November 1996 - ripe-list - mailman.ripe.net

SIRCE - again (this is the intended text of my reflection...)
by Lajos Balint 28 Nov '96

28 Nov '96

Dear Daniel, By reflecting your Wed, 27 Nov 1996 16:27:38 +0100 e-mail, let me first emphasize that my original message didn't aim at hurting anybody. It was a trial of explaining the situation (i.e. the relatively low level of commitments) and also our own hesitation until now. If I try to reflect your reaction, I have to further explain what I wrote yesterday, and here I'm in a really uncomfortable situation. While I don't want to be impolite, and I try to avoid offending you, I'm forced to go into some more details. What I wanted to point out in my yesterday message was that the situation was more complex than it might have turned out of the exchange of messages about commitments. What I felt in the recent period of time was that ISPs were repeatedly urged to make their commitments so that they even could feel blamed by not doing so. Let me begin with repeating my last sentence of my previous message: I hope that the problem is not overall lack of interest in European CERT coordination but just a result of the still open situation about the CERT coordination issue, in general. Namely: RIPE NCC started to collect commitments before TERENA made a decision. And, although RIPE-149 and TIPE-150 did talk about TERENA's intent, RIPE NCC did behave during the last weeks like suggesting that the ISP's had to make a decision about your plan. I have to stress that RIPE NCC is always excellent in doing its job but, probably (and by my sincere belief) with the honest will, in this case did forget to take into consideration all the rules of the game. I try to understand your reaction to my earlier message (and the conduct how you handle the CERT coordination matter) but I mustn't forget the interests of the service providers. And I also should keep in mind the other potential CERT coordinators, too. The service providers need the best coordination service, so their interest is to wait until the (hopefully most advantageous) decision by TERENA is made. On the other hand, the potential CERT coordinators are well behaving if they wait until TERERNA decides about their proposals, and organization of CERT coordination is to be started by the selected one, as soon as the decision is made. You are right: documents RIPE-149 and RIPE-150 are, as I emphasized in my first message, well describing all the details. Of course, if I did speak about "misleading", I didn't think of an intentional thing. The problem is with what followed: the forceful activity toward collecting commitments. This was really a disturbing process: readers of your messages could feel uncomfortable by not committing. And this is what I called misleading (sorry for the wording, probably by a better knowledge of English I could have found a more appropriate expression): if I feel a pressure to do something without real reasons of doing that, I'm mislead by being bombarded. If you don't agree with my above thoughts, it is understandable. Your goal was (is) to get support and you did think that the way you selected was the appropriate one. Maybe there are some ISPs (ISP representatives) being happy with the way you choose. However, I guess, I'm not alone with my feelings about the situation. Originally I didn't want to send my previous message by going into details of the process. I simply wanted to inform you yesterday (the deadline) just about HUNGARNET's interest in the CERT coordination project, by adding that if the RIPE NCC would be selected, HUNGARNET would be ready to commit ECU 500. However, in the last minute there was your reaction to Petter's message which I didn't want to leave without comments. Although Petter himself didn't react your reflection, somebody had to react in favour of him. He was correct with all of his words. But the reaction he did get was not the most appropriate one: it didn't reflect Petter's message about not committing before TERENA's decision but did, by a certain way, criticise his behaviour. Just what I tried to point out above about RIPE NCC's pressurizing manner in this matter. Moreover, your wording had a certain kind of prejudice, a kind of assuming something fishy about the CERT TAG, which is more than impolite from you. That's why I tried to go into details about the full process and not just about HUNGARNET's conditional commitment. Of course, I didn't want to generate a controversy but only wanted to draw the attention of all interested parties to another side of the coin. Fraankly saying, I'm sorry for this debate. I admire RIPE NCC and especially you for your excellent work in general. I'm also sure that if finally the RIPE NCC will be selected by TERENA for European CERT coordination, the task will be performed by a similarly high quality and enthusiasm. (Which doesn't mean any qualification of the other candidates.) Moreover, if the RIPE NCC will be the winner, HUNGARNET will fully support your CERT coordination activity, too. But even so, I mustn't hide the truth (at least by my feelings). Again I emphasize: without the intention of hurting anybody, but just for helping. I hope that also you, Daniel, have a more fragmented picture now of the situation, even if you possibly don't agree with all the details of my arguments. Let me finish again by my sincere words: Regards and best wishes (to you and to the RIPE NCC, too), Lajos P.s.: I would be glad not to continue with this debate. I admit that the RIPE NCC did prepare a set of attractive documents. I admit that, if selected by TERENA, RIPE NCC would surely be an excellent CERT coordinator. I emphasize again that HUNGARNET is interested in European CERT coordination and is ready to commit to the prospective coordinator to be selected by TERENA (either the RIPE NCC or any other organization). I'm ready to admit that my wording about "misleading" was not the fortunate one. On the other hand, I stress that advance collecting of commitments and especially the manner of the process are not fully agreeable. And I stress again that your reflection to Petter's message wasn't the fortunate one. I hope that you are satisfied with this summary, and I'm in favour of stopping further arguing. --- I wanted to launch this message yesterday evening but - the devil never sleeps - unfortunately I launched again my previous text, as I realized this morning. Sorry for that. I also had to re-type my message because I did delete it unintentionally :-( Let me add that in the meantime I have read your message about Questionnaire Clarifications which is of course an agreeable continuation of the on-going process.

