- db-wg - mailman.ripe.net

2022-01 personal data in the "descr:" attribute
by denis walker 06 Jul '22

06 Jul '22

Colleagues Up to now we have focused mostly on member's personal data. But this isn't only about members. The database contains lots of personal data for end users as well. The INET(6)NUM objects have a "descr:" attribute. This has been used extensively for (personal) data about end users, mostly name and address, but maybe also phone numbers. There may well be more of these who are natural persons than members. There are 4.2m INETNUM objects in the database. So the scale of the problem may be far higher here. This is also a more complicated problem. The data is entered by resource holders and possibly multiple levels of sub-allocation holders. The issue of informed consent is hard to judge. Consent may be in the small print of a contract and it may not be clear to the data subject just what they are consenting to. The RIPE Database may contain the home address of many end users without them knowing what this database is or what the consequences are of publishing their personal data in it. This data is also unstructured, unverified, undefined free text. As with member's data there are pros and cons regarding the usefulness of this data. Also the defined purposes of the database cover adding the name and phone number of an end user as part of the public registry, but again not their home address. With the data being undefined, it is not clear what any address relates to. We don't know what address the resource holder asked for or what address the end user supplied. The address, therefore, has no meaning to anyone reading this data. So the question we need to discuss is what do we do with this data in the "descr:" attributes? Perhaps I can start the discussion with a suggestion. First of all we should never overload free text attributes with structured data. So if we want to add a name and address to resource objects we should include user name and address attributes. If we are going to add a new address field we should break it down into a structured set of address attributes, as all addresses should have been from the start. Maybe a phone and/or email attribute is also needed, keeping in mind most end users don't usually have an ORGANISATION object. Any new attributes can all be optional, as it is by choice that resource holders currently add any such data into the "descr:" attributes. The same rules would apply to this data as we have discussed with the members' data. Phone and email must be business data and not personal and they will be verified. (I will explain more about verification in response to Leo's email.) Name may be personal if the end user is a natural person. In that case any optional address added must not be more specific than country and region. Another possible solution could be to optionally create an ORGANISATION object for end users. Either way, this data should not be in the "descr:" attribute. Most of this can be discussed later with the implementation details. What is really important as far as this policy proposal is concerned is the recognition that the same principles of processing personal data will be applied to end users as it is to members, regardless of what objects the data is stored in. cheers denis Proposal author

2 3

Thoughts on 2022-01
by Leo Vegoda 01 Jul '22

01 Jul '22

Hi, Thank you for producing this proposal. It's important to regularly review policy and implementation to ensure we are meeting our legal responsibilities. Parts of the text in this proposal are clear and easy to interpret. For example section 3.0 on Notifications is well written. Other parts are highly ambiguous. The text as written would just lead to disputes. For example, "Email addresses added as contact details and all phone and fax numbers entered into the RIPE Database must be verified." Who must verify them, what must they verify, and when should this happen? Is this just a check that the contact information is syntactically correct? Or is this a check that a fax machine is active and used by the organization listed alongside it? It would be helpful to clearly separate the sections defining a principle from those defining an implementation. The text on verification and compliance is so ambiguous that it's not possible to understand what an implementation would look like. Kind regards, Leo Vegoda

2 2

2022-01 v2 Personal Data in the RIPE Database
by Cynthia Revström 29 Jun '22

29 Jun '22

Hi db-wg, I just want to say that I mostly support the current proposal of 2022-01 (v2). I would prefer it if the following section was reworded in some way to make it more clear how the full home address is never justified and how the default should be no address at all for individuals. Also I think it should be changed to assume that any address an individual is operating from is a home address unless the individual themselves clearly say that it is not a home address. I would still support it in its current form without these changes but I would strongly prefer if these were made to prevent any confusion or ambiguity. (this section is part of 1.0 Organisations) <quote> The name of the organisation (which may be the personal data of a natural person) holding an Internet resource or managing part of an Internet resource, for example a sub-allocation, or using a block of addresses, is an essential part of the public registry. This identification is one of the principal purposes of the database. Any valid address could be helpful. Different types of addresses can be considered including postal addresses. The name and address of a natural person holding or using a resource and operating from a home address are the only personal data that can be justified to be published in the RIPE Database, provided there is documentary evidence held by the RIPE NCC, or a sponsoring LIR, or any resource holder that registered the subject’s details in the RIPE Database, that the natural person has consented to their name and address being published in this public registry. This consensual identification is a requirement of the public registry for holding an Internet resource or managing or using part of an Internet resource. A postal address may optionally be added by the resource holder or manager. Where the resource holder, manager or user is a natural person, the parts of any type of address more specific than country and region must not be entered in any object attribute. </quote> -Cynthia

