- BCOP - mailman.ripe.net

Initiative to create a RIPE BCOP discussion document on proactively mitigating IoT attacks in CPE
by sandoche Balakrichenan 17 Jun '19

17 Jun '19

Dear all, The origin for this initiative came from the ICANN SSAC document on DNS and IoT : https://www.icann.org/en/system/files/files/sac-105-en.pdf As RIPE IoT chairs, we asked (in the RIPE IoT mailing list) whether we should prepare a Best Current Operational Practice (BCOP) document in RIPE scope for proactively mitigating IoT attacks. From both the Academy and the Industry, we got interests to contribute to this work. Possible contributors name can be found at the end of this mail: Thanks for your input on how to proceed further: 1. Do you think the topic is useful for the RIPE community? If yes, any guidance on how to proceed further will be appreciated. 2. Should this discussion be initiated in the RIPE IoT WG and not in the BCOP task force? 3. Anyone in this mailing list would be interested in contributing or provided references to people who will be interested to contribute? People who have already expressed interest in contributing: *From the Academy: * 1. Andrzej Duda (http://duda.imag.fr/) 2. Maciej Korczynski (http://mkorczynski.com/) *From the Industry:* 1. Ad Bresser (SPIN product manager) 2. Eliott Lear (CISCO) 3. Jacques Latour (CIRA - The Canadian Internet registry) 4. Peter Steinhauser (Embedd.com) 5. Possiblity from CZNIC (Czech Internet registry) who are involved in Turris router project Sandoche.

4 4

BCOP about CPE minimum security requirements
by JORDI PALET MARTINEZ 21 May '19

21 May '19

Hi all, Here are the links about the document I mention yesterday in the meeting, regarding the "Minimum security requirements for CPEs": https://www.lacnog.net/docs/lac-bcop-1 https://www.m3aawg.org/CPESecurityBP Also, the other relevant document "IPv6-only CPEs with IPv4-as-a-Service": https://datatracker.ietf.org/doc/rfc8585/ Regards, Jordi ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

RIPE 706 Wording
by James Blessing 03 Aug '18

03 Aug '18

Hi, First of all, this is not a comment about MANRS but the published document RIPE706 and is a question of wordsmithing rather than anything else. In reference to : 3.3 Network operators who agree to the Principles and implement at least one of the Actions (though not solely the Coordination Action) can become a MANRS Participant. This entitles you to use of the MANRS badge, you will be listed on the routingmanifesto.org website, and you can contribute to this document and others like it. As I read that clause it says to make changes to RIPE706 then you *must* first be a MANRS signee, I assume the intent was to transpose the original MANRS documents with as few changes as possible, but in doing so the reference to "this document" should have been updated to point at the original version. If however, it's an intentional attempt to restrict changes to RIPE706 to a subset of the RIPE community then this is a dangerous precedent to set and we should challenge this assertion. And secondly (and maybe more importantly) we now have two documents that (the original MANRS and RIPE706) that, whilst are currently in sync have no explicit method for updating and cross checking. I thought we'd all learnt the hard way that we should always have a single source of truth... Thx J -- James Blessing 07989 039 476

2 1

RIPE-706 published: Mutually Agreed Norms for Routing Security (MANRS) Implementation Guide
by Benno Overeinder 11 Jun '18

11 Jun '18

The document Mutually Agreed Norms for Routing Security (MANRS) Implementation Guide is now published as RIPE document RIPE-706. https://www.ripe.net/publications/docs/ripe-706 Best regards, Jan Zorz & Benno Overeinder -- Benno J. Overeinder NLnet Labs https://www.nlnetlabs.nl/