1 0

SIRCE - again
by Lajos Balint 27 Nov '96

27 Nov '96

Dear Daniel, I have studied all the SIRCE-related materials (at least I think that all of them did reach me): - your Tue, 05 Nov 1996 13:23:44 +0100 message - the RIPE-149 document - the RIPE-150 document - your Thu, 14 Nov 1996 16:36:22 +0100 message - your reports about the collected commitments - RIPE NCC Feedback Dept's Tue, 26 Nov 1996 16:52:09 +0100 message - Petter Kongshaug's message of Wed, 27 Nov 1996 07:28:51 +0100 - your Wed, 27 Nov 1996 09:27:30 +0100 message reflecting Petter's one I'm a bit disturbed by the full process. On one hand, the RIPE NCC did prepare a well elaborated project plan (as it is common with any RIPE NCC activities). However, on the other hand, nothing was mentioned about the background situation which Petter is talking about. While potential supporters are well informed about the plans of the RIPE NCC, they are mislead by the presentation: most of them even don't know about the full picture. An only note is touching the question in its entirety, namely by your Thu, 14 Nov 1996 16:36:22 +0100 message: > Q: Am I bound to my commitment if TERENA decides to execute SIRCE > differently than proposed in ripe-150? > > A: No. The commitment is specifically for the project proposed in > ripe-150. If a different proposal is preferred by TERENA, we will > provide information about it and it is up to you to decide whether you > want to get involved. While I express the interest of HUNGARNET in a Europe-wide CERT coordination, I have to emphasize that I fully support Petter's view: > TERENA has set up a CERT TAG to evaluate candidates for a European > CERT. UNINETT ... wait to see the prefered candidate, and > do not want to conclude on CIRCE before the evaluation is done. (I did intentionally omit that part of Petter's message saying that > ... UNINETT is part of this TAG ... because this fact is irrelevant regarding UNINETT's intentions but underlines only the fact that an ISP, being fortunate enough to know about the background situation, doesn't want to make any commitment before TERENA evaluates the candidates, including the RIPE NCC.) In view of the above comments, let me express HUNGARNET's intention to subscribe the prospective European CERT coordination. If the selected coordinator will be the RIPE NCC (in the frameworks of the planned SIRCE project), HUNGARNET will be ready to commit ECU 500. If the selected coordinator will be a different organization, HUNGARNET will probably join the CERT coordination activity selected by TERENA. In addition, let me mention that Petter's message was correct with respect to the questionnaire, too: > Sorry for not using your form, but i did not find any suitable statements. A suitable statement could have been eg. %STJ We wait for a decision made by TERENA about European CERT coordination. (or something similar). Without such an option, Petter couldn't find any suitable statement, indeed, because only this kind of statement could express suitably why UNINETT didn't commit to SIRCE before your deadline. Finally, I don't know why the amount of commitments is relatively low. If ISPs didn't react because they share Petter's view (and mine, too), that's ok. If the reason is lack of interest in CERT coordination, in general, that's worse. Hopefully at the end, a really Europe-wide coverage of CERT coordination will be achieved - either by SIRCE or by some other project. Regards and best wishes, Lajos

