- db-wg - mailman.ripe.net

Whois Release 1.97.1
by Edward Shryane 06 May '20

06 May '20

Dear Working Group, RIPE Database release 1.97.1 has been deployed to the Release Candidate environment. We plan to deploy to production on Wednesday 6th May. This is a bugfix release, with no new functionality. The release notes are on the website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… More information on the Release Candidate environment can be found on our website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/rc-release-candid… Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

1 1

RIPE Database Requirements Task Force BoF
by Bijal Sanghani 06 May '20

06 May '20

Dear colleagues, The RIPE Database Requirements Task Force (DBTF) will organise its BoF on Wednesday, 6 May from 14h00-15h00 CEST via Zoom. During this BoF, the DBTF will present its latest work and invite participants to discuss what functionality the RIPE Database should provide in the future. The presentation will include quick polls and will be followed by a moderated Q&A. You can register for the BoF at (no Zoom account required): https://ripe.zoom.us/meeting/register/tJMkd-yhrz4uHNDuOIBm8hGvcj8DSDK1Ybog <https://ripe.zoom.us/meeting/register/tJMkd-yhrz4uHNDuOIBm8hGvcj8DSDK1Ybog> We look forward to discussing the future of the RIPE Database with you! Kind regards, Bijal Sanghani on behalf of the DBTF

2 1

New on RIPE Labs: Cleaning Up Locked Person Objects in the RIPE Database
by Mirjam Kuehne 30 Apr '20

30 Apr '20

Dear colleagues, Unmaintained person objects in the RIPE Database were locked by the RIPE NCC so they could not be used to hijack resources. Now we plan to set the correct user maintainer on those person objects. Please find more details in this RIPE Labs article: https://labs.ripe.net/Members/ed_shryane/cleaning-up-locked-person-objects-… Kind regards, Mirjam Kühne RIPE NCC

1 0

RIPE NCC Executive Board election
by Ronald F. Guilmette 17 Apr '20

17 Apr '20

Greetings all, I know that all is not right with the world right now, and that most of you, like me, have much more pressing things on your minds right now, but someone just sent me the following link and I cannot exactly ignore it: https://www.ripe.net/participate/meetings/gm/meetings/may-2020/confirmed-ca… I would like to call everyone's attention to the last of the three candidates who have, it seems, "qualified" as candidates for open seats of the RIPE NCC Executive Board. As I have already said, I know that things are bad in the world right now, but I must ask this question: Is there really no one other than these three candidates who is willing and/or able to stand for the three open seats on the RIPE NCC Executive board... three open seats that will be voted on at the next general meeting, 13-15 May 2020 ? If not, then it seems that RIPE NCC will soon be following in the new tradition, established first by AFRINIC only last year, of placing well and widely known crooks on it board. I desperately hope it won't come to that, but that is not for me to decide. The decision is in your hands dear friends. Regards, rfg

4 5

poetic-form mnt-by/creation
by Cynthia Revström 14 Apr '20

14 Apr '20

Hello DB-WG, I would just like to make the working group aware of the fact that currently anyone can create a new poetic-form and it doesn't require the LIM-MNT to be used. I am not sure if this is intended or not, but I thought it was worth posting about if anyone has input on it. Considering the poem objects require the LIM-MNT as mnt-by I don't think this was really the intended situation. - Cynthia

2 1

Whois Release 1.97
by Edward Shryane 01 Apr '20

01 Apr '20

Dear Working Group, RIPE Database release 1.97 has been deployed to the Release Candidate environment. We plan to deploy to production on Wednesday 1st April. The major change in this release is to open the NRTM service (regardless of membership status). The release notes are on the website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… More information on the Release Candidate environment can be found on our website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/rc-release-candid… Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