1 0

Fwd: [routing-wg] Fwd: Abstract of the MANRS BCOP
by Benno Overeinder 04 Jun '18

04 Jun '18

For information to the BCOP mailing list. MANRS BCOP LC is concluded and we move forward to publish the document as a RIPE Document. Best regards, Jan Zorz & Benno Overeinder -------- Forwarded Message -------- Subject: Re: [routing-wg] Fwd: [bcop] Abstract of the MANRS BCOP Date: Mon, 4 Jun 2018 21:55:08 +0200 From: Benno Overeinder <benno(a)NLnetLabs.nl> To: routing-wg(a)ripe.net Thank you all for the discussion and feedback. >From the email thread we conclude there are no principal objections and close the LC. Best regards, Jan Zorz & Benno Overeinder On 29/05/2018 15:12, Job Snijders wrote: > On Tue, May 29, 2018 at 09:03:48AM +0300, Hank Nussbacher wrote: >> On 28/05/2018 14:53, Job Snijders wrote: >>> On Thu, May 17, 2018 at 07:16:34PM +0300, Hank Nussbacher wrote: >>>> On 17/05/2018 17:02, Benno Overeinder wrote: >>>> >>>> Maybe I'm missing it when reading the website and the BCOP but where >>>> does it state to *not *allow /25 or more specifics? >> >>> If someone registers a /25, and announces it, and the RPKI ROA >>> allows it, then what is the problem? :-) >> >> I am not talking about a registered /25. I am talking about someone >> hijacking your /24 or your /21 by announcing a bunch of /25s. > > I'm pretty sure the MANRS documentation suggests that you should not > accept & propagate hijacked prefixes (regardless of prefix length). > > Kind regards, > > Job > -- Benno J. Overeinder NLnet Labs https://www.nlnetlabs.nl/

1 0

RIPE 76 BCOP TF Agenda
by Benno Overeinder 17 May '18

17 May '18

For archival reasons we send the agenda for the BCOP TF of last Monday to the RIPE BCOP mailing list. • A. Opening, Administrative, Global activities [10 min] • B. DNS Privacy BCP [20 min] Sara Dickinson • C. Email servers on IPv6 [20 min] Sander Steffann and Jordi Palet Martinez • D. Closing -- Benno J. Overeinder NLnet Labs https://www.nlnetlabs.nl/

1 0

No BCOP TF meeting at RIPE 75, but...
by Jan Zorz - Go6 22 Oct '17

22 Oct '17

Dear BCOP community, Due to agenda scheduling challenges for this RIPE75 meeting, we'll not have a BCOP TF meeting this time... but... we'll have a "Measurements of routing health system" BOF at 18:00. This will be a proper Bar BoF, taking place today (Sunday) at The Cave bar on Mezzanine (M2) floor of Conrad hotel. Whoever is interested in this discussion is welcome to join. Cheers, Benno and Jan

1 0

Proposal for a new BCOP document...
by Jan Zorz - Go6 18 Oct '17

18 Oct '17

Dear BCOP TF community, Now when we are finished with this IPv6 prefix delegations BCOP, I would like to suggest a new topic for a new document. While traveling around the world and talking to operators - another quite generic complaint formed up as quite a popular one: "I'm running email server on IPv4, because anti-spam mechanisms works quite well on IP-reputation basis, but on IPv6 there is no such thing, therefore I'm not enabling my receiving email server on IPv6" Sooo... let's join in an effort to document the best current operational practices how to effectively run your email server op IPv6 and survive. I'm asking for volunteers here on this mailing list and I'll ask for volunteers at our Dubai meeting. We need people with operational experience running a receiving email servers on IPv6 to document the best ways how to do it. Any takers? Cheers and see you all in Dubai, Jan

2 1

RIPE-690 BCOP is now published...
by Jan Zorz - Go6 16 Oct '17

16 Oct '17

Dear BCOP community, In past year you have heard a lot about this "Best Current Operational Practice for Operators: IPv6 prefix assignment for end-users - persistent vs non-persistent, and what size to choose" BCOP document draft that many of you also co-authored or contributed to - and I would like to tank you for all hard work and time, put in this BCOP. The document was today published as RIPE-690!!! https://www.ripe.net/publications/docs/ripe-690/ Congratulations!!! Cheers, Jan Zorz

1 0

Abstract of the MANRS BCOP
by Andrei Robachevsky 22 Aug '17

22 Aug '17

Hi, The final version of the MANRS BCOP has been published on the MANRS website: https://www.manrs.org/bcop/. Both a PDF and an online versions are available. However, to bring the bcop process to an official closure, chairs suggested that instead of publishing the MANRS BCOP as a RIPE document, that might be too constrained, we publish just an abstract. And once the BCOP global repository is in place, we can put it there in whatever format is most convenient. I am attaching the abstract for your review and comments. Regards, Andrei

2 1