February 2021 - db-wg - mailman.ripe.net

Webupdates UI bug?
by Cynthia Revström 11 Mar '21

11 Mar '21

Hi DB-WG, When creating a new object via webupdates, it selects IRT objects too in addition to the maintainers that are connected to the SSO account. This ofc doesn't work, and you just get an error, but it might be somewhat confusing and should probably be fixed. -Cynthia

2 4

RIPE Database history - let's make a decision
by denis walker 24 Feb '21

24 Feb '21

Colleagues "NWI-2 - displaying history for DB objects where available" has been open for almost 5 years. Every time we raise this we get 1 or 2 responses, but not enough to declare a consensus on. Although no one has spoken against the idea of making (moree) history available, there is no consensus on what and how to display historical data. So lets review where we are and where we 'could' go...then make some decisions. Available data: The RIPE Database keeps every version of every object since the current RPSL database was launched in April 2001. The data set is almost a complete set. Due to a technical issue a small amount of historical data was permanently lost from the database around 2003. This data does include all deleted objects and objects that have been deleted and recreated. The primary key of any object allows for the correlation of versions across a deletion/re-creation break. However it should be realised that, even if the primary key is the same, a re-created object may not be related to a previous version that was deleted. For example, an assignment may be made to company A. It is later deleted. At some point the same addresses may be assigned to company B. This 're-creates' an INET(6)NUM object with the same primary key as the deleted one. But the two sets of data are unrelated. All of this data is technically available. Excluded data: Privacy laws are quite strict now in the EU. The 'right to be forgotten' in an age where the internet forgets very little is also a significant concern these days. Because the RIPE Database is operated by the RIPE NCC, which is a company registered in the EU, all EU privacy laws apply to all the data held in the RIPE Database. This is a fact. There is no point having any further debate on this issue. So objects that contain only personal data will never be made available through any historical data interface. This includes the PERSON object. Because the ROLE object has been used interchangeably with the PERSON object over the last 20 years it has to be assumed that they may also contain mostly personal data. These objects are excluded from historical data. Operational objects include attributes that are considered to hold personal data. For example the "nic-hdl:" and various email, phone, address attributes are deemed to potentially hold personal data. This data is redacted from historical data in query results. A question that I don't believe has been put to the legal team is whether any case can be made to allow any of the redacted data to be legally included. In other words is there any gray area here? Can an argument be made that some data items, like say "nic-hdl:" are of sufficient interest to some groups, maybe investigators of hijacking resources or LEAs, that would overcome the EU's privacy concerns? Current service: Every time we discuss this issue some people keep turning the conversation onto the current service, who, why, what... It is what it is. It was explained in detail at the time in a RIPE Labs article: https://labs.ripe.net/Members/kranjbar/proposal-to-display-history-of-objec… Lets move on and discuss what you want rather than what you now have. Possibilities: -The focus will be, as it is now, on operational object data. With the one possible caveat on redacted elements mentioned above. -We can remove the arbitrary limitation on presenting history beyond a delete/re-created boundary. -We can allow historical queries on deleted data that does not exist in the database now as a 'current' object. (deleted but not re-created). -How do you want to access historical data? *through all RIPE Database query interfaces *only through a visual representation in RIPEstat *a dedicated whowas service *should historical data be available in bulk *could historical data be a part of the NRTM (in theory if historical operational data is available through unlimited queries, including deleted data, then it would be possible to data mine the entire historical data set) With big data technology, it is technically possible to present a view across the database at a given point in time. This would allow you to query the version of all objects which existed at that point in time. Whether this could be technically managed as a public service I don't know. Anything else that you would like regarding historical data? We can make this as simple or complex as you wish...if you have a use case and subject to legal constraints and technical challenges. Discuss..... cheers denis co-chair DB-WG

2 2

DBTF Questionnaire – Deadline Extended to 22 February 2021
by Bijal Sanghani 12 Feb '21

