- db-wg - mailman.ripe.net

New on RIPE Labs: How Pingable are the Pingables?
by Mirjam Kuehne 05 Apr '16

05 Apr '16

Dear colleagues, We look at how the "pingable:" and "ping-hdl:" attributes have been adopted in the last five years and how reachable the pingable addresses registered in the RIPE Database are when pinged from RIPE Atlas. Spoiler alert: It could be better. Please find the details on RIPE Labs: https://labs.ripe.net/Members/wilhelm/how-pingable-are-the-pingables?pk_cam… Kind regards, Mirjam Kuehne RIPE NCC

1 0

increase daily db dump frequency?
by Job Snijders 15 Mar '16

15 Mar '16

Hi RIPE NCC, WG, I have a use-case in which secondaire NRTM mirrors can't easily reseed from the data stored at ftp.ripe.net:/ripe/dbase/ because the intermediate NRTM mirror retains less history than the actual delta between when the dump was made and the current serial. In other words, if I want to reseed an IRR instance I have to do so before lunch (UTC), because after lunch the delta usually is too large. This can be mitigated if the dump files in ftp.ripe.net:/ripe/dbase/split are refreshed more often then once a day. Would it be possible to dump every 6 hours instead of every 24 hours? Kind regards, Job

6 6

Fw: [anti-abuse-wg] objection to RIPE policy proposal 2016-01
by ripedenis＠yahoo.co.uk 12 Mar '16

12 Mar '16

Sorry I hit reply instead of reply-all... ----- Forwarded Message ----- From: "ripedenis(a)yahoo.co.uk" <ripedenis(a)yahoo.co.uk> To: Sander Steffann <sander(a)steffann.nl> Sent: Friday, 11 March 2016, 17:06 Subject: Re: [anti-abuse-wg] [db-wg] objection to RIPE policy proposal 2016-01 Hi Sander I was not making any decision just expressing an opinion just as Elvis expressed his opinion on my implementation :) cheersdenis From: Sander Steffann <sander(a)steffann.nl> To: denis <ripedenis(a)yahoo.co.uk> Cc: Database WG <db-wg(a)ripe.net>; "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Sent: Friday, 11 March 2016, 16:54 Subject: Re: [anti-abuse-wg] [db-wg] objection to RIPE policy proposal 2016-01 Hello Denis, > Sorry Elvis but you are neither a software engineer nor a regular user inputting data into the RIPE Database. So your unsubstantiated statement of 'poor' does not carry much weight. Excuse me, but you do not get to decide that a fellow working group member's contribution does not carry much weight. That is the working group chairs' job when deciding on consensus, and from experience I know that even the chairs only do that in very rare circumstances. Consensus is based on content and supporting arguments, not on whether you judge somebody worthy... Cheers, Sander

6 6

objection to RIPE policy proposal 2016-01
by Ruediger Volk 11 Mar '16

11 Mar '16

Dear colleagues, I object to passing the policy as proposed. There is no serious need for the policy, and at this time and under curent circumstance it would actually be harmful. I believe that the supposed good intentions would be better served by other actions, and the policy focussing on enforcement is ill advised. I understand that the current implementation of the RIPE database allows legacy holders to enter abuse-c attributes for their legacy resources if that's currently not possible the required extension of the database should be discussed (in the approprioate wg) and implementation would NOT require the PDP (as more drastic changes have been done to the database - and that extension hardly would contradict existing policy). No PDP is needed to send friendly invitations to legacy holders to populate their data objects with abuse-c information; I'm sure asking the RIPE NCC to do this would not create an undue burden or serious problem. Enhancing the invitations with some additional information potentially helpful to the recipients could be considered too: - some hints/guidance about expected use and support of that mailbox (active members of the abuse handling community probably will NOT be the typical recipient! and no injuries are expected if any community member sees that information:-) - specific suggestions what to put into the abuse-c field (whatever the RIPE NCC might use to extrapolate abuse-c from existing data) The working group should contribute helpful information to be included. I'm quite certain running a second invitation campaign would be even less of a problem and effort for RIPE NCC; I cannot predict how much the information provided in a later campaign can be improved based on feedback and experience from an earlier one. You may argue, that such more friendly approach could have been used also earlier - and I would very much agree and I certainly complained and suggested that at least the forced population of missing abuse-c should be postponed until friendly information was made available. Now we do NOT HAVE TO repeat past errors... Specifically with legacy resource holders it would be a good idea for RIPE community and NCC to address them with an inviting and helpful approach; as there is a sad history of seemingly coercive and unfriendly communications towards legacy holders. REPEATING the error now - even considering the much lower number of relevant records - is however actually MORE SERIOUS in DAMAGING the CREDIBILITY of the working group (and as a consequence the RIPE NCCs position) because of the accumulated history. Repeated requests for information on supposed use und handling of abuse-c has been answered by pointing out that it is required by a policy that was consciously created without any such information. The new policy proposal painfully fits into the sad observation that the anti-abuse working group as a community has constantly put effort into enforcing creation and population of abuse-c data but not (even tried) to provide to the rest of the world helpful explanations on requirements and expected handling at the requested mailboxes. That observations leads to the question whether the community is not able to come up with some helpful explanation or whether it does not care... :-( In both cases asking for enforcement does seem neither appropriate nor acceptable and means that the request cannot be taken serious - bad for the perception of RIPE and RIPE NCC activety by parties that are not heavily involved in the community processes. Consider the typical person confronted with a request to define abuse-c: how deeply is he involved with the anti-abuse working group (where a common understanding might exist - I consider myself only occassional observer and not a member and don't know)? Trying to close more quickly and on a more constructive perspective let me skip to elaborate here on my judgement: at close inspection the rationale and arguments look quite broken. The policy content does actually not matter that much - look for a sketch of a potential harmless implementation approach above in this message. What matters is appropriate use of the PDP (it can be abused!!!) and what are good goals of the working group and good ways of achieving them. The assumed good goals (as I understand it) are (a) improving quality of abuse-c information in order to (b) improve abuse reporting and report handling processes and (c) extending the abuse-c coverage for Internet number resources in the RIPE NCC registry The policy proposal references (a) and (b) quite explicitly; I took the liberty to interpolate (b) which actually seems to be the primary goal, and it looks like the working group decided that this will be helped by means of creating distinctly identified mailbox information to be put into abuse-c. The criterium for gauging (a) seems to be whether "improved data" actually helps "improve processing" (b) - what else? Creating abuse-c entries of better/good quality obviously depends on the recipient being appropriate and informed about expected potential messages and preparing to deal with them. Forcing creation of abuse-c in any other way is not going to create better quality but actually looses information (you loose track of which entries have the "quality of informed and [potentially] prepared recipient"). We have to assume that Internet number resource holders requested to establish abuse-c - usually are NOT focussed an abuse handling (different core business:-) - in many cases are not members of the anti-abuse working (and unlikely to have insight into undocumented potential consensus views of the working group or the larger abuse-c activist community) - in general willing to cooperate (we really should care for those and help them! ... yes, there are others - from "don't care" to "evil") For making a reasoned decision about the recipient for abuse-c and preparing for handling messages one obviously needs some understanding/explanation of what is expected. If no such helpful information is offered at the time of requesting abuse-c setup, many well intentioned parties will *something* (not really good "quality") to fill required fields and little motivation to followup will remain. If they care to ask for helpful information and the answer stays "this is required by policy, and it consciously declines to explain", they are likely to conclude that they have to submit to RIPE policies and the policy makers+process that cannot be taken serious... I note that for goal (b) of course some common understanding of expected use and handling for the abuse-c mailbox is a prerequisite on BOTH sides (senders also!) I do not expect to see formal, precise, and exhaustive definition of requirements and intended/expected use of abuse-c use - that would seem fairly impossible and certainly would not provide a practical answer to the issue. The working group needs to followup it previous abuse-c policy by starting to create practically useful explanations, before considering more "enforcement" (actually IMHO all enforcement activety should [have] be[en] postponed - potentially replaced by friendly invitations). It may take considerable effort to develope consensus on such documentation - but is it reasonable to rely on all relevant outside parties to have the first contact figure out completely on his own and explain to his management, consultants, service providers, etc... what needs to be done? (what aggregated cost and what "quality" implications do you expect?) It's ok to have working groups that just have internal fun between some birds of a feather. If a working group feels like making demands (e.g. policies) to a larger community it should also consider what support it needs to provide to serve the purposes of that larger community. Thanks for your attention and consideration. Ruediger Volk P.S.: Sorry, for a painfully long message. Trust me I had more painful time writing - and making it shorter would have been worse - with termination not secure:-) I hope that the painful length does not obscure - valid concern - constructive suggestions

