- ripe-list - mailman.ripe.net

Re: DANTE CERT Service
by Sven Tafvelin 13 Dec '94

13 Dec '94

I have been listening to the discussion on the European CERT Coordination. I believe in the following: - Any service provider is free to and should be encouraged to organize a CERT to serve its customers. - A European CERT Coordination activity depends on being trusted both on technical and commercial aspects by the organizations depending on it. To me this makes it impossible for a service provider to coordinate CERTs in competing service providers. - The European CERT CC need to be organized and done on "neutral" ground. - Therefore I support the ConCERT-in-E proposal. - I see that TERENA by many (hopefully all) and even by commercial organizations is regarded as such a neutral ground. - The RIPE NCC is also doing work where neutrality and trust is important. The high standard of quality and neutrality has made that sensitive activity accepted everywhere. - It is my firm belief that the European CERT CC in order to be successful should be organized in a similar way together with or close to the RIPE NCC to assure the same qualities. Sven Tafvelin

2 1

Re: DANTE CERT Service
by P.Bryant 11 Dec '94

11 Dec '94

In message Mon, 5 Dec 94 17:29:30 GMT, "Harald.T.Alvestrand" <Harald.T.Alvestrand(a)UNINETT.NO> writes: > You are not alone in being surprised. > The CERT meeting recently felt that the main problem in setting > up a CERT/CC was finding the right organization to do it, and I > think they meant finding an organization that all parties could > feel comfortable with, not that there would be a shortage of > volunteers. For task such as this I make a number of arguable statements: * This is a task which is not restricted to the academic or commercial bodies, it effects everyone. As such whoever takes on the job must be able to deal with all relevant bodies and have their confidence. * Although I like competition, this is not an area which is suitable for more than one organisation to be involved. * The job is in the nature of a police force and must have a reasonable range of powers (although at this stage the range of powers needs some thought). As such one wonders whether some governmental organisation should take on the task. Perhapse the EU should take an interest. * I am not at all sure that this is an area where volunteers are needed. We need guaranteed action which suggests permanent staff although ideas and suggestions from the volunteer side would no doubt be welcome. * As this is a somwewhat legal area I wonder whether this should be funded from governments or through the EU. Funding through UKERNA, DFN, TERENA et al does not seem appropriate since they do not represent the commercial sector. It may be better funded (if government funding fails) through site membership from those who wish to take advantage of the service. Paul. > > Is DANTE the right organization for the job? > > Or (a more positive note) is DANTE the right organization to > do the collection of money and subcontract the actual work > to another organization taht all parties trust to do the > (necessarily sensitive) coordination service right? > > I keep the long CC list, but would like to see it shortened > during the discussion... > > Harald T. Alvestrand Paul Bryant. Rutherford Lab, Chilton, Didcot, OX11 0QX, GB Tel. +44 235 445 267 Fax. +44 235 446 626

3 2

Re: DANTE CERT Service
by Peter Lothberg 08 Dec '94

08 Dec '94

> The Internet industry in Europe needs to sort out the funding of > 'mutual services' like the CERTs. While TERENA and RIPE-NCC are I To me all of this sounds like an operational issue, and doing any security coordination without the buyin from all the involved operators is likely to fail. My suggestion is that we put the question of European Cert-coordination on the agenda for the next EOF-meeting, wich is colocated with the next Ripe meeting in Amsterdam. ---Peter