1 0

Re: [db-wg] Request for the correct review of document link
by Christian Nzhie 29 Jun '22

29 Jun '22

> > Good morning folk, I was reading this archive on the folowing link > https://www.ripe.net/ripe/mail/archives/db-wg/2022-June/007459.html > and I saw this > > The PDP document can be found at:https://www.ripe.net/publications/docs/ripe-710 > > However, when I click on the above link to review the proposal, I am > seeing the following red notice: This document is obsoleted by ripe-781 > <https://www.ripe.net/publications/docs/ripe-781> > So, please, kindly provide the correct link of version 2 under review... > Thanks in advance... > Christian Nzhie. >

2 1

RIPE Database Quarterly Planning Q3 2022
by Edward Shryane 29 Jun '22

29 Jun '22

Dear colleagues, We have published our quarterly plans for Q3 2022 for the RIPE Database: https://www.ripe.net/manage-ips-and-asns/db/quarterly-planning We recently made usability improvements to the website and in this quarter we’re planning on migrating the RIPE Database documentation to a new interface. We will announce on the list when this is ready. The goal of our quarterly planning is to communicate the work we’re doing for the coming months, get your input and start a discussion on other developments we should work on. If you have comments or questions around this, we hope you'll let us know on the list or you can always contact the DB team directly at ripe-dbm(a)ripe.net . Regards, Ed Shryane RIPE NCC

1 0

Updating Descr part of object with # results in No Operation
by Sascha E. Pollok 28 Jun '22

28 Jun '22

Hi everyone, I just tripped over something today which I have never noticed after >20 years of using the RIPE DB :-) It might be explained somewhere but I haven't found anything so here it is. I am updating an inetnum object from: descr: Testobject Ticket #12345 to descr: Testobject Ticket #123456 using Syncupdate. This results in a "No Operation" (Warning: Submitted object identical to database object). Is this intentional? It works if I remove the # and add it again in a second step. I assume it's something about it being interpreted as a comment but even if that's the case, I should still be able to update it. Can someone enlighten me? Thank you and best regards Sascha

4 7

2022-01 V2 Resource Holders Address
by denis walker 27 Jun '22

27 Jun '22

Colleagues I have listened to your comments in recent discussions and had some preliminary talks with the RIPE NCC about what could be implemented. So now we have a second version of my proposal on personal data. I was getting comments from people that LEAs need addresses for their investigations, but also people had serious privacy concerns about publishing their home address in the database. I was considering the idea of publishing addresses with restricted access. However it seems that it is almost impossible to confirm the identity of LEAs (even from within our own region, never mind globally) and perhaps other NGOs that could be eligible to access this restricted data. So that idea is not viable. Then there was an issue over data quality of the addresses currently published in the database. In the ORGANISATION object the address is assumed to be a postal address. This mandatory address is entered and managed by the resource holders. No verification is done on this address. In the database documentation it says: "This is a full postal address for the business contact represented by this organisation object." That could be anyone. They don't even need to be located in the country where the organisation operates it's business. Being so loosely defined, any kind of verification would be impossible. That makes this address almost meaningless. It is on the same level as the "country:" attribute in resource objects. It only has meaning to whoever manages the data. Also by having this unverifiable address mandatory, we are almost inviting those who don't want to be easily located to enter false data. Especially as it is almost impossible to identify any of this postal address data as being true or false. I am therefore suggesting we make this postal address an optional attribute. If any resource holder wishes to enter this optional postal address they can do so. But if it is a personal address they must not enter more than region and country. The full personal address of a natural person must not be entered into the database in any object type. Optional data, when provided, is more likely to be accurate. Making this address optional is in line with a recommendation of the RIPE Database Task Force. Some will still argue that false data is useful if 'bad actors' enter the same false data in different places. That offers investigators an opportunity to cross reference this (false) data over different objects using the free text search facility of the database. In some cases this may be the only way to make these data links. Doing this has many problems. We cannot justify preserving false data in the database to allow some people to use an 'accidental feature'. There is no guarantee the same false data will be used in multiple places. There is a defined purpose of the database that allows LEAs to use public information from the database as part of their investigations. This purpose is actually about granting permission to LEAs to use available data. It does not define any data to be published in the database for the sole benefit of LEAs. So there is no purpose requiring this postal address to be published in the database. Optional is therefore a convenience for anyone who wishes to enter it. cheers denis policy proposer