27 87

ROUTE objects for non RIPE resources
by denis 10 Mar '16

10 Mar '16

Hi guys For the last 2 or 3 RIPE Meetings a conversation has started just before the meeting and carried on during the meeting. It is the same conversation about what to do with ROUTE objects in the RIPE Database for non RIPE resources. The same possible solutions have been proposed at each meeting. By the end of the meeting the same conclusion is drawn...something needs to be done. Then.....silence....until just before the next meeting when the cycle is repeated. In fact if you look at the archive for the routing and DB WGs nothing has been said about this on the mailing lists since the start of RIPE 71. So are we going to have this same conversation just before RIPE 72 and end with the same result? Or do you think we could break this cycle and have a different conclusion...decide to do something instead of deciding something needs to be done. Subtle but significant difference. The simple solution I proposed that would solve the consequences of having these ROUTE objects in the RIPE Database was on the table 18 months ago. Most of the software building blocks for it already exist in the database software, so it could be implemented in a month or so. Even if this is not the final solution, as a temporary fix it could be up and running so easily and improve the confidence in the IRR. cheers denis

1 0

Re: [db-wg] [anti-abuse-wg] objection to RIPE policy proposal 2016-01
by h.lu＠anytimechinese.com 07 Mar '16

07 Mar '16

Hi I fail to understand how spammer are legal in certain country has to do with my reasoning or logic. The argument is about if there is managing position for community to take, my answer is no, we are not law enforcement and we only do book keeping, we don't tell people what to do, if they want to be good guy, great, if they don't care about spam or any abuse so to say, ok, it's their call. Making things mandatory with no real enforcing power are just not working. So make logic simple to understand, if the abuse is serious as crime, you don't need abuse c to get the right person(law enforcement has much better way than ripe db), if it is not serious as crime, if the op cares, with or without abuse c they will have their abuse contact there, and will deal with it. For ops don't care, with or without abuse c, they still don't care. So you can put up an extra line ask people to fill, but I don't think it makes much difference. > On 4 Mar 2016, at 20:00, Jeffrey Race <jrace(a)post.harvard.edu> wrote: > > Dear Lu, > > Your reasoning fails the logic test because you do not cognize the mismatch > between the operation of "law to enforce things" and the spammer business > model. The loss to no single victim rises above the threshold to initiate > either criminal or civil proceedings. The spammers organize their business > model in this way expecting most people to have your attitude. > > This is clearly explained in > > <http://www.jeffreyrace.com/nugget/spam_05.pdf> > > Kind regards, > > Dr. Jeffrey Race, President > Cambridge Electronics Laboratories > 20 Chester Street, Somerville MA 02144-3005 > Tel +1 617 629-2805 Fax +1 617 623-1882 > > Avoid spinal damage from computer use! > Read "Cripples by Thirty?" > > <http://www.camblab.com/nugget/nugget.htm> > > --Original Message Text--- > From: Lu Heng > Date: Fri, 4 Mar 2016 14:20:28 +1300 > > Hi there: > > I think the whole notion about we are managing the internet though the policy are not correct. > > > We are not managing the internet, we are book keeping really. > > > Denis, your argument standing on a group that if we do not manage the internet, the gov will step > in and do it for us, but that is largely untrue. > > > The Gov are managing it now as we speak, they have something called law to enforce things, they > really don't need bother to go though policy here to block content they dislike, bust people they > think are bad, find people are responsible, if there is a seriou crime going on, with or without > abuse-c, gov will find them or not---abuse c does not change the outcome. > > > Take China for example, A 500 m user can not access Facebook, tell me they go though any sort of > APNIC policy to do that, same goes for some countries inA Middle East. > > > So my last point is. If you like their gov job, you can apply one, don't try to push community here > to do gov's job. > > > On Friday 4 March 2016, denis <ripedenis(a)yahoo.co.uk> wrote: > Hi Peter > > OK lets cut to the bottom line. Does anyone NOT agree with these points: > > -Internet abuse (in it's various forms) is considered both a nuisance and a danger by the publicA > -Politicians will jump onto any band wagon that has popular public support and enhances their > careers > -Responsible internet resource management includes receiving and handling abuse complaints related > to the networks you manage > > If we all supported these points, especially the last one, then in an ideal world all network > managers would be happy to provide abuse contact details and would take action on complaints > received. > > Unfortunately we don't live in that ideal world. The fact that so many experienced technical > internet people are opposing this policy worries me. So many of you are fixating on this point > about 'mandatory', 'enforcing', 'justifying'. If everyone agreed with point 3 above then you would > all be willing to do this voluntarily anyway. So what difference does it make to those of you who > do this anyway if it is mandatory? > > But we know some people simply can't be bothered to handle abuse complaints and we also know some > people make money by providing services to the abusers. There is no point pretending this does not > happen. If there is a lot of money to be made some people will want a slice of it. That is why this > has to be mandatory. > > When abuse-c was first introduced it was made clear that this was the first step of a process. The > intention was for all IP addresses within the RIPE region to have one common way of documenting an > abuse contact that can be accessed programatically. It was also made clear that this first step had > nothing to do with whether anyone responds to reports sent to that contact. Because it was and > still is clear that some people don't want to publicise any abuse contact details it had to be and > still has to be mandatory. If you enter data into the RIPE Database you are required to ensure it > is correct. Dealing with whether anyone responds to the reports sent to this contact is a separate > issue and should not cloud the discussion on the abuse-c information in the RIPE Database. Neither > should the technical implementation of the abuse-c attribute. > > I know there are policies about policies for legacy resources. Personally I think that is crazy. > All IP addresses are technically the same no matter how or when you acquired it. Abuse can come > from any one of them. > > I don't know why we are making the policy side so complicated. The principle is simple. If you > manage IP addresses in the public domain, from where abuse can be generated, responsible management > requires you to provide abuse contact details!!! > > cheers > denis > > On 03/03/2016 23:30, Peter Koch wrote: > On Thu, Mar 03, 2016 at 11:46:45AM +0100, denis wrote: > > In these days of political interest in how the internet is 'managed' the > RIRs need to do more than 'just maintain an accurate registry'. The > > > indeed. The community should be careful to maintain and improve the > credibility and legitimacy of its policy development process. > ``Extra constitutional'' activity (imposing "abuse" handling procedures > camouflaged as syntax changes to database objects) and retroactive > changes to policy without an exceptional justification both aren't > helpful. > > 2016-01 claims "Better data quality", which is not backed with arguments. > 2016-01 claims "More accurate data for abuse contact", which is not > A A A A A supported by arguments or evidence/precedent. > > internet is a crucial part of modern life. Abuse is considered to be a > serious problem. What you are saying is that you don't give a dam about > abuse and are not interested in being part of the management of abuse. > > > The alleged correctness of data does not imply a "right to response" (cf ripe-563), > and rightfully so.A Therefore the claims that refusal to add abuse-c > would imply refusal to deal with abuse reports are pointless, since > the sheer presence of the attribute does not imply anything, either. > > Also, I have not heard RA¬diger (or anyone else) claim they would not > want to even add abuse-c - it's making this policy mandatory what is > being contested.A ripe-639 re-establishes the 'special role' of > legacy resources as exempt from policy changes: > > A A A A Any existing or future RIPE policy referring to resources shall not apply > A A A A to legacy resources unless the policy explicitly includes legacy resources in its > scope. > > Now, if that was simply a matter of a boilerplate in any future policy > (xxx shall also apply to legacy resources), this clause would not make > the slightest sense.A Consequently, a special consideration is needed. > 2016-01 simply refers to inconsistency (obviously a simple consequence > of ripe-639 and thus not exceptional) and "better data quality" - without > justification.A No indication is given of any harm caused by legacy > resources currently not subject to ripe-563.A ripe-563/ripe-639 > do not preclude use of abuse-c for legacy resources, either. > > All in all, I understand the motivation behind 2016-01, but the reasoning > is far too poor to justify proceeding with the proposal. > > -Peter > > > > > > > > -- > -- > Kind regards. > Lu > > > > > > >

9 19

Re: [db-wg] [anti-abuse-wg] objection to RIPE policy proposal 2016-01
by h.lu＠anytimechinese.com 05 Mar '16

05 Mar '16

Hi guys: I think I really should make myself clear here. (Sorry for sending 3 mails in a row as I just realise people are taking to me one by one) I do not against abuse c or support it, I just don't think it will make much difference. That's all I have to say about abuse c. However, I do against the idea "if we not managing the internet the gov will step in and take over". The last thing I would want the community is doing the gov's managing job for them. So that's what my last email about. > On 5 Mar 2016, at 08:32, andre(a)ox.co.za wrote: > > On Fri, 4 Mar 2016 17:55:16 +0000 > Michele Neylon - Blacknight <michele(a)blacknight.com> wrote: > <snip> >> >> We are not managing the internet, we are book keeping really. > [...] > > If you are correct (and imho you are) > > the whole point of book keeping is to have accurate data and records > > so, pick your poison. All POV leads to exactly the same thing: the ncc > needs accurate abuse-c as much as any of the other data.