1 0

SIRCE
by Lajos Balint 27 Nov '96

27 Nov '96

Dear Daniel, I have studied all the SIRCE-related materials (at least I think that all of them did reach me): - your Tue, 05 Nov 1996 13:23:44 +0100 message - the RIPE-149 document - the RIPE-150 document - your Thu, 14 Nov 1996 16:36:22 +0100 message - your reports about the collected commitments - RIPE NCC Feedback Dept's Tue, 26 Nov 1996 16:52:09 +0100 message - Petter Kongshaug's message of Wed, 27 Nov 1996 07:28:51 +0100 - your Wed, 27 Nov 1996 09:27:30 +0100 message reflecting Petter's one I'm a bit disturbed by the full process. On one hand, the RIPE NCC did prepare a well elaborated project plan (as it is common with any RIPE NCC activities). However, on the other hand, nothing was mentioned about the background situation which Petter is talking about. While potential supporters are well informed about the plans of the RIPE NCC, they are mislead by the presentation: most of them even don't know about the full picture. An only note is touching the question in its entirety, namely by your Thu, 14 Nov 1996 16:36:22 +0100 message: > Q: Am I bound to my commitment if TERENA decides to execute SIRCE > differently than proposed in ripe-150? > > A: No. The commitment is specifically for the project proposed in > ripe-150. If a different proposal is preferred by TERENA, we will > provide information about it and it is up to you to decide whether you > want to get involved. While I express the interest of HUNGARNET in a Europe-wide CERT coordination, I have to emphasize that I fully support Petter's view: > TERENA has set up a CERT TAG to evaluate candidates for a European > CERT. UNINETT ... wait to see the prefered candidate, and > do not want to conclude on CIRCE before the evaluation is done. (I did intentionally omit that part of Petter's message saying that > ... UNINETT is part of this TAG ... because this fact is irrelevant regarding UNINETT's intentions but underlines only the fact that an ISP, being fortunate enough to know about the background situation, doesn't want to make any commitment before TERENA evaluates the candidates, including the RIPE NCC.) In view of the above comments, let me express HUNGARNET's intention to subscribe the prospective European CERT coordination. If the selected coordinator will be the RIPE NCC (in the frameworks of the planned SIRCE project), HUNGARNET will be ready to commit ECU 500. If the selected coordinator will be a different organization, HUNGARNET will probably join the CERT coordination activity selected by TERENA. In addition, let me mention that Petter's message was correct with respect to the questionnaire, too: > Sorry for not using your form, but i did not find any suitable statements. A suitable statement could have been eg. %STJ We wait for a decision made by TERENA about European CERT coordination. (or something similar). Without such an option, Petter couldn't find any suitable statement, indeed, because only this kind of statement could express suitably why UNINETT didn't commit to SIRCE before your deadline. Finally, I don't know why the amount of commitments is relatively low. If ISPs didn't react because they share Petter's view (and mine, too), that's ok. If the reason is lack of interest in CERT coordination, in general, that's worse. Hopefully at the end, a really Europe-wide coverage of CERT coordination will be achieved - either by SIRCE or by some other project. Regards and best wishes, Lajos

2 1

Re: Re: SV: SIRCE: Action Needed !
by RIPE NCC Billing Department 27 Nov '96

27 Nov '96

Dear Daniel David, Thank you for committing to fund the SIRCE pilot project. We have received your data as follows: Name: Daniel David Position: President Registry ID: de.ipf Committed amount (ECU): 1000 Billing reference: RIPE/SIRCE Your registration has been successful. Kind regards, Roderik Muit RIPE NCC Billing Department

1 0

Re: SV: SIRCE: Action Needed !
by Daniel David 27 Nov '96

27 Nov '96

At 22:17 19.11.96 +-100, you wrote: >%START > >%FORM [sirce9601] > >I herby commit to contribute the ECU amount indicated to the >SIRCE pilot project as defined in ripe-150 and the documents >it refers to. I confirm that I have authority to commit >my organisation for this contribution. I expect to be invoiced >for this contribution as soon as the project will have started. > >Please put information between the brackets. > >Please give your full name. > >%NAME [Daniel David] > >Please give your position in the organisation. > >%POS [President] > >Specify the registry ID of your organisation if it has one. > >%REGID [de.ipf] > >If you have *not* specified a registry ID above, please give the >full organisation name and billing address. We will contact >you for more details if necessary. > >%ORGNAME [] > >%ADDRESS [] > >Committed amount in ECU. Minimum is ECU 500. Excludes VAT where applicable. > >%AMOUNT [1000] > >Any billing reference that you may wish to be mentioned on the invoice. > >%BILLREF [RIPE/SIRCE] > >%END > > > > > IPF.NET GmbH Mainzer Landstr. 46 Tel: +49 69 17084-20 Daniel David 60325 Frankfurt Fax: +49 69 17084-33