4 20

2022-01 New Version Policy Proposal (Personal Data in the RIPE Database)
by Angela Dall'Ara 24 Jun '22

24 Jun '22

Dear colleagues, RIPE policy proposal 2022-01, "Personal Data in the RIPE Database" is now available for discussion again. The goal of this proposal is to allow the publication of verified Personal Data in the RIPE Database only when they are justified by its purpose. This proposal has been updated following the last round of discussion and is now at version 2.0. Some of the differences from version 1.0 include: - Publishing only country and region for natural persons - Making the current postal address publication optional for all - Allowing for the publication of different types of addresses in the future You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2022-01 As per the RIPE Policy Development Process (PDP), the purpose of this four week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposer, with the agreement of the WG Chairs, will decide how to proceed with the proposal. The PDP document can be found at: https://www.ripe.net/publications/docs/ripe-710 We encourage you to review this proposal and send your comments to db-wg(a)ripe.net before 15 July 2022. Kind regards, Angela Dall'Ara Policy Officer RIPE NCC

5 20

Re: [db-wg] [anti-abuse-wg] Proposal 2022-01
by denis walker 23 Jun '22

23 Jun '22

Yes Carlos you are absolutely right. There is no suggestion whatsoever that any membership will be revoked or any resources de-registered if any verification fails. Cheers denis Proposal author On Thu, 23 Jun 2022, 11:48 Carlos Friaças via anti-abuse-wg, < anti-abuse-wg(a)ripe.net> wrote: > > > Hi, please see inline. > > > On Thu, 23 Jun 2022, Ronald F. Guilmette wrote: > > > Just curious... How many of you folks have actually read sections 4.0, > 5.0, > > and 6.0 of this pending proposal from the Database Working Group? > > Read it just now. :-) > > > > https://www.ripe.net/participate/policies/proposals/2022-01 > > > > I suspect that many of you are going to want to read those sections > before > > you have your memberships revoked for non-compliance. > > I can't read any details about membership revokation. Also i don't see it > as implicit. > > The three sections make perfect sense to me. In section 6.0, if i > understood correctly this won't apply to legacy resources which are still > out of any contractual relationship -- which also seems fine. > > > Regards, > Carlos > > > > Regards, > > rfg > > > > -- > > > > To unsubscribe from this mailing list, get a password reminder, or > change your subscription options, please visit: > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > > > > -- > > To unsubscribe from this mailing list, get a password reminder, or change > your subscription options, please visit: > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg >

2 1

test database
by denis walker 22 Jun '22

22 Jun '22

Hi Why can I not create an AUT-NUM object in the test database using the web UI? It is not in the drop down menu on the create page. That of course means I can't create ROUTE(6) objects either. So I can't do anything with the routing registry in test mode. Although there is an orange banner across the top of the page saying 'TEST Environment' all the left hand index items refer to the RIPE Database. This is confusing. I would prefer them to refer to the TEST Database. cheers denis co-chair DB-WG

2 4

2022-01 Policy Proposal, Personal Data in the RIPE Database V2
by William Sylvester 13 Jun '22

13 Jun '22

All, I wanted to notify the workgroup that there is a new version of the Personal Data Proposal coming, it would be best to save any comments for the discussion period of that version. Please let me know if you have any questions. Thanks, William DB-WG Co-Chair

1 0

rfc2770
by Max Tulyev 03 Jun '22

03 Jun '22

Hi All! May be you know, if you have a 16-bit ASN, you have a /24 IPv4 network reserved for you for multicast purposes. It is 233.asnum-hi-octets.asnum-lo-octets.0/24: https://datatracker.ietf.org/doc/html/rfc2770 My ASN is 29632, so the prefix is 233.115.192.0/24 I would like to start using it (well, for testing purposes now). To do so, I need a route object in the RIPE database. How can I create it?