1 0

Re: [db-wg] [anti-abuse-wg] objection to RIPE policy proposal
by Marilson 04 Mar '16

04 Mar '16

Hello I am also impressed and concerned with the old, inopportune and improper posture of the gentlemen Randy Bush and Gert Doering. Denis, it is gratifying to hear someone concerned about the future of the Internet and with the exponential increase in the abuse. Greed, not wanting to plagiarize Gordon Gekko, reigns absolute and moves the wheels of the global economy. The agenda is: cheat as much as you can, just try not to get caught. HSBC and Volkswagen are the portrait of this posture unethical where the end, profit, justifies the means. You all have the opportunity to do the right thing. How do you want to be remembered? Or you start a remediation process of such abuses or will be done by rulers (governments) pressured by the world's population. Thanks Marilson

3 2

Cleanup work for "abuse-mailbox:" in certain ORGANISATION objects, following policy 2011-06
by Tim Bruijnzeels 04 Mar '16

04 Mar '16

Dear working group, As you know, the RIPE NCC completed the work for the 2011-06 policy on 15 February, and "abuse-c:" is now added to all organisations that hold resources allocated or assigned by the RIPE NCC. Going forward we propose to: - Remove "abuse-mailbox:" for all ORGANISATION objects that *have* "abuse-c:" in a one-off operation - Introduce a business rule to prevent adding "abuse-mailbox:" to ORGANISATION objects, urging people to use "abuse-c:" instead Please note that the proposal above does not force anyone to use "abuse-c:", it just enforces that "abuse-c:" is used instead of "abuse-mailbox:". Having both attributes on an ORGANISATION object is extremely confusing, and currently updating "abuse-mailbox:" does not work in the LIR Portal organisation object editor. We therefore believe that the cleanup is needed, and we hope that this will not be controversial. We would like to ask the working group for the mandate to do the cleanup proposed above. Originally the intent was to clean up "abuse-mailbox:" on all objects (except in abuse-c roles) and possibly IRT objects. However, we are fully aware that more controversy exists here. There is a lot of discussion about whether "abuse-c:" can be mandatory for organisations holding legacy resources (2016-01). Questions are being raised about the data model. We are following these discussions with interest and we believe that this part of the originally proposed cleanup should be put on hold until we have a more clear direction from those discussions. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

2 1

Re: [db-wg] [anti-abuse-wg] objection to RIPE policy proposal 2016-01
by Gert Doering 03 Mar '16

03 Mar '16

Hi, On Thu, Mar 03, 2016 at 12:56:05PM +0200, andre(a)ox.co.za wrote: > it is actually very simple: > > any rigorously correct resource allocation registry data must > include accurate abuse records. No. It needs to contain accurate records of who has been delegated responsibility for that (admin-c / org). abuse-c is a way to ease finding the *right* contacts instead of always having to write paper mail to the company CEO - and that makes sense, but it's a convenience to operators (as is tech-c), and in no means required for the function as registry. Which might conincide with the fact that the paperwork you sign when opening a LIR has no field for abuse-c... Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

4 4

[training] RIPE NCC Training Courses April-June 2016
by Training Services 29 Feb '16

29 Feb '16

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Budapest, Tirana, Manchester, Lisbon, Bologna, Munich, Tallinn, Moscow, Vienna, Valletta, Reykjavik. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - Basic IPv6 Training Course - DNSSEC Training Course - 2 days Advanced IPv6 Training Course - 2 days BGP Operations and Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

RIPE DB services downtime
by Thiago da Cruz Pereira 19 Feb '16

19 Feb '16

Dear working group, Later today, we’re going to restart our servers to apply a patch. A short downtime to updates is expected and queries will not be affected. Kind regards, Thiago da Cruz Software Engineer - Ripe Database Team

1 1

RIPE NCC to set abuse-c for remaining organisation with ASNs or other resources allocated or assigned by the RIPE NCC
by Tim Bruijnzeels 19 Feb '16