4 4

Re: [db-wg] API keys for database maintenance
by Gunnar Guðvarðarson 23 Mar '20

23 Mar '20

Hey, My main issue with API Keys is them being attached to SSO accounts. What about when the employee leaves the company? He gets removed from auth on the mntner, all the apps he set-up break? Making admins hesitant about removing user access. API access needs to be bound to the mntner in some form imho. Additionally, would api keys allow querying the API and getting unfiltered data? Or would it just be for `post`ing updates to objects? -- I suspect the signed updates have little usage for two major reasons: * Figuring out if the update succeeded requires receiving and parsing emails * Figuring out if the object is up to date on the ripe database is practically impossible* due to filtering (auth: SSO# Filtered) Sending requests with x509 client cert auth means you know who is sending the request and you have no need to filter data (like the auth sso entries) out for objects the mntner has permissions for, making idempotent api clients so much easier to make. -- The logic i might want to implement, in pseudocode: while true mntners = database(mntners) foreach mntners as mntner objects = rest api request for all objects with mnt-by = mntner foreach objects as object if object not in database notify admin .... or delete it continue if object == database(object) continue rest api request to update object with data from database sleep for a while -- p.s. sorry about my earlier, mangled email, my email client seems to have gone a bit nuts... * okay not "impossible" but really annoying, you'd have to store the last updated timestamp from ripe, for all objects, and if it changes in the ripe db, then we'd have to post the object to see if it changes? ________________________________ From: Edward Shryane Sent: Wednesday, March 18, 2020 15:29 To: Gunnar Guðvarðarson Cc: Tore Anderson; db-wg(a)ripe.net Subject: Re: [db-wg] API keys for database maintenance Hi Gunnar, We're indeed also working on Client Certificate authentication (we have tested it, and now it's pending a security review). However, to make use of this, a user must: - Generate an X.509 certificate - Extract the certificate as text and create a key-cert object from it - Associate the key-cert with a maintainer in an auth: attribute - Configure the Whois client to send the client certificate when connecting to the REST API (or Syncupdates). This is not trivial to do, and we can see that although signed updates are supported in Whois, it has low usage. It is still worthwhile to support this, as the credential (secret) is only stored locally on the client. Hopefully API keys will be more "user friendly" and can be used in preference to MD5 hashed passwords. Regards Ed Shryane RIPE NCC > On 18 Mar 2020, at 09:45, Gunnar Gušvaršarson <gunnar.gudvardarson(a)advania.is> wrote: > > Hey,I think that if we get x509 client certificate authentication for the API working, it might even be easier. > All the UI to add certs and auth them on mntners is already there, the web services just need endpoints that request and use client provided certs. > https://github.com/RIPE-NCC/whois/issues/534