5 6

2022-01 Resource holders identity
by denis walker 01 Jun '22

01 Jun '22

Colleagues Now we move on to the more difficult issue of identifying resource holders. For any resource holder that is not a natural person I don't think there is a privacy issue. For natural persons we seem to have this conflict between privacy and public interest. The privacy issue is well understood. Publishing the name and address of a natural person in an open, public database can have severe consequences. But what is the public interest? To understand this question we have to dig deep into the purpose of the RIPE Database. Terms are thrown around with little consideration to what they actually mean. We all know the RIPE Database is a 'public registry', but what does that really mean? What is it a registry of, why does it need to register this, who needs to know what and why? After 30 years maybe we need to re-evaluate the fundamental purpose of this database. The database is a number, routing and reverse delegation registry. The routing and delegation elements generally don't include personal data, so we can put them to one side for the moment. What is the number registry? It 'documents' IP addresses (IPv4 and IPv6). It is arguable if ASNs are part of the number or routing registry. Although they are Internet resources, the "org:" attribute is optional so it is not possible to identify the resource holder of an ASN using the database. There are a number of reasons that have been given over the years for why this documentation is required. To ensure allocations and assignments are unique. To know what parts of allocations are 'in use' by end users. To identify who is responsible for a block of address space. To have a means of contacting network operators for several reasons. We have already discussed contacts, so the key issue here relating to both privacy and public interest is identifying who is responsible for a block of address space. Let's consider why this needs to be done and who needs to know. ORGANISATION and INET(6)NUM objects all reference contacts. So if there are any technical, administrative or abuse issues there are contacts who can handle these issues. We have already agreed that contacts must be contactable and they must only exist in the database if they are capable of addressing the related issues. So what is the reason for wanting or needing to be able to identify who is responsible for a block of address space and where to find them? Taking away all the issues that contacts can handle, are we down to purely legal matters? Is it for those cases involving criminal or abusive behaviour that someone wants to hold the responsible party accountable or liable? Are there research and investigatory reasons for identifying the holders of blocks? Do some people want to cross reference assignments held by individuals or organisations from multiple, different resource holders to monitor activities? If so, is it in the public interest and should it override privacy? Before we can decide on the priorities of privacy vs public interest, we need to understand what that public interest is. How does that public interest fit with the purpose of the database? We need to have this discussion now on the purpose of the database and the public interest, or not, in certain bits of data to decide if the identities of natural persons holding resources can, should, must be hidden from public view. cheers denis proposal author