19 Feb '16

Dear working groups, As you know all organisations that have internet number resources allocated or assigned by the RIPE NCC need to have an abuse-c attribute according to policy 2011-06. The following implementation plan was communicated for this policy: https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-201… Phase 1 of this plan was completed in December 2013, setting up abuse-c for then existing LIRs. Phase 2 of this plan was completed for organisations holding sponsored PI resources in November 2014. However, since then LIRs and end-users have been responsible for ensuring that an abuse-c exists for their organisation. In practice it has proven difficult to enforce this, since abuse-c is not a mandatory attribute in the RIPE DB schema, and as a result new cases where organisations do not have an abuse contact have been created. There is an important change in the implementation we would like to do – based on our experiences thus far – which would like the community's mandate on. We propose to use the end-user organisation's email address instead of the sponsoring LIR email address. We believe there are valid reasons for this change, but of course if this suggested change is controversial we would encourage discussing it in the anti-abuse working group. Ideally, we need to have a decision on this by early January so that we can prepare the work. 1) Prevent NEW cases We want to ensure that no new cases will be created as follows: = Since 1 March, the new member application form already provides much better integration with the RIPE Database - because of this an abuse contact is now created whenever a new LIR is activated - it can be modified the LIR, e.g. using web-updates, but not removed = We are currently adapting the new create organisation webupdates form to include abuse-c by default allowing the user to: - reference an existing abuse-c role object, or - enter an email address to create an abuse-c role for the organisation (using the same maintainer) = We are also adapting the edit organisation webupdates form to always suggest adding an abuse-c contact if it's not present = We plan to extend the new request forms: - check that an end-user organisation has abuse-c before it can be used - if not, refer to the edit form for the organisation where it will be easy to add reference an existing abuse contact, or create a new object 2) Resolve remaining EXISTING cases Originally the idea for phase 2 was to use the sponsoring LIR's email address in case the end-user organisation was unresponsive to requests to set their own abuse contact. However, since then policy 2012-08 has been implemented and nowadays the sponsoring LIR, and its abuse contact, can be found through the sponsoring-org attribute. Also, the RIPE NCC found that using the sponsoring organisation's email address leads to a number of issues: - end-users have no incentive to set their own abuse-c, rather then letting abuse questions go to their sponsor, so the majority remains unresponsive - in case an end-user has resources from more than one sponsor it is ambiguous which sponsor's email should be used - many LIRs were unpleasantly surprised by finding their email address in the abuse-c of the organisation they sponsor - in case LIRs no longer wish to sponsor resources, or when they are returned, existing references to their email in the end-user abuse-c are not cleaned up We would therefore like to propose a change to the implementation plan when addressing the remaining cases. Today, in case no abuse contact is set, users of the database will resort to using the organisation's default email. Therefore, adding a dedicated abuse-c role object using this email address, doesn't cause any noticeable new effects on organisations. It may well be the correct email address to use for an organisation, and no action would be required. However, it *enables* an organisation to use a different email address for abuse questions if appropriate. We would like to email remaining LIRs, and end-user organisations and sponsoring LIRs on Monday 1 February, giving them until Monday 15 February to set their abuse contact. We realise that this means we would have another delay, but we believe that it would be unwise to do this change over the end of year holiday period, and to ensure that we can give proper support to questions we want to avoid doing this at the same time as the start of the year invoicing. Please let us know what you think. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

9 14

Question about RIPE Database
by Ricardo Cukier 15 Feb '16

15 Feb '16

Hi. I am using the following FTP files to identify IPs per Country: ftp://ftp.arin.net/pub/stats/arin/delegated-arin-extended-latest ftp://ftp.afrinic.net/pub/stats/afrinic/delegated-afrinic-latest ftp://ftp.apnic.net/pub/stats/apnic/delegated-apnic-latest ftp://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-latest ftp://ftp.ripe.net/ripe/stats/delegated-ripencc-latest ftp://ftp.apnic.net/pub/stats/iana/delegated-iana-latest While doing some searchs on the web, I found a few IP Addresses that are not included in those files, for example, 2.190.0.0 however, when i searched on the Web Database (see attached screenshot), it was found as an IRAN subnet and assigned by RIPENCC. Why I am unable to see this subnet in the files? Am I doing the download of the incorrect files? Can someone please help me to identify whats the best process to get the correct list of IPs/subnets per country? -- Best Regards, Ricardo Cukier

2 1

Proposal to limit the use of the RIPE-NCC-RPSL-MNT on mnt-by
by Tim Bruijnzeels 11 Feb '16

11 Feb '16

Dear working group, There is an open action point on us regarding the use of the RIPE-NCC-RPSL-MNT maintainer: https://www.ripe.net/ripe/mail/archives/db-wg/2015-May/004626.html > I'd like to ask RIPE NCC to provide the group with an implementation > plan and a timeline on how to prevent the RIPE-NCC-RPSL-MNT mntner from > being used to authenticate updates to an object after the object has > been created. We also ask that the RIPE NCC look into cleaning up > existing references to RIPE-NCC-RPSL-MNT and tell us their plan. Note that there is an ongoing an important parallel discussion about the authorisation of out-of-region IRR objects in general. But this is specifically about the use of 'RIPE-NCC-RPSL-MNT' on "mnt-by:". As long as we do have RIPE-NCC-RPSL-MNT, there are things we can improve and we want to propose the following to working group: 1) implement a business rule to prevent that this maintainer is used as 'mnt-by' Submitting an object that includes 'mnt-by: RIPE-NCC-RPSL-MNT' would result in a hard error, with a message like: "The RIPE-NCC-RPSL-MNT is used to authorise the creation of out-of-region aut-num and route(6) objects, but may not be used as 'mnt-by'" This is fairly trivial to implement, provided of course that the working group agrees to this. 2) remove the maintainer from existing objects There are roughly 2000 objects that are maintained by 'RIPE-NCC-RPSL-MNT' only, and about 10000 objects that are maintained by 'RIPE-NCC-RPSL-MNT' and at least one other maintainer. In the first case we propose to lock the object, i.e. set 'mnt-by: RIPE-NCC-LOCKED-MNT', and send out a custom notification to any contacts on the object explaining that the object has been locked to prevent a hijack of the object, and that ripe-dbm(a)ripe.net can be contacted to unlock the object. In the second case we propose to leave the remaining maintainer and send out a custom notification informing contacts on the object that the "RIPE-NCC-RPSL-MNT" has been removed to prevent a hijack of the object, and listing which maintainer(s) remain. Technically this is not difficult either, but it can result in a lot of questions. Therefore we prefer to do this in batches to make sure that we can process possible follow up requests to ripe-dbm(a)ripe.net properly. For reference we used a similar approach when dealing with locking the old MD5 passwords earlier this year. Provided that the working group agrees with this, we expect this can be done in the space of a few weeks after the business rule is implemented. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