12 Feb '21

Dear colleagues, We’ve received 20 replies so far to the RIPE Database Requirements Task Force (DBTF) questionnaire. Thank you for that and the discussion on the mailing list. As we would like more feedback on these questions, we’ve decided to extend the deadline to 22 February 2021. The questionnaire takes less than 10 minutes and really will give us valuable feedback to consider for our final draft. You can take the questionnaire here: https://www.surveymonkey.com/r/ZM222M3 Thank you for your participation and support. Have a lovely weekend! Kind regards, Bijal Sanghani RIPE DBTF Chair

1 0

The DBTF needs your feedback!
by Ronald F. Guilmette 05 Feb '21

05 Feb '21

I am attempting to fill out this apparently endless survey, and it's obvious from the get-go that this whole thing was designed as an artificial device to justify the deep-sixing of critical WHOIS information which has traditionally been kept open and public. I mean seriously, who designed these questions? The way the questions are framed, they are all quite obviously pushing one particular point of view, and one specific political agenda, namely to excuse the hiding of information which has never before been hidden... and which does not need to be hidden, except for the benefit of criminals. Here's an example of how to frame a question in a way that pre- supposes one specific outcome: *) QUESTION: What would you prefer? 1) To be beaten and strangled to death? 2) To die of a horrible communicable infectious disease? 3) To be mercifully euthanized in your sleep? How about (4) NONE OF THE ABOVE? I'd actually like to go on living, if it's all the same to you. The survey questionare is positively jam packed with questions that are framed in this same manner... questions that, in effect, ask "How much information should we hide?" How about NONE OF THE ABOVE? Here is a concrete example from the questionaire: * 16. Rank this contact information from most (1) to least (3) important to facilitate Internet operations in the RIPE Database: Email address Phone number Fax number Well, hardly anyone ever sends FAXes anymore, so that one is a no-brainer. But the way the question has been formulated, it is obvious that *someone* wants to get rid of either phone numbers or email addresses in the contact data for various assigned resources, and that answers to this carefully crafted (and methodologically bogus) questionare are going to be used as a lame excuse to do that. I, for one, have seen this movie before... https://www.youtube.com/watch?v=ic6c3WvwbAw This kind of too-clever-by-half way of formulating questions in a way so as to get some desired set of pre-determined answers is both shameful and really beneath the dignity of RIPE. I suggest that the whole thing should be thrown out and replaced by the following single question: "Are you in favor of hiding the traditionally open WHOIS infornmation?" Then the folks who are in favor of allowing criminals in the RIPE region to hide behind GDPR can simply out-vote the rest of us and we can then wrpa up this entire sham process far more quickly and efficiently, saving time for all concerned, since the outcome has already been determined. Regards, rfg P.S. Whoever designed this survey form also does not believe, apparently, that any participant has the right to NOT have an opinion on any single one of the myriad of questions set forth. Do not pass GO and do not collect $200 UNLESS you have given answers even to the questions for which you have no opinion. P.P.S. Apparently, there is no constraint whatsoever on anyone who wishes to skew the results of this "survey" by simply filling in the form several thousand times. It's 2021. People are still running online surveys that can be trivially gamed?? <<me -- shakes head>>

6 7

Deprecation of whitepages
by denis walker 01 Feb '21

01 Feb '21

Colleagues Way back in 2008 it was suggested that the RIPE Database could be used for linking people well known within the network operating industry. The concept of 'whitepages' was introduced. This was an ORGANISATION object (ORG-PAGE1-RIPE) with 'org-type: WHITEPAGES' that could be referenced by PERSON objects to override the automatic deletion of PERSON objects not referenced by any resource object. In today's privacy world, it is a bad idea to use the RIPE Database as a phone book. Currently there are only 4 people whose PERSON object references this ORGANISATION object. (There are also 5 moderators referenced in the ORGANISATION object who have probably long since forgotten they had anything to do with it :) ) I think we should now deprecate this concept. LinkedIn is much more suited to keeping in touch with networking people. Comments appreciated... cheers denis co-chair DB-WG

