nick, On Mon, Feb 25, 2013 at 03:18:44PM +0000, Nick Hilliard wrote:
We need trust because we are asking a bureaucracy (the RIPE NCC) to manage a monopoly (number resources), and we know from overwhelming third party experience that enforcement of transparency is one of the only ways to ensure that a bureaucracy a) maintains the trust of its constituents and b) is forced and is seen to act in a way which is consistent with its own principals.
Other recent proposals have also implied a need for more oversight of the NCC. I don't know whether this is an indication that the community no longer trusts the NCC but, as a member, I emphatically do not want "oversight" by anyone who can operate a browser or whois client.
We have very good transparency on what address space is assigned or allocated to whom (all of which provides information on existing contractual relationships) and the RIPE community agrees that this is a good thing.
I, for one, do *not* agree with any right to privacy or anonymity being sacrificed on the high altar of "Transparency". I would even propose a roll-back of much of the existing open access to registration data, and be it only in the way that those seeking access must be known to the NCC as the data holder. That is, however, a discussion for a different day. rgds, Sascha Luck
On 25/02/2013 16:13, Sascha Luck wrote:
sacrificed on the high altar of "Transparency". I would even propose a roll-back of much of the existing open access to registration data, and be it only in the way that those seeking access must be known to the NCC as the data holder.
Sorry to hear this. Let's agree to disagree then. Nick
participants (6)
-
Daniel Stolpe -
Emilio Madaio -
Erik Bais -
Nick Hilliard -
Peter Koch -
Sascha Luck