1 0

SIRCE Funding Update
by Daniel Karrenberg 26 Nov '96

26 Nov '96

Commitments currently stand at almost 30kECU or "only" 20% of the expected amunt. Thanks to the people who made a commitment; they are listed in chronological order below. Since commitments are still coming in we have extended the deadline to Friday November 29th. See the form attached. We are very much interested to know why the response is so much less than expected. We will therefore circulate a questionnaire to get some of the answers. Daniel Karrenberg RIPE NCC Organisation name Person commit (ECU) pi.se AB Pontus Ekman 1000 ACONET Wilfried Woeber 1000 RedIRIS-CSIC Victor Castelo 1000 Academic Computer Centre, CYFRONET-KRAKO Karol Franczak 500 IPGlobal, Informatica e Telecomunicacoes Pedro Ramalho Carlos 500 Teleport C&S GmbH. Christoph Maerk 500 BT Public Internet Service Nigel Roy Titley 1000 Tele Greenland Michael Schultz 1000 SpaceNet GmbH Sebastian v. Bomhard 750 Unisource Business Networks Italy Mauro Magrassi 1000 Sontheimer Datentechnik GmbH Bernd Sontheimer 500 ECRC GmbH Dave Morton 1000 Tele2/SWIPnet Jorgen Ericsson 1000 Nacamar Klaus Landefeld 1000 SIBS - Sociedade Interbancaria de Servic Jose Eduardo Pina Mi 1000 LITNET Daiva Tamulioniene 500 INRIA Annie Renard 500 EUnet Communications Services BV Per Gregers Bilse 1500 HogiaNet Kenneth Hybner 1000 AT&T Internet Services Tankut Turhan, Henk 1000 CESNET Pavel Vachek 500 OTEnet S.A. Theodore Thanopoulos 1000 HEAnet John Hayden 1000 U-NET Limited Stuart Muckley 500 Telia AB J=F6rgen I Larsson 1000 GTN Andreas Baess 1000 INS GmbH Andreas Frackowiak 1000 NASK - Research and Academic Network in Krzysztof Silicki 500 Xlink Michael Rotert 1000 Entreprise des Postes et Telecommunicati Thierry Coutelier 500 HPT - Croatian Post and Telecomm, Teleco Ivan Sedinic 1000 Unisource Business Networks (Schweiz) AG Philip Bridge 1000 Clinet Heikki Suonsivu 1000 InComA Ltd. Gregory Dmitriev 1000 ----- Total: 29250 ------ send this form to <biling(a)ripe.net> ------- %START %FORM [sirce9601] I herby commit to contribute the ECU amount indicated to the SIRCE pilot project as defined in ripe-150 and the documents it refers to. I confirm that I have authority to commit my organisation for this contribution. I expect to be invoiced for this contribution as soon as the project will have started. Please put information between the brackets. Please give your full name. %NAME [ ] Please give your position in the organisation. %POS [ ] Specify the registry ID of your organisation if it has one. %REGID [ ] If you have *not* specified a registry ID above, please give the full organisation name and billing address. We will contact you for more details if necessary. %ORGNAME [ ] %ADDRESS [ ] Committed amount in ECU. Minimum is ECU 500. Excludes VAT where applicable. %AMOUNT [ ] Any billing reference that you may wish to be mentioned on the invoice. %BILLREF [ ] %END

1 0

SIRCE Funding
by Daniel Karrenberg 22 Nov '96

22 Nov '96

Dear colleagues, thank you very much for the additional commitments. Five days from the deadline of November 27th we have 15% of the expected commitments. below you find the latest list in order of receipt. If you have any further questions, please do not hesitate to contact us. Regards Daniel Karrenberg RIPE NCC Manager Organisation name Person commit (ECU) pi.se AB Pontus Ekman 1000 ACONET Wilfried Woeber 1000 RedIRIS-CSIC Victor Castelo 1000 Academic Computer Centre, CYFRONET-KRAKO Karol Franczak 500 IPGlobal, Informatica e Telecomunicacoes Pedro Ramalho Carlos 500 Teleport C&S GmbH. Christoph Maerk 500 BT Public Internet Service Nigel Roy Titley 1000 Tele Greenland Michael Schultz 1000 SpaceNet GmbH Sebastian v. Bomhard 750 Unisource Business Networks Italy Mauro Magrassi 1000 Sontheimer Datentechnik GmbH Bernd Sontheimer 500 ECRC GmbH Dave Morton 1000 Tele2/SWIPnet Jorgen Ericsson 1000 Nacamar Klaus Landefeld 1000 SIBS - Sociedade Interbancaria de Servic Jose Eduardo Pina Mi 1000 LITNET Daiva Tamulioniene 500 INRIA Annie Renard 500 EUnet Communications Services BV Per Gregers Bilse 1500 HogiaNet Kenneth Hybner 1000 AT&T Internet Services Tankut Turhan, Henk 1000 CESNET Pavel Vachek 500 OTEnet S.A. Theodore Thanopoulos 1000 HEAnet John Hayden 1000 U-NET Limited Stuart Muckley 500 Telia AB J=F6rgen I Larsson 1000 GTN Andreas Baess 1000 INS GmbH Andreas Frackowiak 1000 ----- Total: 23250