1 0

ISOC nominations
by Jan Gruntorad 08 Dec '94

08 Dec '94

The Internet Society 1995 Board of Trustees Elections CALL FOR NOMINATIONS On 30 April 1995 Internet Society members will be requested to vote for FOUR elected positions on the Internet Society Board of Trustees. These elected Trustees will serve a three year term. The role of the Trustees is detailed in the Internet Society By-Laws (not included in this notice), but available on the Internet Society gopher (gopher://gopher.isoc.org/00/isoc/basic_docs/bylaws.txt) and WWW servers (http://www.isoc.org) This notice is a call from the ISOC Nominations Committee for nominations of candidates for election. Nominations are to be forwarded this committee via: o electronic mail to +---------------------+ | isoc-noms(a)isi.edu | +---------------------+ or o fax to +-------------------+ | +1 (315) 453 3052 | +-------------------+ or o postal mail to: +--------------------------------+ | Jean Armour Polly | | NYSERNet, Inc. | | 200 Elwood Davis Rd. Suite 103 | | Liverpool, NY 13088-6147 | | USA | +--------------------------------+ PLEASE DISTRIBUTE THIS NOTE WIDELY Nominations must reach the committee no later than 31 December 1994 in order to ensure due consideration of the nomination by the committee. Nominations (in the form of agreed nominations, suggestions or volunteers) are to include the name of the nominated individual, contact details and a brief explanation of the basis of the nomination. The committee will confirm with the candidates their willingness to stand for election as a nominated candidate if so selected. Nominees will also be requested to provide the committee with further personal details (in the format of a curriculum vitae) as they relate to the selection guidelines that are to be applied by the committee, and provide to the committee a statement indicating their willingness and ability to devote an appropriate level of time to activities associated with the position of Trustee of the Internet Society. It is intended that the committee's selection process will result in no less than 8, and up to 10 candidates for election as nominated candidates. This list will be passed to the Elections Committee on 15 January 1995, as well as informing voting members of the Society of the selected nominees. Additional candidates for election to the Board of Trustees may be nominated by membership petition, filed with the Chair of the Nominating Committee no later than 14 February, 1995. A petition for the 1995 election will require the signatures of fifty voting ISOC members. Specific details of the petition process will be included in the announcement of nominated candidates on 15 January 1995. Following the closure of the petition period, the list of the nominated and petitioned candidates will be announced 15 February, 1995. The Election Committee will mail the ballots out to ISOC voting members on 1 March, 1995 and the election date is set to be 30 April 1995. Thank you, Jean Armour Polly Chair, ISOC Nominations Committee jpolly(a)nysernet.org phone +1 315 453 2912 extension 224 (GMT -5) fax +1 315 453 3052 ------------------------------------------------------------------------ A. The 1995 ISOC Nominations Committee membership Jean Armour Polly (Chair, ISOC Trustee) Susan Estrada (ISOC Trustee) Jan Gruntorad (ISOC Member) Mike Lawrie (ISOC Member) Andy Linton (ISOC Member) David Farber (ISOC Trustee) (alternate) Jon Postel (ISOC Trustee) (alternate) Committee Email address: isoc-noms(a)isi.edu ------------------------------------------------------------------------ B. Nominations Committee Selection Guidelines Candidates for ISOC Trustee should have a demonstrable involvement in the Internet. Such involvement may range from participation as a technology developer, researcher, user, network operator, policy maker (e.g. in government), sponsor of research and development. ISOC is interested in broadly-based representation on the Board of Trustees and seeks to identify candidates from industry, education and non-profit sectors and from government. The selection criteria will be directed to selecting a broad range of interests, and will include criteria of regional location, current activities, relevant experience and professional background. A minimum of 8 candidates, and up to 10 candidates, will be selected by this committee, using the criteria as outlined above. ------------------------------------------------------------------------ C. A Profile of the current Board of Trustees The current membership (as of 1 December 1994) of the Board of Trustees is as follows: "Vint Cerf" 1992-95 USA-Americas <vint_cerf/1050002(a)mcimail.com> "Lawrence Landweber" 1994-97 USA-Americas <lhl(a)cs.wisc.edu> "Frode Greisen" 1992-95 Denmark-Europe <frode.greisen(a)uni-c.dk> "Geoff Huston" 1992-95 Australia-Asia-Pacific <g.huston(a)aarnet.edu.au> "Scott Bradner" 1992-95 USA-Americas <sob(a)harvard.edu> "Charles Brownstein" 1993-96 USA-Americas <cbrownst(a)cnri.reston.va.us> "Susan Estrada" 1993-96 USA-Americas <sestrada(a)aldea.com> "David Farber" 1993-96 USA-Americas <farber(a)cis.upenn.edu> "Shigeki Goto" 1994-97 Japan-Asia-Pacific <goto(a)ntt-20.ntt.jp> "Saul Hahn" 1994-97 Mexico-Americas <shahn(a)umd5.umd.edu> "Haruhisa Ishida" 1993-96 Japan-Asia-Pacific ishida(a)u-tokyo.ac.jp> "Robert Kahn" 1992-* USA-Americas <rkahn(a)nri.reston.va.us> "Tomaz Kalin" 1994-97 Slovenia-Europe <kalin(a)rare.nl> "Dan Lynch" 1994-97 USA-Americas <dlynch(a)interop.com> "Kees Neggers" 1993-* Netherlands-Europe <neggers(a)surfnet.nl> "Jean Armour Polly" 1993-96 USA-Americas <jpolly(a)nysernet.org> "Jon Postel" 1993-96 USA-Americas <postel(a)isi.edu> "Michael Roberts" 1993-* USA-Americas <mmr(a)darwin.ptvy.ca.us> "Anthony Rutkowski" ex-officio <amr(a)isoc.org> * appointed for unlimited terms ------------------------------------------------------------------------ D. Procedures Resolution 94-19 Procedures for Nomination and Election of Trustees (Supersedes Resolution 92-11) The Board resolved unanimously to adopt the following process for the nomination and election of ISOC Trustees. Procedures for Nomination and Election of Trustees 1. Trustee Positions to be Filled The Board of Trustees will advise the Nominating Committee of the number of Trustee positions to be filled by vote of the individual members at each annual election. The Board may also advise the Nominating Committee of its desires with respect to the backgrounds of individuals to be nominated in order to achieve the balance o experience and qualifications required by the provisions of By-Law Article III, Section 2, which provides that "the Board shall seek to have among the Trustees representative individuals from industry, from educational and nonprofit organizations and from government." 