9 14

Implementation proposal descr line
by Tim Bruijnzeels 11 Feb '16

11 Feb '16

Dear working groups, Following discussion in this group it was decided that the RIPE NCC should stop enforcing that the first "descr:" attribute of resource objects reflects the name of the organisation, for resources that it alloced or assigned. This practice has been place for a long time, but now that all such objects have a reference to an organisation object and the RIPE NCC ensures that this reflects the resource requests, this is no longer needed. Furthermore it was decided that the RIPE NCC should clean up existing organisation names in "descr:" attributes in order to: (1) avoid confusion about where the organisation name should be found; (2) avoid that the names here are different from the name of the actual organisation; (3) make it very clear which attributes are verified by RIPE NCC, and which attributes are not. Hereby the RIPE NCC would like to propose an implementation plan for these changes. We invite the working group to review and discuss if needed. As soon as the working group co-chairs formally call consensus, we can proceed to implement shortly. Implementation proposal: ======================== = Change "descr:" to an 'optional multiple' attribute We believe that the working group concluded that it would be appropriate to make "descr:" optional. The reason is that when the organisation name is cleaned up, there may be no description lines left. The working group considered whether the attribute should be 'single optional', but there seemed to be no strong preference for this, and it would have a bigger impact. Therefore we propose to go for the easier option of making it 'optional multiple'. Technically this change is not hard to do on the server side, but can impact users of the database because there may be no "descr:" attribute, and this can affect parsers. Because this can have an impact on automated systems the RIPE NCC will announce this change ncc-announce(a)ripe.net, and use a longer week staging period in the Release Candidate environment allowing users to test and update their systems. Dependent on formal consensus call we may be able to combine this with the upcoming release for deprecating "changed:" phase 3, to avoid delays. = Clean up existing "descr:" attributes where RIPE NCC enforced the organisation name The RIPE NCC will remove the "descr:" attributes that it has been enforcing. = Add "descr:" to allocation object editor in LIR Portal So that LIRs can edit this themselves. = Stop setting the "descr:" on new allocations or assignments done by the RIPE NCC We will leave "descr:" blank. It can be edited by the LIR or end-user later.

8 14

Release 1.85 (changed phase 3) deployed to RC
by Tim Bruijnzeels 02 Feb '16

02 Feb '16

Dear working group, We have just deployed release 1.85 to the Release Candidate environment. This release completes the deprecation of the "changed:" attribute: https://labs.ripe.net/Members/tim/deprecating-the-changed-attribute-in-the-… With this release we will: = Filter out "changed:" from all RIPE Database objects = Actively remove "changed:" from all RIPE Database objects = Reject updates that contain "changed:" We encourage all users of the database to test their tools. If no issues are found we plan to deploy this release to production on Monday 1 February 2016. Note that this release includes all changes from the previous release, 1.84.1. But, we only plan to upgrade the RIPE Database hardware, and deploy the 1.84.1 release, in the first half of January. Because this upgrade will involve a brief outage for updates to the Database, we will communicate a more detailed plan with time lines closer to the date. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

1 1

Re: [db-wg] [members-discuss] ripe objects as single text field
by Alex Band 02 Feb '16

02 Feb '16

Hello everyone, I would just like to clarify a couple of things on the redesigned user interface, based on the feedback we have received so far. First of all, these are the URLs to all of the different parts of the RIPE Database web ui, as it seems some people are getting a bit lost: Query: https://apps.db.ripe.net/search/query.html Create using single text field: https://apps.db.ripe.net/db-web-ui/ Create/Update using multiline text area: https://apps.db.ripe.net/syncupdates/simple-rpsl.html In addition, the TEST database user interface now has its own dedicated URL, instead of having to select it with a radio button: https://apps-test.db.ripe.net/ The option to edit an existing object in a single text area is functionality that was used very infrequently according to our statistics. We decided to leave it out of the first phase of the redesign, as most people use email or scripting to update the RIPE Database in a single text area. If there is a lot of demand, we'll implement that option as well for the web interface as well. Please keep in mind that it not impossible to edit an existing object in a single text area, it is simply a two-step process. You can copy and paste the object you queried into Syncupdates and go from there. This update method will allow you to use your SSO account to authenticate as well, if it is associated with your maintainer. Lastly, I realise "Syncupdates" is not the most descriptive name ever. We will make sure that we have a look at the wording of the different menu items to avoid confusion. Kind regards, Alex Band Product Manager RIPE NCC > On 25 Nov 2015, at 11:28, Andy Betts <A.Betts(a)node4.co.uk> wrote: > > Yep, I just discovered that feature had been removed (or really well hidden) this morning. > > Please bring it back. > > Regards > Andy > From: members-discuss [mailto:members-discuss-bounces@ripe.net] On Behalf Of David Wilkinson > Sent: 24 November 2015 17:06 > To: Tapio Haapala; members-discuss(a)ripe.net > Subject: Re: [members-discuss] ripe objects as single text field > > Hi Tapio, > > Looks like they have removed it. I can't see away to use the single text update either. (Unless both of us are blind) > > That is quite annoying as to update some records it was easier to edit via the single text area than adding each attribute one by one. > > Regards > > David > > > -----Original Message----- > From: members-discuss [mailto:members-discuss-bounces@ripe.net] On Behalf Of Tapio Haapala > Sent: 24 November 2015 16:42 > To: members-discuss(a)ripe.net<mailto:members-discuss@ripe.net> > Subject: [members-discuss] ripe objects as single text field > > Signed PGP part > I was just adding domain objects to DB. Suddenly that ui ask me to login again. After that I did not find way to add objects via single text fied. > Can someone check that do they really remove one of most used feature at whole portal or is it just me who is blind or dumb? > > -- > F-Solutions Oy > > Tapio Haapala > > PL7, 90571 Oulu > GSM 0400 998371 > Skype burner- > IRC Burner@ircnet<mailto:Burner@ircnet> > > > ---- > If you don't want to receive emails from the RIPE NCC members-discuss mailing list, please log in to your LIR Portal account and go to the general page: > https://lirportal.ripe.net/general/ > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses. > > ---- > If you don't want to receive emails from the RIPE NCC members-discuss > mailing list, please log in to your LIR Portal account and go to the general page: > https://lirportal.ripe.net/general/ > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses. > > ________________________________ > This email has been scanned inbound by Node4's Email Security System. > ________________________________ > This email message has been delivered safely and archived online by Mimecast. > ________________________________ > > *************************************************************************************************************************************************** > Node4 Limited is registered in England No: 04759927 and has its registered office at Millennium Way, Pride Park, Derby, DE24 8HZ > The information contained in this email is confidential and is intended for the exclusive use of the email addressee shown. > If you are not the addressee, any disclosure, reproduction, distribution or other dissemination or use of this communication is strictly prohibited. > If you have received this mail in error, please notify our mail manager at abuse(a)node4.co.uk and delete it from your system. > Opinions expressed in this email are those of the individual not the company, unless specifically indicated to that effect. > > > > This email has been scanned by Node4's Email Security System. > > This email message has been delivered safely and archived online by Mimecast. > **************************************************************************************************************************************************** > ---- > If you don't want to receive emails from the RIPE NCC members-discuss > mailing list, please log in to your LIR Portal account and go to the general page: > https://lirportal.ripe.net/general/ > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From here, you can add or remove addresses.