11 16

"Hidden" historical WHOIS records
by Ronald F. Guilmette 01 Feb '21

01 Feb '21

The Co-Chairman's declaration that my prior post was off-topic for this mailing list... an assertion that I take strong exception to... has at least had the salutary effect of reminding me of a number of what I consider to be "open issues" -- issues which ARE quite unambiguously on-topic for this mailing list, and which I first broached here way back around December 3rd: https://www.ripe.net/ripe/mail/archives/db-wg/2020-December/006736.html At that time and ever since I do not believe that I have seen any resoponse to the clear and pointed questions I posed in the message linked to above. I thus am now obliged to restate and reiterate those still-pending questions. As part of my effort to clarify my goals, vis a vis historical WHOIS transparency, back on December 3rd I threw out what I felt would be a perfectly ludicrous and absurd suggestion, just for retorical purposes, in order to try to make a point. I said something along the lines of "Hey why don't you all just make the entire RIPE WHOIS data base private rather than public?" I felt sure that when I did this that at least some of the denizens of this list... at least the few who might still care about either transparency or accountability... would immediately recognize the utter absurdity of my retorical suggestion, and that those folks, at least, would get up on their hind legs to vigorously protest any such move away from the longstanding and historical open and public nature of the WHOIS data base in all five regions. I was thus shocked and more than a little dismayed to see some of the folks here on this list taking my suggestion as something other than the lame joke and retorical device it was intended to be. Some folks here, it seems, would be entirely fine with hiding literally *everything* from the eyes of outside and independent investigators, including but not limited to me personally -- outside and independent investigators who's only goals are honesty, fairness, and a lack of thievery and self-dealing on the part of RIPE "insiders". I will not mince words. I find this type of position and this type of orientation, in favor of secrecy and against transparency, to be nothing less than shameful. Who does secrecy and darkness help other than the criminal element within the RIPE region? Some of you may still remember the discussion which I engaged in here, on and around December 3rd. For those that do not, the above link may be helpful in refreshing your memories. At that time the subject at hand was the availability, or lack thereof, of access to historical RIPE records, in particular (a) access to records that have since been purged from the data base and also (b) access to the historical versions of various ostensibly "privileged" record types, specifically PERSON, ROLE, and MNTNER records. As noted above, to this day I have never seen an answer to the basic question that I had asked, back on December 3rd about access to either or both of these two broad categories of historical data, and more specifically, who, if anyone, decided or approved, unilaterally or otherwise, the notion that either of these two broad categories of historical data should be made unavailable. Thus, I ask yet again, who made these decisions to hide what was at one time open and public WHOIS data? I certainly do not wish to draw any improper or unjustified inference from the lack of response on this key point, but it quite certainly does seem to be the case, from where I am sitting, that nobody much wants to talk about how these decisions were made, let alone who made them. So, once again: Who exactly decided that these two categories of historical WHOIS records should be unavailable? Was this a decision of the membership and/or the community? Were these decision points / policy points debated openly and fairly, taking into account what may perhaps be multiple divergent views on the matter? Or did certain people in positions of power just make these decisions entirely unilaterally and without ever consulting anyone? I look forward to some clarity here as regards to how these decisions were made and who made them. I hope that others on this list, even if you may disagree with my personal preference for total openness and transparency of the data base, will at least join me in hoping that all -decisions- relating to data base access should at least be made in the clear light of day, and in an open and transparent manner. Regards, rfg P.S. I remind everyone that during the discussion back in early December it was noted that a relevant policy proposal had already been lingering in a state of suspended animation for some years already. Perhaps someone can help me out here. I have been searching for the reference to the specific (still pending?) policy proposal in question but I can't seem to find it now.

4 3

The DBTF needs your feedback!
by Bijal Sanghani 01 Feb '21

01 Feb '21

Dear colleagues, The DBTF (RIPE Database Requirements Task Force) would like to thank those that have given feedback so far on the published draft document - https://www.ripe.net/participate/ripe/tf/rdb-requirements-tf/the-ripe-datab… We appreciate the feedback given so far, however need a little bit more clarity on some aspects and have therefore published a new questionnaire to collect further feedback. Please can you take a few moments to compete this survey - https://www.surveymonkey.com/r/ZM222M3 You have until Monday, 15 February 2021 and the results will be reviewed and integrated by the task force in the final draft. More information about the task force is available at - https://www.ripe.net/participate/ripe/tf/rdb-requirements-tf Thank you for your participation! Kind regards, Bijal Sanghani RIPE DBTF Chair

1 0