4 13

Re: [db-wg] 2022-01 Resource holders identity
by denis walker 31 May '22

31 May '22

Hi Tyrasuki On Tue, 31 May 2022 at 07:24, Tyrasuki <me(a)tyrasuki.be> wrote: > > Hi Denis, > > I assume yes, but has it already been suggested to go for a > middle-ground, and have resources possibly identified by for example, a > nickname / username? That could be quite complicated and not sure of the benefit. Especially with assignments. How would we know the same nickname was used each time for a specific person? > > As an example, I use Tyrasuki everywhere as my online nickname, and I > hold 4 PI assignments and 2 ASNs. But there is a PERSON and ORGANISATION object in the database with your full name and address details. These are linked to several INET(6)NUM and AUT-NUM objects. So your personal details are fully exposed. > > This would still make it possible for people to know I operate the > network, and I can then, on for example my personal site, list contact > details if I'd find this necessary. Contacts are not an issue. They can be fully documented without personal data (check out the thread on this list about contact details). cheers denis proposal author > > Or even on PeeringDB for that matter. :) > > (I might have possibly glimpsed over this a bit too quick if this was > already ruled out of the question) > > As for public interest, the only reason I could see it being relevant is > to know who to address in mails. > > PS: I am writing this directly instead of to the mailing list, as I'm > not sure if my points mentioned above make a lot of sense or not. (It's > currently 7:00 in the morning and I've been up all night debugging > hardware. :) ) > > Kind regards, > Tyrasuki > > https://tyrasuki.be > F587 F089 1655 A5E0 > > On 5/30/2022 1:17 PM, denis walker via db-wg wrote: > > Colleagues > > > > We had a good discussion on contact details, I am hoping we can do the > > same on resource holder identity. I know there is reluctance in the > > community to get into a deep discussion on the purposes of the RIPE > > Database. The Task Force sidestepped the issue as far as any public > > discussion is concerned. It is a difficult subject. The use of the > > database as a public registry is not in question. We do need an > > updated understanding of what that means. > > > > If no one is able to present the public interest case for publishing > > the name and address of natural persons holding resources then the > > privacy case takes priority. If we cannot justify publishing this > > personal information based on the purposes, then the GDPR says very > > clearly that we must not publish it. All personal details of natural > > persons holding resources will have to be removed from the database or > > hidden from public view. This will also apply to assignments as well. > > There are many assignments with name and full address details of > > natural persons in the "descr:" attributes. We will have to remove the > > "descr:" attributes where the assignee is a natural person or hide > > them from public view. > > > > We need to have this discussion now and reach a new consensus, no > > matter how difficult it is...otherwise privacy overrides all other > > concerns, which may be the new consensus anyway. > > > > cheers > > denis > > proposal author > > > > On Thu, 26 May 2022 at 16:29, denis walker <ripedenis(a)gmail.com> wrote: > >> > >> Colleagues > >> > >> Now we move on to the more difficult issue of identifying resource > >> holders. For any resource holder that is not a natural person I don't > >> think there is a privacy issue. For natural persons we seem to have > >> this conflict between privacy and public interest. The privacy issue > >> is well understood. Publishing the name and address of a natural > >> person in an open, public database can have severe consequences. But > >> what is the public interest? > >> > >> To understand this question we have to dig deep into the purpose of > >> the RIPE Database. Terms are thrown around with little consideration > >> to what they actually mean. We all know the RIPE Database is a 'public > >> registry', but what does that really mean? What is it a registry of, > >> why does it need to register this, who needs to know what and why? > >> After 30 years maybe we need to re-evaluate the fundamental purpose of > >> this database. > >> > >> The database is a number, routing and reverse delegation registry. The > >> routing and delegation elements generally don't include personal data, > >> so we can put them to one side for the moment. What is the number > >> registry? It 'documents' IP addresses (IPv4 and IPv6). It is arguable > >> if ASNs are part of the number or routing registry. Although they are > >> Internet resources, the "org:" attribute is optional so it is not > >> possible to identify the resource holder of an ASN using the database. > >> There are a number of reasons that have been given over the years for > >> why this documentation is required. To ensure allocations and > >> assignments are unique. To know what parts of allocations are 'in use' > >> by end users. To identify who is responsible for a block of address > >> space. To have a means of contacting network operators for several > >> reasons. > >> > >> We have already discussed contacts, so the key issue here relating to > >> both privacy and public interest is identifying who is responsible for > >> a block of address space. Let's consider why this needs to be done and > >> who needs to know. ORGANISATION and INET(6)NUM objects all reference > >> contacts. So if there are any technical, administrative or abuse > >> issues there are contacts who can handle these issues. We have already > >> agreed that contacts must be contactable and they must only exist in > >> the database if they are capable of addressing the related issues. So > >> what is the reason for wanting or needing to be able to identify who > >> is responsible for a block of address space and where to find them? > >> Taking away all the issues that contacts can handle, are we down to > >> purely legal matters? Is it for those cases involving criminal or > >> abusive behaviour that someone wants to hold the responsible party > >> accountable or liable? Are there research and investigatory reasons > >> for identifying the holders of blocks? Do some people want to cross > >> reference assignments held by individuals or organisations from > >> multiple, different resource holders to monitor activities? If so, is > >> it in the public interest and should it override privacy? > >> > >> Before we can decide on the priorities of privacy vs public interest, > >> we need to understand what that public interest is. How does that > >> public interest fit with the purpose of the database? We need to have > >> this discussion now on the purpose of the database and the public > >> interest, or not, in certain bits of data to decide if the identities > >> of natural persons holding resources can, should, must be hidden from > >> public view. > >> > >> cheers > >> denis > >> proposal author > > >