7 9

Fwd: [staff] [ncc-announce] [service] Planned RIPE Database Hardware Upgrade: Monday 18 January, 17:00-18:00 UTC
by Tim Bruijnzeels 18 Jan '16

18 Jan '16

Dear working group, In case you missed the announcement we sent last week. We are planning a hardware upgrade later this afternoon/evening that will involve a short outage for updates. Queries should not be affected. Kind regards, Tim Bruijnzeels > Begin forwarded message: > > From: Tim Bruijnzeels <tim(a)ripe.net> > Subject: [staff] [ncc-announce] [service] Planned RIPE Database Hardware Upgrade: Monday 18 January, 17:00-18:00 UTC > Date: 14 Jan 2016 14:37:57 CET > To: ncc-announce(a)ripe.net > > Dear colleagues, > > The RIPE NCC is planning to upgrade the RIPE Database hardware this coming Monday, 18 January. > > With the new hardware we will start to use MariaDB instead of MySQL as the back-end to the RIPE Database. To support this change we will upgrade the RIPE Database software to version 1.84.1. This software has been running in the Release Candidate environment without issues since 9 December. Detailed release notes can be found here: > https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… > > Queries to the RIPE Database will be unaffected during the upgrade, but there will be a short outage in updates between 17:00 and 18:00 UTC. > > Kind regards, > > Tim Bruijnzeels > Assistant Manager Software Engineering > RIPE NCC Database Group >