3 2

RIPE Database Requirements
by ripedenis＠yahoo.co.uk 19 Mar '20

19 Mar '20

Colleagues The RIPE Database Requirements Task Force recently published notes on their last meeting showing some of their current thinking and progress so far. This can be read here:https://www.ripe.net/ripe/mail/archives/ripe-db-requirements-tf/2020-M… I am going to play devil's advocate and make a few comments and raise a few questions on this and throw in some issues that may not have been discussed. Some of you may wish to make other comments or discuss some of the points... cheers denis co-chair DB-WG public - should all/some/none of the RIPE Database data content be public? As a public registry, what data is needed by which stakeholders for this to be a useful registry? It is clear from the recent survey that the RIPE Database is used for other purposes, like IPAM. It was suggested in the notes that this could be offered as a separate service. The RIPE Database involves a considerable amount of infrastructure to provide a very reliable and resilient service. Why duplicate that for another service or provide a lesser service if it can be incorporated into the RIPE Database as non public data? So a requirement could be that the RIPE Database will provide a range of IPAM (and maybe other) services to resource holders using non public data. Or perhaps a mix of (non)public data. RPSL - whether or not the RIPE Database stores data internally in RPSL format is a design/technical issue, not a requirement concern. The requirement could be that the RIPE Database uses a common, simple format for managing the data content. This format will be reflected in the user interfaces. Where RPSL is required, a conversion of data content into/from RPSL option will be provided. geolocation - This and the "language:" option were originally added as an experimental service without any concrete requirement. Although it has been discussed several times since, no decision was ever made about it. There were always a few people who liked it, a few who didn't, most had no opinion. Some questions that perhaps need to be answered are:-Once you have a definition of what geolocation means (in the context of the RIPE Database), can the RIPE Database provide a viable and accurate service within that definition?-Can it provide a service with additional/complementary benefits to existing 3rd party services, or will it simply replicate or conflict with existing services?-Is such a service of sufficient benefit to the community/public to justify the effort to maintain it (as an optional/mandatory service)? Postal and Legal address - The RIPE Database T&C says in Article 3 one of the purposes is:"Providing information about the Registrant and Maintainer of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information."Article 10 says the governing law is that of the Netherlands.-Does Dutch law permit such information to be given directly on request to any relevant party or only to/via the Dutch police or Dutch court? In particular other (pan)national LEAs?-The purpose in the T&C does not define the process. Does the Dutch law require this to be with a subpoena or will a formal letter be sufficient? person/role - I don't see the bigger questions being asked:-Is there a need for ANY personal data in the RIPE Database?-If so what, how much, for what purpose, which stakeholders need access to which parts of it?-Should personal data be public? irt - Perhaps we shouldn't get too hung up on numbers of objects or queries. They have a clearly defined role in a specialist area. The numbers are never going to be high. The main question seems to be:-is it a useful service to the (security) community? UTF8 - Something that may not have been discussed yet, but perhaps it is crying out to be considered at a requirement level. The technical aspect has been looked at several times by the RIPE NCC, but it never moves forward because of the social/political/registry/legal issues which cannot be resolved at the technical level:-Should we allow all/some/none of the data content to be in non Latin characters?-Is there some data content that must be in Latin characters (for the correct functioning of the registry?), some that can be duplicated in Latin and local characters, some that can be in any format chosen by the resource holder?-Who can make these decisions (this is the bit that has been missing ever since the subject was first raised)? RIPE Database Purposes - The DBTF preliminary list of purposes does not cover all the currently defined purposes in the RIPE Database T&C. Were the ommisions intentional?

1 0

API keys for database maintenance
by Tore Anderson 18 Mar '20

18 Mar '20

Hi WG. In the LIR Portal, at https://lirportal.ripe.net/api/, it is possible to issue API keys for use with several different RIPE NCC services. However, it is unfortunately not possible to issue API keys for the two APIs that are used for database maintenance; Syncupdates and the RESTful API. The documentation implies that the only authorisation [sic] method for those APIs is MD5-PW. I propose that the API keys mechanism is extended to Syncupdates and the RESTful API. The already existing default maintainer concept could be leveraged to accomplish this (similar to how NWI-8 was implemented). That is, using Syncupdates or the RESTful API with API keys will simply authenticate the client as the LIR's default maintainer. Authorisation should remain handled by in-band mnt-* object attributes, as is currently the case. It would be an acceptable limitation that API keys for database maintenance are unavailable for LIRs without a default maintainer. Assuming the WG agrees that this is a good idea, I request an NWI. Tore

6 12

RIPE DB V2 (Perl) code
by Joao Luis Silva Damas 17 Mar '20

17 Mar '20

Does anyone have a copy of the Perl version of the RIPE DB code. I am looking for some code that I know was there and worked well (was fully debugged) but the RIPE FTP site no longer has v2 or v3 code that I can find (while it still has a copy of the WAIS source code!) So, does anyone have a copy that they can send around, please? Joao

1 1

RIPE Database E-Learning Course Launched
by Evelien Schilder 26 Feb '20

26 Feb '20

Dear RIPE Database Working Group, On behalf of the RIPE NCC Academy team, I would like to let you know that we have launched the updated RIPE Database e-learning course. Here are some of the major changes: - We modularised the content. You can now learn a new topic whenever you have 15 minutes to spare. - The modules are more interactive, and include practical exercises and scenarios. - The Training Database has been upgraded to the latest version of the RIPE Database software. The RIPE NCC Academy, our free, open e-learning platform has been revamped. It has received a visual upgrade. You can visit it at: https://academy.ripe.net <https://academy.ripe.net/> Kind regards, Evelien Schilder E-Learning Developer RIPE NCC