1.1 Date of Election The Board of Trustees will annually adopt a timetable for Trustee elections. The election date shall be not less than 40 days prior to the next Annual Meeting of the Society. 1.2 Use of Electronic Mail All communications concerning the nomination and election of Trustees shall be in the form of electronic mail except the ballot, which shall be in the form of first class postal mail. Members of the Society who are not reachable by electronic mail may participate in the nomination process by postal mail. 2. Nominating Committee The Board of Trustees will annually appoint a Trustee Nominating Committee. The Nominating Committee will consist of 5 individual members of the Society. The Chair of the Nominating Committee shall be a member of the Board of Trustees. At least 2 members of the Nominating Committee shall be individual members of the Society not currently serving in any elected or appointed capacity in the Society. 2.1 Nominations by Committee The Nominating Committee will notify the members of the Society of the procedures for nominating individuals for election to the Board of Trustees, and will provide a minimum period for receiving nominations of 30 days. The number of individuals nominated shall exceed the number of Trustees to be elected. 2.2 Nominations by Petition The Nominating Committee will notify the voting members of the Society of the names of individuals nominated by the committee for election to the Board of Trustees not less than 105 days prior to the date established for Trustee elections. Additional nominations for election to the Board of Trustees may be made by petition filed with the Chair of the Nominating Committee not less than 75 days prior to the election. Petitions may be filed electronically. The Nominating Committee shall specify the number of signatures of voting members required for petitions, which shall be at least fifty voting members of the Society, or 1% of the total number of voting members of the Society, whichever is greater. 2.3 Candidates for Election The Nominating Committee will provide the names of a completed slate of candidates for election to the Elections Committee not less than 74 days prior to the election date. 3. Elections Committee The Board of Trustees will annually appoint an Elections Committe composed of three voting members of the Society which will be responsible for establishing and supervising elections. The Chair of the committee shall be a Trustee whose term of office does not expire during the year of the election. 3.1 Eligibility to Vote All individual members of the Society in good standing are eligible to vote. An individual member is in good standing if his or her annual dues are not more than 60 days past due on the date of mailing of the ballot. 3.2 Ballot The Trustee election shall be conducted by written ballot of the individual members, which shall be mailed to each member of the Society in good standing not less than 60 days prior to the date of the election. 3.3 Voting Each voting member will be entitled to as many votes as there are Trustee positions to be filled by vote of the members. Votes may be cumulated on behalf of one or more candidates for election. A member may use fewer than the total number of votes available if he or she so chooses. 3.4 Receipt of Ballots All ballots for Trustee elections shall be received by the Chair of the Elections Committee by 5 PM local time on the day prior to the date of the election, at the place established by th Elections Committee for delivery of the ballots. 3.5 Counting of Ballots The counting of ballots will take place on the election date, at a time and place established by the Elections Committee. At least two members of the Elections Committee shall be present at the counting of the ballots. The committee will establish procedures to ensure the privacy, validity and accuracy of all ballots. 3.6 Certification of Vote The Elections Committee shall certify the results of the annual Trustee election to the Board of Trustees within 10 days following the election, forwarding a list of the candidates and the number of votes each candidate has received. 3.7 Challenges No challenge to any Trustee nomination or election procedure or result may be brought except by an individual member in good standing. Any challenge must be addressed to the President of the Society with a recital of the reasons for the challenge, and must be received within 20 days of the election date. The President, after consultation with the Chairs of the Nominating and Elections Committees and the members of the Board of Trustees, shall advise the author of the challenge of the Board's decision, which shall be final, within 40 days of the election date. Resolution 94-20 1995 ISOC Nomination and Trustee Election Timetable The Board resolved unanimously to adopt a Timetable for the 1995 Trustee nomination and election process in accordance with the procedures of Resolution 92-19 commencing with the opening of the Nominations period on December 1 1994. The Timetable to be adopted is as follows: December 1 1994 Nominations Period Opens December 31 1994 Nominations Period Closes January 15 1995 Nominations Committee Announcement February 14 1995 Petition Period Closes February 15 1995 Candidate Announcement March 1 1995 Election Period Opens - Ballots posted April 30 1995 Election date May 1 1995 Challenge Period Opens May 10 1995 Elections Committee Certifies Result May 20 1995 Challenge Period closes June 9 1995 ISOC Response to Challenge Period Closes June 28 1995 1995 Annual General Meeting =======================================================================