2 1

abuse-c: important points on it's usage
by denis 13 Jan '16

13 Jan '16

HI All I make no apologies for the length of this email, but I would ask anyone concerned with abuse handling, RIPE Database data management and RIPE Database maintenance to read it. I am not trying to be a perfectionist or technical purist, but the changes being forced through now do matter. cheers denis When "abuse-c:" was first proposed, Tobias (co-chair of Anti Abuse WG) and I spent a lot of time discussing how to achieve the intended goal. We came up with the current implementation, which after community discussion was approved. But you never think of everything in the first instance. I believe there is one piece missing that allows the whole system to be broken (see later). I also believe the changes being made (without proper discussion) by the RIPE NCC's 'improvements' to Webupdates will break the abuse-c system over time. As a separate issue, but related to this, I think the RIPE NCC should give advance notice to the community of changes to interfaces like Webupdates and allow some discussion on significant changes like ORGANISATION object creation and authorisation and not just 'slip them in', then try to justify them when someone notices. These are major changes to the way the RIPE Database works. They are not just changing the look and feel of Webupdates as an interface tool. So lets start with some history. The goal of "abuse-c:" When the data model was designed there was no thought given to abuse contacts. The internet was much smaller and more personal. The data model was built on the principle of human readability and not programatic parsing. So when the need for abuse reporting was first considered necessary it was good enough to add things like: remarks: In case of abuse contact me(a)here.com You could put this anywhere and someone would find it. Then it got a bit more formal and we introduced the "abuse-mailbox:" attribute. But this was allowed in five or six object types. None of these were the resource objects. So the information was scattered all over the database. This was still almost impossible to find programatically. The goal of "abuse-c:" was: -to have one way of documenting abuse contact details -parsable programatically -very simple for majority of resources -flexible for any other resource situation The "abuse-c:" design Tobias and I considered many options to achieve these goals. What we focussed in on was that most small to medium LIRs may have many resources but only one person/role handling abuse complaints. All these resource objects in the database referenced their one ORGANISATION object. So by adding the "abuse-c:" attribute to the one ORGANISATION object, referencing a ROLE object containing the contact details, we handled a large number of simple cases in a very simple way. All the resources referencing this one ORGANISATION object and all the more specific resources would inherit this contact information from this one location. Easy to set up, easy to maintain. But there are other situations. For example sub allocations. We also considered that accountability is an important element of this public registry database. There is a notion that when a resource is allocated or assigned by the RIPE NCC to an organisation, then that organisation is ultimately responsible for anything that happens regarding that resource. This is why ORGANISATION objects are mandatory for any organisation that wants to hold internet resources. So we considered that if part of the responsibility has been delegated to another organisation with a sub allocation, it is not unreasonable that another ORGANISATION object should be created to reflect this delegated responsibility. If this second organisation handles the abuse reporting for this sub allocation, then another "abuse-c:" attribute can be added to their ORGANISATION object to reflect this. If the LIR who is responsible for this allocation, including the sub allocation, wants to handle all abuse reports for the whole of their allocation then no "abuse-c:" should be added to the second ORGANISATION object. The sub allocation will then continue to inherit the abuse contact details of the LIR who holds the whole resource. Inheritance vs Scattering The data model for the RIPE Database was not designed with inheritance in mind. In many situations duplicated, redundant data is scattered all over the database. There are over 3 million INETNUM objects in the database. They all contain one or more "admin-c:" and "tech-c:" attributes. In reality all these references are to a few tens of thousands of individual roles. These contacts could be inherited from the ORGANISATION objects in the way "abuse-c:" has been set up. The "abuse-c:" was designed to be inherited and not to be duplicated where it is not needed. The changes made recently to Webupdates by the RIPE NCC (without any discussion) breaks the inheritance of "abuse-c:". It forces the scattering of more redundant data throughout the database. If you create an ORGANISATION object with Webupdates it forces the addition of an "abuse-c:" attribute whether it is needed or not. They argue that you can refer to an existing ROLE object making it the same abuse contact. Even if this was set up correctly it is redundant data. In reality people setting this up quickly will just take the easy option of giving any email address (mickey(a)mouse.com). They may not realise the impact of this. But this simple mistake overrides the LIRs genuine abuse contact details from any point in a network where this new ORGANISATION object is referenced. Understanding your network and the RIPE Database What it comes down to is that you should understand how your network is structured. You should at least know who needs to be contacted, for what reason, from which point in your network. Unfortunately with the current data model you also need to have at least a basic