- db-wg - mailman.ripe.net

Re: [db-wg] Complying with Mail Provider Requirements When Sending Mail from Whois
by Lutz Donnerhacke 15 Mar '24

15 Mar '24

> In this release, we will implement mail bounce detection (i.e. an outgoing > message has permanently failed delivery) and also unsubscription (i.e. one- > click unsubscribe from a mail client). Once an address is undeliverable or > unsubscribed, we will not send further Whois update acknowledgements or > notifications to that address. However we will continue to send targeted > notifications where required by RIPE policy (e.g. abuse-c validation, RIPE- > NONAUTH route object cleanup etc.). Thank you for your ongoing work and please forgive my ignorance on this subject. IIUC, all addresses, which are unavailable for the sending RIPE MTA once, will be blocked until manual interference. The cause of this error might be located in the RIPE MTA, the RIPE uplink, a global network routing issue, a peering issue, our uplink, our local MTA, or even a DNS(sec) issue. In consequence we will not receive any notifications anymore unless we try to update the very object in question and read the warning box the RIPE-DB update web form. Hence we can't rely on the email notifications anymore?

2 1

NWI-4: Preferred Solution Definition
by Edward Shryane 14 Feb '24

14 Feb '24

Dear colleagues, During the interim meeting on 17th January: https://www.ripe.net/community/wg/active-wg/db/interim-sessions/interim-ses… The two proposed solutions to NWI-4 were discussed, namely, either add a new combined "status:" value "ALLOCATED-ASSIGNED PA": https://www.ripe.net/ripe/mail/archives/db-wg/2022-December/007722.html Or combine the prefix and status tuple as a primary key: https://www.ripe.net/ripe/mail/archives/db-wg/2023-September/007913.html I proposed to go ahead with the new combined "status:" solution as it has fewer drawbacks and appears to be the preferred option from the community, pending the co-chairs to declare consensus on the solution. Please let me know if you have any comments or concerns. Regards Ed Shryane RIPE NCC

1 0

DB WG interim session January 2024
by David Tatlisu 06 Feb '24

06 Feb '24

Hi, Picking up from RIPE87, the first interim working group session for the Database Working Group is planned for 17 January 2024, 15:00–16:00 UTC. The following topics are on the agenda right now: * Discussing the two possible solutions for NWI4 (multivalued status:) * Discussing the use of UTF-8 in the RIPE database * Following the recent breach, feedback on how authentication could be improved * Leo Vegoda and Dmitry Kohmanyuk would like to talk about alternative modes of contact in the RIPE database * Any other business Kind regards, Denis, William, and David https://ripe.zoom.us/j/99068479472 Alternatively, dial by your location • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 669 444 9171 US • +1 669 900 9128 US (San Jose) • +1 689 278 1000 US • +1 719 359 4580 US Meeting ID: 990 6847 9472 Find your local number: https://ripe.zoom.us/u/adsp2SzA80

5 6

geolocation purpose
by Maria Stafyla 24 Jan '24

24 Jan '24

Hello all, As you may have seen in the minutes from the RIPE NCC Executive Board's most recent meeting (on 6 October 2023), the Executive Board approved the amendments to the RIPE Database Terms and Conditions. The RIPE Database Working Group had reached consensus that the provision of geolocation information should be included in the list of purposes of the RIPE Database. Accordingly, the approved amendments to the RIPE Database Terms and Conditions include this new purpose and replace the pronouns 'he/she' with the gender-neutral singular 'they'. You can access the RIPE NCC Executive Board Meeting minutes at: https://www.ripe.net/about-us/executive-board/minutes/2023/minutes-168th-ex… And the updated RIPE Database Terms and Conditions are available at: https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms In the next whois release, we will remove the prefix size validation rules, which we had to implement to restrict unnecessary processing of personal data when geolocation was not yet a defined purpose of the RIPE Database. If you have any questions, please let us know. Kind regards, Maria Stafyla Senior Legal Counsel RIPE NCC

2 1

Re: [db-wg] [ncc-services-wg] Enforce 2FA for RIPE NCC Access account
by Daniel Suchy 04 Jan '24

04 Jan '24

Hi, Denis is right, the problem isn't only RIPE access and I aggre DB needs to be redesigned in terms of security - we're talking not only about LIR portal and RPKI dashboard, which caused issue with Orange. If you break objects in DB in similar manner (as-sets, route objects), you'll cause similar outage - just because many upstreams and IXP use these data to build their prefix filters. Maybe the destruction will not be so fast... For some methods (restAPI) you need password linked to maintainer object. And all passwords here are still stored in MD5! Yes, this is year 2023. There's no other option [1]... All this is one big ticking bomb... I don't want to guess what could happen if the internal in case of internal RIPE database leak. Just because we're still storing some passwords in prehistoric way. It's not only about LIR accounts, risks are also hidden in maintainer objects, which can be used outside LIR portal. And it's out of reach of one working group. Trivialization of risks is highway to hell. And there're more things, which needs better protection - not only RPKI ROAs. - Daniel [1] https://apps.db.ripe.net/docs/Authorisation/Authorisation-Model/#solving-au… On 1/4/24 21:24, Jim Reid wrote: > IMO, no. Your question is a bit like asking what colour the new carpets should be while the house is on fire. :-) > > The first priorities should be to plug the security issue(s), secure the exposed LIR accounts and do an audit/impact analysis. Discussions about next steps can wait until these have been done. Those next steps may well include a redesign of the RIPE database. Though I think other things would need attention before that: revising the RIPE Access requirements, introducing 2FA, assessing the report about the latest breach, etc. > > It seems premature to debate changes to the database when it’s not yet clear what needs to be done. That may well be clear to you Denis. But perhaps your thoughts will need a reassessment in light of this security breach. > >