1 0

Re: SIRCE Funding
by Marco Negri 21 Nov '96

21 Nov '96

Andrea, per favore, fammi sapere qualcosa in piu' su questo SIRCE!!! Potrebbe essere utile contribuire con 500~1000 ECU. Bye Marco At 16.40 19/11/96 +0100, Daniel Karrenberg wrote: > >Dear contributors, dear colleagues, > >the interest in an ISP-driven security incident coordination service is >still much lower than expected. The total of all commitments is less >than 8% of the expected value. If there is no significant change in >this trend before November 27th the RIPE NCC will have to withdraw its >proposal for running the pilot. That is the right thing to do if there >is really little interest. However it is wrong if there is interest but >the right people do not react or get told about this. > >Here is a summary of the commitments so far in the order of receipt. >Thanks to all of the people and organisations below: > >Organisation name Person commit (ECU) > >pi.se AB Pontus Ekman 1000 >ACONET Wilfried Woeber 1000 >RedIRIS-CSIC Victor Castelo 1000 >Academic Computer Centre, CYFRONET-KRAKO Karol Franczak 500 >IPGlobal, Informatica e Telecomunicacoes Pedro Ramalho Carlos 500 >Teleport C&S GmbH. Christoph Maerk 500 >BT Public Internet Service Nigel Roy Titley 1000 >Tele Greenland Michael Schultz 1000 >SpaceNet GmbH Sebastian v. Bomhard 750 >Unisource Business Networks Italy Mauro Magrassi 1000 >Sontheimer Datentechnik GmbH Bernd Sontheimer 500 >ECRC GmbH Dave Morton 1000 >Tele2/SWIPnet Jorgen Ericsson 1000 >Nacamar Klaus Landefeld 1000 > ----- > > Total: 11750 > > > -- Marco Negri - I.NET High Quality ISP Phone : +39-2-40906 ext 1 I.NET e' associata ad AIIP Fax : +39-2-40906 ext 262 I-20153 V. Caldera, 21 - Milano, Italy e-mail : Marco.Negri(a)INet.It

1 0

SV: SIRCE: Action Needed !
by Kenneth Hybner 19 Nov '96

19 Nov '96

%START %FORM [sirce9601] I herby commit to contribute the ECU amount indicated to the SIRCE pilot project as defined in ripe-150 and the documents it refers to. I confirm that I have authority to commit my organisation for this contribution. I expect to be invoiced for this contribution as soon as the project will have started. Please put information between the brackets. Please give your full name. %NAME [Kenneth Hybner] Please give your position in the organisation. %POS [President] Specify the registry ID of your organisation if it has one. %REGID [se.hogianet] If you have *not* specified a registry ID above, please give the full organisation name and billing address. We will contact you for more details if necessary. %ORGNAME [] %ADDRESS [] Committed amount in ECU. Minimum is ECU 500. Excludes VAT where applicable. %AMOUNT [1000] Any billing reference that you may wish to be mentioned on the invoice. %BILLREF [RIPE/SIRCE] %END

1 0

SIRCE Funding
by Daniel Karrenberg 19 Nov '96

19 Nov '96

Dear contributors, dear colleagues, the interest in an ISP-driven security incident coordination service is still much lower than expected. The total of all commitments is less than 8% of the expected value. If there is no significant change in this trend before November 27th the RIPE NCC will have to withdraw its proposal for running the pilot. That is the right thing to do if there is really little interest. However it is wrong if there is interest but the right people do not react or get told about this. Here is a summary of the commitments so far in the order of receipt. Thanks to all of the people and organisations below: Organisation name Person commit (ECU) pi.se AB Pontus Ekman 1000 ACONET Wilfried Woeber 1000 RedIRIS-CSIC Victor Castelo 1000 Academic Computer Centre, CYFRONET-KRAKO Karol Franczak 500 IPGlobal, Informatica e Telecomunicacoes Pedro Ramalho Carlos 500 Teleport C&S GmbH. Christoph Maerk 500 BT Public Internet Service Nigel Roy Titley 1000 Tele Greenland Michael Schultz 1000 SpaceNet GmbH Sebastian v. Bomhard 750 Unisource Business Networks Italy Mauro Magrassi 1000 Sontheimer Datentechnik GmbH Bernd Sontheimer 500 ECRC GmbH Dave Morton 1000 Tele2/SWIPnet Jorgen Ericsson 1000 Nacamar Klaus Landefeld 1000 ----- Total: 11750

1 0