1 0

phone number required for person objects
by Cynthia Revström 26 May '22

26 May '22

Hi, TL;DR: stop requiring the "phone" attribute for person objects. This is something that I quickly brought up during the db-wg session at RIPE84 but thought would be good to bring up here as well. Currently you need to specify a phone number for person objects but not for role objects, which I think should be fixed (as in not require it for person objects either). While there is the argument to be made to not encourage use of person objects or whatever, I do think that we should make sure that they are functionally the same as to prevent people putting PII in role objects. This is so we can still keep track of how many personal contact objects there are, which would be more difficult if people used role objects for personal contacts. -Cynthia

6 20

2022-01 New Policy Proposal (Personal Data in the RIPE Database)
by Angela Dall'Ara 25 May '22

25 May '22

Dear colleagues, A new RIPE Policy proposal, 2022-01, "Personal Data in the RIPE Database" is now available for discussion. The goal of this proposal is to allow the publication of verified Personal Data in the RIPE Database only when they are justified by its purpose. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2022-01 As per the RIPE Policy Development Process (PDP), the purpose of this four week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposer, with the agreement of the WG Chairs, will decide how to proceed with the proposal. The PDP document can be found at: https://www.ripe.net/publications/docs/ripe-710 We encourage you to review this proposal and send your comments to db-wg(a)ripe.net before 8 June 2022. Kind regards, Angela Dall'Ara Policy Officer RIPE NCC

5 8

Decision on NWI-2 Historical queries
by denis walker 18 May '22

18 May '22

Colleagues When I wrote the spec for historical queries, almost 10 years ago, I included an arbitrary constraint to only show history back to the most recent deletion point. This was to get something in production quickly and see how useful it was. Over the years several people have asked for this arbitrary constraint to be removed. No one has objected to removing it. The co-chairs therefore recommend that this arbitrary constraint be removed. The co-chairs now ask the RIPE NCC to produce an impact analysis and implementation plan to remove it. We will then seek a final approval from the community on the plan. cheers denis co-chair DB-WG

5 10

Impact Analysis for UTF-8 in the RIPE Database
by Edward Shryane 12 May '22

12 May '22

Dear Colleagues, The RIPE NCC was requested by the Database Working Group to perform an impact analysis for UTF-8 in the RIPE Database, including the technical and functional effects on the RIPE NCC itself. How would the RIPE Registry function with UTF-8? And what would be the impact on running the Registry? The RIPE NCC has now published a RIPE Labs article detailing the impact analysis: https://labs.ripe.net/author/ed_shryane/impact-analysis-for-utf-8-in-the-ri… Regards Ed Shryane RIPE NCC

1 0

DB Task Force Recommendations
by denis walker 11 May '22

11 May '22

Colleagues The chairs propose creating a series of NWIs to address the recommendations recently made by the Database Task Force that are considered to be relevant to the DB-WG. NWI-15 Baseline requirements for registration information NWI-16 Using RIPE Database as an IPAM solution NWI-17 Historical data NWI-18 Operational Contact Information They can all reference this page as the Problem Definition https://www.ripe.net/participate/ripe/tf/rdb-requirements-tf/database-requi… cheers denis co-chair DB-WG

2 1

Agenda RIPE84 - Database Working Group
by William Sylvester 09 May '22

09 May '22

Dear Database Working Group Members, Below is the agenda for the Database Working Group for RIPE84. If you would like to present, have questions, comments, or requested changes please let the chairs know. Best regards, William & Denis DB-WG Chairs A. Introduction - 10 min * Welcome * Scribe * Jabber * Chairs & Succession Planning * Agenda B. NWI Update – 20 mins Denis Walker, Co-Chair DB-WG C. Operational Update– 20 mins Edward Shryane, RIPE NCC D. Personal Data in the RIPE Database – 20 mins Denis Walker, Co-Chair DB-WG Z. AOB (open discussion)