1 0

New Document available: ripe-125
by RIPE NCC Document Annoucement Service 07 Dec '94

07 Dec '94

Revised RIPE Document Announcement -------------------------------------- A revised document is available from the RIPE document store. Ref: ripe-125 Title: RIPE NCC Activity Plan Author: R. Blokzijl Date: 7 December 1994 Format: PS=31981 TXT=11515 Obsoletes: ripe-110 Short content description ------------------------- (bit now filled in :-( This is the updated Activity Plan, previously circulated as a draft document. FTP Access ---------- All RIPE documents and Internet RFC`s are available via anonymous FTP from host ftp.ripe.net. Type "ftp ftp.ripe.net". Login with username "anonymous" supplying your email address as the password. After logging in, type "cd ripe/docs/" followed by the command "get filename". The relevant filenames for this document are: ripe-125.txt for the ASCII version ripe-125.ps for the PostScript version Electronic Mail Retrieval of Documents -------------------------------------- Documents can also be retrieved from the RIPE document store using a mail server program. For more information on how to use the program, send email to: mail-server(a)ripe.net with "send HELP" in the body text. RIPE NCC Interactive Information Server --------------------------------------- Type "telnet info.ripe.net". This is a menu driven service allows the document store to be browsed. After reading documents you are prompted as to whether you would like to receive an email copy of the document you have just read. If you would, you simply enter your email address and the document will be mailed to you. Below are details of alternative methods of access. Gopher Access ------------- The same documents are available via a "gopher" server at "gopher gopher.ripe.net". WAIS Access ----------- There is also a "WAIS" server at wais.ripe.net, where there is a WAIS index for RIPE documents "ripe-docs.src" WWW Access ---------- For those who wish to add this home page at the RIPE NCC to their own customized home pages, it can be accessed as: http://www.ripe.net MIME Mail Reader ---------------- Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the RIPE document by FTP or mail server. SEND ripe/docs/ripe-125.txt

1 0

New Document available: ripe-125
by RIPE NCC Document Annoucement Service 07 Dec '94