1 0

Update RIPE MNT records
by Mohamed Eldemiri 22 Feb '20

22 Feb '20

Hello RIPE support , In the past few years, our organization has gone through a privatization program by the government of Kuwait. Kuwait Stock Exchange has been changed now to Boursa Kuwait our old domain was kuwaitse.com is now boursakuwait.com.kw. The MNT ID and email is still pointing to old inaccessible domain ID, Anyway, the phone number & address are still the same, and the contact person still with Boursakuwait looped in this mail with his new email id 'ybaniyan(a)boursakuwait.com.kw'. Do you have any idea how to change these records? I have contacted the local registrar LR: Fast Telco and they said this must be done through the RIPE and they are not authorized to change these registration parameters. We will adhere to provide all the supporting official documents and memos that RIPE might asking for this change. LIR : Fast Telecommunications Company W.L.L. P.O.Box 287 15453 Dasman KUWAIT phone: +96522256666 fax: +96522401925 e-mail: ripeadmin (at) fasttelco (dot) net Areas serviced: KW 195.137.174.0/24 AS# 49104 Domain : BoursaKuwait.com.kw<https://dnslytics.com/bgp/as49104> % Abuse contact for '195.137.174.0 - 195.137.174.255' is 'abuse(a)fasttelco.net' inetnum: 195.137.174.0 - 195.137.174.255 netname: Kuwait-Stock-Exchange country: KW org: ORG-KSE1-RIPE admin-c: YA443-RIPE tech-c: YA443-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-END-MNT mnt-by: MNT-Kuwait-Stock-Exchange mnt-routes: MNT-Kuwait-Stock-Exchange mnt-domains: MNT-Kuwait-Stock-Exchange created: 2005-09-20T07:36:57Z last-modified: 2016-04-14T08:28:19Z source: RIPE # Filtered sponsoring-org: ORG-FTC1-RIPE organisation: ORG-KSE1-RIPE org-name: Kuwait Stock Exchange org-type: OTHER address: P.O. Box 22235 - Safat - Kuwait abuse-c: AR25180-RIPE mnt-ref: MNT-Kuwait-Stock-Exchange mnt-by: MNT-Kuwait-Stock-Exchange created: 2005-09-19T11:59:15Z last-modified: 2014-11-17T21:01:58Z source: RIPE # Filtered person: Yousef Abbas address: Kuwait City phone: +965 22992576 nic-hdl: YA443-RIPE created: 2009-07-27T06:57:06Z last-modified: 2016-04-06T19:52:01Z mnt-by: RIPE-NCC-LOCKED-MNT source: RIPE % Information related to '195.137.174.0/24AS49104' route: 195.137.174.0/24 descr: Kuwait Stock Exchange origin: AS49104 mnt-by: MNT-Kuwait-Stock-Exchange created: 2009-04-16T10:13:58Z last-modified: 2009-04-16T10:13:58Z source: RIPE Regards, Mohamed Eldemiri Network Administrator [cid:image001.png@01D5E970.A74CE0E0] Address: Mubarak Al Kabeer Street, Kuwait City, Kuwait P.O.Box: 22235, Safat, 13083 Kuwait Telephone: +(965) 2299-2595 Mobile: +(965) 55266079 Fax: +(965) 2244-0476 www.boursakuwait.com.kw Disclaimer: This e-mail message and any files attached to it are intended only for the recipients named above. The information in this e-mail is confidential and may be legally privileged. If you are not the intended recipient or have received this e-mail by error, you must not use or disseminate the information and must promptly notify the sender and delete this e-mail immediately. Unless otherwise explicitly provided in the body of this e-mail, neither this e-mail nor any attachment hereto is intended to operate as a commitment of whatever type or to include an electronic signature of whatever form under any applicable law. Opinions, conclusions and other information in this email that do not relate to the official business of Boursa Kuwait. Shall be understood as neither given nor endorsed by Boursa Kuwait. Although this email and any attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that it is virus free. Boursa Kuwait accepts no responsibility for any loss or damage arising in any way from the use of this email.