1 0

Warning: This Syncupdates request used insecure HTTP
by Peter Hessler 27 Dec '23

27 Dec '23

I was doing some object updates / creation on https://apps.db.ripe.net/db-web-ui/syncupdates and I got this warning while doing so: ***Warning: This Syncupdates request used insecure HTTP, which may be removed in a future release. Please switch to HTTPS. I'm using https to apps.db.ripe.net, so I assume it is the backend that is in http mode. Can this be updated before insecure http mode is removed? Thanks! -- Nothing is illegal if one hundred businessmen decide to do it. -- Andrew Young

2 1

RIPE Database Quarterly Planning Q1 2024
by Edward Shryane 20 Dec '23

20 Dec '23

Dear colleagues, The next quarterly plans for the RIPE Database are now available on our website: https://www.ripe.net/manage-ips-and-asns/db/quarterly-planning In this quarter, we will continue with our day-to-day operations and work on the implementation of the RDAP 'RIR Search' feature. By sharing these plans with you, we want to inform you of the ongoing developments on the RIPE Database and get your feedback on other work items you would like us to focus on. If you have comments or questions around this, we hope you'll let us know on the list or you can always contact the DB team directly at ripe-dbm(a)ripe.net . Regards, Ed Shryane RIPE NCC

1 0

Whois 1.109.1 Release
by Edward Shryane 20 Dec '23

20 Dec '23

Dear colleagues, Following the Whois 1.109 release on Monday, we found a regression affecting all RDAP queries for an organisation entity containing a "country:" attribute. We have now deployed a Whois 1.109.1 release which fixes this regression to the Release Candidate environment for testing. We plan to deploy to production on Wednesday 20th December. The data in the RC environment is a dummified copy of production from 16th November. The release is tagged on GitHub: https://github.com/RIPE-NCC/whois/releases/tag/acc20f73 More information on the Release Candidate environment can be found on our website: https://apps.db.ripe.net/docs/Release-Notes/ Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

1 1

Re: [db-wg] Proposal to allow non-ASCII characters in "org-name:", "person:" and "role:" attributes
by Ángel González Berdasco 18 Dec '23

18 Dec '23

It's nice to see you here, Marco. I don't think it will be possible to change the default without potentially causing problems for clients not expecting that. Adding that -C option to the server seems appropriate, and unless you expect that at one point there will be no clients not providing that, you will face the issue that if the default changes from iso-8859-1 to utf-8, old clients will be wrong, as you can't get every client to be updated at the same time. The most similar situation would be if you had a predefined epoch at which both server and clients would change the encoding. But it still requires all clients to have been updated, and the date having been agreed far in advance (and not posponed later!). A situation that could help would be if the server marked the encoding so that the client could recognise the output is no longer iso-8859-1, but utf-8, such as including a BOM (although it may be preferable to include that inside a comment rather than at the beginning, I see benefits both ways), and thus old-but-not-ancient clients could autodetect the switch. Most likely, the server default will not change, though. Best regards -------- Original message -------- From: Marco d'Itri via db-wg <db-wg(a)ripe.net> Date: 12/18/23 00:44 (GMT+01:00) To: Piotr Strzyzewski <piotr(a)internetsailor.net> Cc: db-wg <db-wg(a)ripe.net> Subject: Re: [db-wg] Proposal to allow non-ASCII characters in "org-name:", "person:" and "role:" attributes On Dec 03, Piotr Strzyzewski via db-wg <db-wg(a)ripe.net> wrote: > As the UTF-8 topic was briefly discussed during DB-WG session at RIPE87 > in Rome, I would like to propose moving forward with it. If that means a > topic for first (?) interim meeting, let it be. Let me know please if > this works for you. Thanks in advance. In Rome I talked a bit with Edward about this. Background: I am the author of the whois client used by all Linux distributions. I fully agree that switching to UTF-8 is desirable, but we cannot just change the encoding of port 43 without major side effects. Since version 5.5.4 (december 2019), the client assumes that the output of whois.ripe.net is Latin 1 and then transcodes it to the system encoding. Receiving unexpected UTF-8 would cause mojibake. My suggestion is to add a new query "command line" option to specify the desired encoding (limiting it to either ISO-8859-1 or UTF-8), as supported by other whois servers. -C is the most common choice, but maybe it would be better to use --charset to not waste a single letter option. See https://github.com/rfc1036/whois/blob/next/servers_charset_list . In a few years then it will be much easier to switch the default from Latin 1 to UTF-8. -- ciao, Marco

1 0

Whois Release 1.109
by Edward Shryane 04 Dec '23

04 Dec '23

Dear colleagues, RIPE Database release 1.109 has been deployed to the Release Candidate environment for testing. We plan to deploy to production on Monday 4th December. The data in the RC environment is a dummified copy of production from 16th November. This release has the following main changes: * RDAP redaction (#1317) * Removed organisation "e-mail" from RDAP to match Whois and added to redaction list (#1333) * Removed geofeed prefix validation (#1326) * Added HTTPS Support to Whois Backend (#1329) * Support HTTP Basic authentication (#1342) * Support HTTPS Client Certificate Authentication (#1343) * Initialize NRTMv4 from command-line (JMX) (#1310) * Use parallel stream to generate NRTMv4 snapshots more quickly (#1309) * Include AS-SET in RIPE-NONAUTH dump (#1352) The release notes are on the website: https://apps.db.ripe.net/docs/Release-Notes/#ripe-database-release-1-109 More information on the Release Candidate environment can be found on our website: https://apps.db.ripe.net/docs/Release-Notes/ Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

1 1