07 Dec '94

New/Revised RIPE Document Announcement -------------------------------------- A revised/new document is available from the RIPE document store. Ref: ripe-125 Title: RIPE NCC Activity Plan Author: R. Blokzijl Date: 7 December 1994 Format: PS=31981 TXT=11515 Obsoletes: ripe-110 Obsoleted by: Updates: Updated by: Old: Short content description ------------------------- PLEASE FILL THIS IN FTP Access ---------- All RIPE documents and Internet RFC`s are available via anonymous FTP from host ftp.ripe.net. Type "ftp ftp.ripe.net". Login with username "anonymous" supplying your email address as the password. After logging in, type "cd ripe/docs/" followed by the command "get filename". The relevant filenames for this document are: ripe-125.txt for the ASCII version ripe-125.ps for the PostScript version Electronic Mail Retrieval of Documents -------------------------------------- Documents can also be retrieved from the RIPE document store using a mail server program. For more information on how to use the program, send email to: mail-server(a)ripe.net with "send HELP" in the body text. RIPE NCC Interactive Information Server --------------------------------------- Type "telnet info.ripe.net". This is a menu driven service allows the document store to be browsed. After reading documents you are prompted as to whether you would like to receive an email copy of the document you have just read. If you would, you simply enter your email address and the document will be mailed to you. Below are details of alternative methods of access. Gopher Access ------------- The same documents are available via a "gopher" server at "gopher gopher.ripe.net". WAIS Access ----------- There is also a "WAIS" server at wais.ripe.net, where there is a WAIS index for RIPE documents "ripe-docs.src" WWW Access ---------- For those who wish to add this home page at the RIPE NCC to their own customized home pages, it can be accessed as: http://www.ripe.net MIME Mail Reader ---------------- Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the RIPE document by FTP or mail server. SEND ripe/docs/ripe-125.txt

1 0

Re: DANTE CERT Service
by houttuin＠terena.nl 07 Dec '94

07 Dec '94

Since I have personally been deeply involved in setting up the European CERT co-ordination service through ConCERT-in-E, I might as well let you know my personal opinions in this matter: > > ...well, from the point of view of the customers "asking" DANTE to > > provide this service, it's probably a coordinated action, isn't it? > If this is the case, that's fine with me. However, I've spoken to too > many people being surprised by the DANTA announcement, so it didn't > appear *that* coordinated. It was co-ordinated between a very limited number of customers and DANTE. Not between the European CERTs, who were co-ordinating very well through the ConCERT-in-E task force, or between that task force and DANTE. > > However the trust aspect and confidentiality somehow contradicts the > > idea of putting up a (commercial) tendering process.. > > It's not necessarily more commercial than the DANTE offering. At least, > it will give interested parties a chance to participate on equal terms. We were, through ConCERT-in-E, trying to get together as many interested parties in Europe and leave it up to them what the funding model would look like and who would provide the service in the end. That way, even if in the end DANTE would have been chosen to provide the service, everyone would at least have had a say in that decision.... Plus all parties would have been able to determine what exactly the service would consist of. > > Or have TERENA do the "tendering" (more like asking for qualified > > volunteers) and then provide the financial clearinghouse? That was another option that could have been chosen by the participating parties. > That's what I thought would happen, and such a Call for Tender has indeed > been prepared by TERENA, as far as I know, which has given me the feeling > that the TERENA activity in that area was pre-empted by DANTE's announcement > of a service. Maybe somebody from TERENA and/or DANTE cares to comment about > that? At least one of your customers is a bit confused about these semi- or > fully-parallel CERT/CC activities, so please clarify the situation! The only advantage that I personally see in the latest DANTE approach is speed. Consortium establishment is not done overnight. But the trade-off may very well be that a lot of countries that don't choose to buy the service via DANTE will still need some form of ConCERT-in-E. Result: at least two European CERT co-ordination services. I think (and I know many other parties think) that we were on the best possible way through ConCERT-in-E, and I was rather negatively surprised by this announcement (for which I do not blame DANTE at all BTW). I'll leave it to our member networks to convince each other that one approach is better than the other, or even to continue with both. That's not my job. I can give you my personal opinion though: I am still convinced that ConCERT-in-E is the right way to do this, even if it will take a bit more time and effort to establish the service. At the same time, we cannot forbid DANTE to offer this service of course. They do need more than 2 customers though for it to succeed.... Cheers, JH -//-