1 0

NWI-1 overview of abuse contacts for resources
by ripedenis＠yahoo.co.uk 21 Feb '20

21 Feb '20

Colleagues I said at Ripe 79 that I would review the open NWIs. So lets start with NWI-1. This has been open and virtually static since 2016. The original summary is here:https://www.ripe.net/ripe/mail/archives/db-wg/2016-May/005234.html The situation has changed since then with the "abuse-c:" attribute now allowed in resource objects. The main point I was making (as one of the authors of this NWI) is that there is no easy way for a resource holder to view all the abuse contact details for any of their resources. Hierarchical queries for abuse contacts only search 'up' the hierarchy. There is no easy way for the resource holder to search 'down' through the hierarchies to find all/any abuse contact details. These can now be added at any point in a hierarchy and forgotten about. But they are still active and may present the wrong information when people query for these details. The question now is "Do we need a search/query option or RIPEstat widget that will present an overview of all abuse contacts from a resource allocation down the hierarchy, or even for all of an organisation's resources?" cheers denis co-chair DB-WG

1 0

2018-06 Proposal Implemented (RIPE NCC IRR Database Non-Authoritative Route Object Clean-up)
by Edward Shryane 31 Jan '20

31 Jan '20

Dear Working Group, The RIPE NCC Database team have now implemented the 2018-06 proposal (now ripe-731), "RIPE NCC IRR Database Non-Authoritative Route Object Clean-up". We plan to deploy this to production on Wednesday 15th January. A nightly job will run from that evening onwards. We expect approximately 965 route objects will be initially marked for cleanup (which will happen 2 weeks after that). Regards Ed Shryane RIPE NCC > > From: Petrit Hasani <phasani(a)ripe.net> > Subject: [policy-announce] 2018-06 Proposal Accepted (RIPE NCC IRR Database Non-Authoritative Route Object Clean-up) > Date: 6 November 2019 at 16:03:18 GMT+1 > To: policy-announce(a)ripe.net > > Dear colleagues, > > Consensus has been reached on 2018-06, "RIPE NCC IRR Database Non-Authoritative Route Object Clean-up". > > This proposal aimed at creating a process to delete a non-authoritative object stored in the RIPE IRR, if it conflicts with an RPKI ROA. > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2018-06 > > The new RIPE Document is called ripe-731 and is available at: > https://www.ripe.net/publications/docs/ripe-731 > > We estimate that this proposal will take around two to three months to fully implement. > > We will send another announcement once the implementation is complete and the new procedures are in place. > > Thank you to everyone who provided us with your input. > > Kind regards, > > -- > Petrit Hasani > Policy Officer > RIPE NCC > > > > >

4 4

NWI-10 country attribute
by ripedenis＠yahoo.co.uk 27 Jan '20

27 Jan '20

Colleagues The chairs of the DB-WG declared a consensus on NWI-10 at RIPE 79. This is to add a "country:" attribute to the ORGANISATION object which will be managed by the RIPE NCC in ORGANISATION objects for resource holders. This email is to document that consensus and ask the RIPE NCC to implement this change. cheers denis co-chair DB-WG

2 1

RIPE Database Usage Survey - Database Requirements Task Force
by Boris Duval 20 Jan '20

20 Jan '20

Dear Colleagues, The RIPE Database Requirements Task Force (DBTF) needs your feedback! The DBTF has just launched a survey to know more about how the RIPE Community uses the RIPE databases. The results will provide feedback to the RIPE Database Task Force to help understand the relevance of the database to the RIPE Community and to help shape future RIPE Database policy. You can take the survey at: https://www.surveymonkey.com/r/PC9HTYP <https://www.surveymonkey.com/r/PC9HTYP> The deadline to answer the survey is 31 January. Feel free to share it with your network. Many thanks! Best, Boris Communications Officer RIPE NCC

1 0

NWI-9: Making the Whois NRTM Service Public
by Edward Shryane 16 Jan '20

16 Jan '20

Dear colleagues, Last month, as part of the DB-WG NWI-9 proposal, the RIPE NCC Executive Board resolved to make the Whois NRTM Service public. The full minutes of the Board meeting are on our website: https://www.ripe.net/about-us/executive-board/minutes/2019/minutes-130th-ri… We will now start working on all aspects related to implementing this decision and will have more details for you soon. Regards Ed Shryane RIPE NCC