understanding of how the data is structured within the RIPE Database. And to be honest if you don't understand the basic structure of the RIPE Database you should not be managing data in it, maintaining it or documenting it. With knowledge of your network and the database you can decide where you need to put "abuse-c:" attributes. DO NOT add extra, redundant "abuse-c:" attributes. What can possibly go wrong? In defence of their unannounced changes to Webupdates, the RIPE NCC has argued that adding additional "abuse-c:" attributes is harmless and will NOT lead to bad data in the database. Forcing users to add additional, redundant data that breaks the principle of inheritance is in itself technically wrong. But without being a technical purist what else can go wrong? Once these additional references have been added, the seeds have been sown for future mistakes. It all depends now on who maintains what and who is notified of what changes. The referenced ROLE object can be changed or the "abuse-mailbox:" value in the ROLE object can be changed. This could be accidental or with good intent, but just got it wrong or even maliciously. Without the proper checks this can easily go unnoticed. Over time some/many of these redundant references may/will get out of sync with what they should refer to. In a few years time someone will argue that all this contact data is messed up, abuse-c did not work and we will invent a new system... The missing bit The "abuse-c:" attribute does work and will work well if used properly. But there is one bit missing from the original design....proper notifications. We need another attribute adding to the ORGANISATION object abuse-notif: [required] [multiple] [] This will allow the resource holder to keep an audit trail of any changes made to the abuse contact details for any parts of their resources. The 'required' (as defined in the database documentation) means it is syntactically optional, but business rules enforce it's presence in some situations. This should be added to any ORGANISATION object referenced by a resource object. Any addition, change or deletion of any part of the abuse contact details ("abuse-c: attribute, referenced ROLE object, "abuse-mailbox:" attribute) at any part of a network will be notified to the resource holder's email address specified in this attribute. Only the "abuse-notif:" referenced via the top level of a resource object will be notified. Any redundant references in more specific objects will be ignored (and should be removed, warned or disallowed). This means the resource holder will always be notified if anything is changed at any point in the resources/networks they are responsible for. I also think it would be useful if RIPEstat could give a visual representation of where abuse contacts are located within a network. This would allow a resource holder to review who is managing abuse for any part of their networks.

1 0

[training] RIPE NCC Webinars - new dates
by Training Services 13 Jan '16

13 Jan '16

Dear colleagues, We are pleased to announce the launch of new dates for our Webinars. The RIPE NCC Webinars are live and take only one hour. You can interact with our trainers without leaving your desk. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/lir-services/training/e-learning/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 0

Meanwhile, at ICANN...
by Shane Kerr 06 Jan '16

06 Jan '16

All, Not necessarily RIPE Database related, but I thought I'd point out that ICANN is considering replacing WHOIS for gTLD: https://www.icann.org/news/announcement-2016-01-04-en Cheers, -- Shane

3 2

Release 1.84 deployed to RC
by Tim Bruijnzeels 09 Dec '15

09 Dec '15

Dear working group, We have deployed release 1.84 to RC. This release was necessary to prepare for hardware upgrades of the whois infrastructure. Note that this release does not include the work for deprecating "changed:". This work will be part of release 1.85 that we plan to deploy to RC on 21 December, and to production on 1 February 2016. We needed to give precedence to this release, so that we will be able to upgrade the server infrastructure in January, while the release for "changed:" is still being evaluated in RC. Even though we plan to deploy 1.85 to RC on 21 December, we will only upgrade the server hardware and move to 1.84 in production in January. This upgrade does not include any API changes, however the hardware upgrade itself will involve a short outage of the RIPE DB updates. We want to do this operation after the end of year holidays when we are fully staffed, and will communicate a more detailed plan closer to the date. Please let us know if you have any concerns, comments or questions. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

1 0

[training] RIPE NCC Training Courses January-March 2016
by Training Services 07 Dec '15

07 Dec '15

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Amsterdam, London, Toulouse, Prague, Baku, St. Petersburg, Helsinki, Vilnius, Chisinau, Bishkek. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - Basic IPv6 Training Course - DNSSEC Training Course - 2 days Advanced IPv6 Training Course - 2 days BGP Operations and Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

anyone using the RIPE Databse MUST now have an SSO account?
by ripedenis＠yahoo.co.uk 02 Dec '15

02 Dec '15

Hi guys When was it discussed, agreed or announced that Webupdates will no longer allow objects to be created or updated with a password? As Webupdates is the only way to access an unfiltered version of your own MNTNER object, it is no longer possible to even retrieve a version of your own MNTNER without signing up for an SSO account. I did not realise this has become mandatory. So has it been agreed that SSO is the only authorisation method allowed to access the RIPE Database? Did I miss the announcement that passwords and PGP are being deprecated? cheersdenis

6 6