2 1

Re: DANTE CERT Service
by Hannes Lubich 06 Dec '94

06 Dec '94

Hmmm, I would rather see a coordinated action here, rather than just one or the other organisation "taking over" a function, regardless of their other services. Wouldn't that be a classical scenario for a Call for Tender? Another thought: as the person responsible for the SWITCH CERT, my impression is that one of the foundations of running a CERT/CC is trust (ie.e. a customer has to trust me that I will handle his/her security problem in a knowledgeable AND confidential way, also a CERT provider has to trust his/her customers to a certain degree). Such trust can only be built over time, so an European CERT/CC should in my opinion be based on one or more existing national CERTs, with that particular experience in place (and I'm not only talking about purely technical experience, see above). CHeers --HaL PS: In the original message from DANTE, a corresponding DANTE mailing list was mentioned, and I have asked to be included in that list. So far, I have not received any feedback on this. Is this list active at all? PPS: Looking at the headers of the individual messages sent so far, this discussion is addressed to a lot of lists, and a number of individuals. Could we please keep this discussion within a defined set of lists? -- /==========================================================================\ | Hannes P. Lubich Voice: +41 1 268 15 55 (direct) 15 50 (line) | | SWITCH Head Office Fax : +41 1 268 15 68 | | Limmatquai 138 Mail : lubich(a)switch.ch | | CH-8001 Zurich Mail : S=lubich; O=switch; P=switch; A=arcom; C=ch; | | Switzerland Phys : 47 23'N, 8 33' E, GMT + 1 | | More : "finger @macHaL.switch.ch" (if switched on) | \==========================================================================/

2 1

Re: DANTE CERT Service
by Wilfried Woeber, UniVie/ACOnet 06 Dec '94

06 Dec '94

Dear Hannes! #include <disclaimer.h> /* this is my personal view, not necessarily ACOnet's position */ >Subject: Re: DANTE CERT Service >From: Hannes Lubich <lubich(a)chx400.switch.ch> > >Hmmm, I would rather see a coordinated action here, rather than just one >or the other organisation "taking over" a function, regardless of their >other services. Wouldn't that be a classical scenario for a Call for Tender? ...well, from the point of view of the customers "asking" DANTE to provide this service, it's probably a coordinated action, isn't it? >Another thought: as the person responsible for the SWITCH CERT, my impression >is that one of the foundations of running a CERT/CC is trust (ie.e. a customer >has to trust me that I will handle his/her security problem in a knowledgeable >AND confidential way, also a CERT provider has to trust his/her customers to a >certain degree). Such trust can only be built over time, so an European CERT/CC >should in my opinion be based on one or more existing national CERTs, with that >particular experience in place (and I'm not only talking about purely technical >experience, see above). I fully agree with your line of thoughts! However the trust aspect and confidentiality somehow contradicts the idea of putting up a (commercial) tendering process.. As an aside, I don't see DANTE's position in this at all, given the fact that the service is proposed to be subcontracted. Why dont' the national CERTs get directly in touch with the group that actually provides the coordination/functionality (I do not use the term "service" here by purpose)? Or have TERENA do the "tendering" (more like asking for qualified volunteers) and then provide the financial clearinghouse? But maybe we again "need" an "appropriately coloured management" somewhere along the path... Yours, Wilfried. -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

4 3

Re: DANTE CERT Service
by Christian Panigl, ACOnet/UniVie +43 1 4065822-383 06 Dec '94

06 Dec '94

>Date: Tue, 6 Dec 94 09:42:37 +0100 >From: Dave Morton <Dave.Morton(a)ecrc.de> > >A service provider is not the correct type of organisation to provide >or organise a CERT. I would suggest the RIPE-NCC, they are already accepted as non-provider coordination center for Internet registries, why not for CERTs ? Just an idea and my personal opinion, I didn't ask them if they would like to take that burden and I don't have an ACOnet mandate ! Regards Christian --- Christian Panigl : Vienna University Computer Center - ACOnet --- --- VUCC - ACOnet : -------------------------------------------- --- --- Universitaetsstrasse 7 : Internet: Christian.Panigl(a)CC.UniVie.ac.at --- --- A-1010 Vienna / Austria : Tel: +43 1 4065822-383 (Fax: -170) ---

1 0