2 1

database support for ed25519 PGP keys
by Marco d'Itri 19 Dec '19

19 Dec '19

Can RIPE staff clarify if there are plans to support PGP authentication of database updates using ed25519 keys? This should require not much more that upgrading gnupg to a modern release. -- ciao, Marco

2 1

converting a C class from PI to PA
by Franco Tauceri 19 Dec '19

19 Dec '19

Hello. What's the right how-to convert an existing C class from PI to PA? According to this: https://www.ripe.net/manage-ips-and-asns/ipv4/converting-pi-to-pa "Members can request this update via the LIR Portal." ... but I was not able to find HOW this may be done (If I try to edit the object, the field "status" is locked, and I can't edit it anyway... while I can edit other fields as usual) Regards -- Franco Tauceri DomainRegister m: 39.3483064202 w: https://DomainRegister.international e: franco.tauceri(a)domainregister.it

3 2

Whois Release 1.96
by Edward Shryane 04 Dec '19

04 Dec '19

Dear Working Group, RIPE Database release 1.96 has been deployed to the Release Candidate environment. We plan to deploy to production on Wednesday 4th December. This release contains the following main changes since 1.95.1: * Added "country:" attribute to organisation object type * Deprecated "mnt-lower:" attribute in autnum object type * Abuse-c validation comment must refer to the LIR organisation * Limit number of results in full-text search queries * Apply query limit to version queries For a full list of changes, refer to the release notes: https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… More information on the Release Candidate environment can be found on our website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/rc-release-candid… Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

1 1

Removing the "mnt-lower" attribute from aut-num objects
by Edward Shryane 03 Dec '19

03 Dec '19

Dear Colleagues, as presented during the DB-WG session at RIPE 79, we plan to remove the "mnt-lower" attribute from the aut-num object type. From the RIPE database documentation [0]: “mnt-lower: This attribute has no meaning in the aut-num object. In the RIPE NCC service region, we do not allocate blocks of AS numbers for users to assign from. All AS numbers are assigned by the RIPE NCC therefore there is no hierarchy to ‘maintain’ or authorise against. This attribute should be deprecated.”  We plan to implement this change in the next Whois release (we will announce this separately). We do not expect any operational impact. It is currently an optional attribute. This attribute will be removed (with a warning) from any aut-num updates. At the same time, we plan to remove this attribute from approximately 948 of 35,144 aut-num objects. We will announce separately to the db-wg and affected maintainers, before and after removal. Please let me know of any feedback or questions you may have. Regards Ed Shryane RIPE NCC [0] https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-data…

1 1

Removing the Legacy Status "remarks" attribute
by Edward Shryane 03 Dec '19

03 Dec '19

Dear Colleagues, As presented during the DB-WG session at RIPE 79, we plan to remove the legacy status "remarks" attribute from inetnum and aut-num objects in the RIPE database. This remark was added to LEGACY resources in 2015, when implementing the policy 2012-07 "RIPE NCC Services to Legacy Internet Resource Holders” [0]. The remark states: "For information on "status:" attribute read https://www.ripe.net/data-tools/db/faq/faq-status-values-legacy-resources” We now consider this remark to be obsolete, and have already performed a similar cleanup on (most) aut-num objects in August 2017. We plan to shortly remove this remark from approximately 19,059 inetnum and 15 aut-num objects, and will email affected maintainers before and after the change. Please let me know of any feedback or questions you may have. Regards Ed Shryane RIPE NCC [0] https://www.ripe.net/participate/policies/proposals/2012-07

1 1

Internationalized domain names in the data abase?
by Ronald F. Guilmette 08 Nov '19

08 Nov '19

Sorry if I am interrupting any ongoing discussion, but I just have a quick and simple question... Is it permitted to have internationalized domain names appear within the database? By that I really mean to ask if it is permissible to have there appear in the data base IDNs which are written in their UTF-8 encoded forms, rather than, say, in punycode? I have found at least one specific case where an IDN does appear in the data base as a UTF-8 encoded string, but since I had never seen that before, I just wanted to know if that was an anomalous mistake or if it was consider normal, acceptable, and routine.

4 15

Re: [db-wg] NWI-10 Definition of Country
by Arash Naderpour 08 Nov '19

08 Nov '19

Hi Denis, What you name it as "meaningless values" are not meaningless to the organizations that they are using it. When you request a new allocation from NCC you will be asked to *"specify the country which the allocation will be announced"*, and based on your selection the country code will be set for both the inet(6)numns and allocation entry in the delegation file. This is the way that the country code is added in first place in delegation file. A member may decides to use the allocation later in a different country, and they can update the country code for inet(6)numns in ripe db, so I think the best practice is to sync the delegation file with the database and let the members decide what value should be set. Regards, Arash Naderpour On Fri, Nov 1, 2019 at 11:50 PM denis walker <dw100uk(a)yahoo.co.uk> wrote: > Hi Arash > > If many organisations are using these values then, unfortunately, you are > basing decisions on meaningless values. > > The country attribute in resource objects is undefined. Users can set this > to any country they wish with no meaning to anyone reading the value from > the database. > > From the description of the extended delegated stats file > ftp://ftp.ripe.net/ripe/stats/RIR-Statistics-Exchange-Format.txt > > it says this about the country code: > > Format: > > registry|cc|type|start|value|date|status[|extensions...] > > registry = One value from the set of defined strings: > > {apnic,arin,iana,lacnic,ripencc}; > > cc = ISO 3166 2-letter country code, and the enumerated > variances of > > {AP,EU,UK} > > These values are not defined in ISO 3166 but are widely used. > > The cc value identifies the country. However, it is not specified > if this is the country where the addresses are used. > There are no rules defined for this value. > It therefore cannot be used in any reliable way to map IP addresses > to countries > > If you were to sync the stats file with resource object data you are in > effect setting an undefined field in the stats to an undefined value from > the database. > > The purpose of NWI-10 is to create a well defined country value in both > the stats file and the ORGANISATION object. The legal location of an > organisation is currently the only well defined country information > available. There is no information available anywhere in the database or > stats file telling you where a network is being used. > > cheers > denis > > co-chair DB-WG > > On Friday, 1 November 2019, 05:37:28 CET, Arash Naderpour via db-wg < > db-wg(a)ripe.net> wrote: > > > Hi, > > I'm new to DB-WG, but want to express my opinion in this regard, > from problem definition: > "Historically the country code was used to refer to the location of the > network" > > There are plenty of organization out there that are already set their > network and firewalls rules to use country code value in delegation file as > reference to the location of the network. > > Changing the rule to to something new, will cause problem for clients and > providers, so I don't think it is a good idea, > country code in delegation file can be synced with the country code for > resource object in RIPE DB. > A new attribute in organization object refers to where the resource holder > is legally based is totally fine, but having the same value in delegation > file can break networks and services. > > Regards, > > Arash Naderpour > Parsun Network Solutions >

4 6

Re: [db-wg] [Ext] Re: NWI-10 Definition of Country
by Leo Vegoda 01 Nov '19

01 Nov '19

Sanjaya wrote: > Just a thought, maybe we could redefine the RIR extended delegated > file format to incorporate both cc values of inet(6)num|autnum and > organisation Whois objects like this: > > registry|xx|type|start|value|date|status|yy-custodianid > Where: > xx = country code of inet(6)num|autnum > yy = country code of organisation > > This will require agreement among the RIRs and some adjustments > by the relying parties, but provides a clearer mapping between > Whois objects and the stats file records. My 2 cents. The stats file could have its structure adjusted but remember that "country:" is a multiple attribute, so there could technically be as many countries listed as there are valid ISO 3166 codes. Also, aligning the stats file and inet(6)numns doesn't solve the fundamental issue, which is that the "country:" attribute in inet(6)nums has never had a clearly defined meaning. Readers and writers of the data almost certainly mean and understand different things. As there is already a lack of shared understanding and a very large deployed base, which includes lots of legacy software, managing a change that leaves the structure intact while potentially changing how that data should be used sounds dangerous to me. That's the sort of change that leads to subtle, quiet errors that are hard to debug. I think it is safer to break things in a way that is very obvious, so that they get noticed and fixed. Kind regards, Leo Vegoda

1 0