1 0

NWI-1 Staying on top of abuse contact changes
by denis walker 09 May '22

09 May '22

Colleagues There has been no interest in this item for several years so the chairs recommend cancelling NWI-1. We ask the RIPE NCC to mark it as 'Cancelled'. cheers denis co-chair DB-WG

1 0

Whois Release 1.103
by Edward Shryane 09 May '22

09 May '22

Dear Colleagues, RIPE Database release 1.103 has been deployed to the Release Candidate environment. We plan to deploy to production on Monday 9th May. The database in the Release Candidate environment has been reloaded with dummified production data from 20th April. This release includes the following main changes: • Fixed "goefeed:" validation when reading object containing multiple remarks: attributes (#975) • Removed WHITEPAGES org type. (#1003) • Better Error Message when Changing "mnt-by:" on Allocations (#988) • Allow user "mnt-by:" when creating inet6num allocations (already allowed for inetnums) (#982) • Disallow weak keys and hash algorithms (#642, #974) • Abuse-c is Required for End User Organisations With Resources (#955, #969) • Domain overlap validator (#956) • Increase HTTP idle timeout from 30s to 60s (#998) The release notes are on the website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… More information on the Release Candidate environment can be found on our website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/rc-release-candid… Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

1 1

Update: NWI-2, NWI-4, NWI-8
by denis walker 03 May '22

03 May '22

Colleagues The RIPE NCC is working on an impact analysis and new legal review for NWI-2 Historical Queries. The chairs ask the RIPE NCC to also produce an impact analysis on NWI-4 Status Value based on the addition of a new value 'ALLOCATED-ASSIGNED PA' The chairs ask the RIPE NCC to mark NWI-8 as 'Finished (Stage 2 Cancelled)' cheers denis co-chair DB-WG

2 1

Missing org: fields for direct allocations from RIPE
by Ronald F. Guilmette 30 Apr '22

30 Apr '22

Some considerable time ago I previously noted here the fact that there exists in the RIPE WHOIS data base some WHOIS records for what I personally would refer to as "top level" IP address block allocations (i.e. ones which were assinged directly by RIPE NCC to some specific RIPE member organization) and that contain no org: field which would otherwise associate these blocks with a specific organisation having its own organisation: record in the data base. At that time, I was basically told (by denis, as I recall) that this was a historical artifact in the data base, that it would absolutely NOT be rectified, and that I should go pound sand. Having long ago become resigned to this level of respectful helpfulness when raising legitimate issues relevant to the RIPE data base here, I let it go, and I have not raised the issue again since that itme. Now however I feel that I have some clear and concrete basis for doing so. I call everyone's attention to the following post that I just made to the mailing list of the RIPE Anti-Abuse Working Group: https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2022-April/006346.html I should say that it is my (naive?) belief that (a) every operator of an inbound mailbox or an inbound mail server should have the right to decide for themselves when any given network is not worthy of having its inbound emails accepted, and also (b) RIPE and the RIPE WHOIS data base should not make the task of locally filtering inbound packets or emails from a given network any harder than it needs to be. As noted in the mailing list post linked to above, it is my desire to locally block all further inbound emails from the entire set of IPv4 CIDRs currently associated with the Dutch network which is alternatively known as Signet B.V. and/or TransIP B.V. (These people are clearly lack the requsite minimal level of competence to run a network from which outbound emails emmanate.) In any universe guided by either reason or simplicity it should be easily possible to find the ORG handle for any given (offending) network and then to use that handle as a "reverse" lookup key in a query to the relevant RIR data base and thus automatically derive the full set of IP address blocks currently assigned to the given organization. Unfortunately, and for reasons that have yet to be adequately explained, we do not live in that simple or rational universe, at least not when it comes to the RIPE WHOIS�data base. For quite some time now I have had a relatively trivial Perl script that does this exact job. I call it "org2cidrs". It works flawlessly when provided an ORG handle known to any one of the five Regional Internet Registries, except in the case of RIPE where, as I have noted above, some IP block allocations have no org: field and thus no connection to any particular organisation... at least none that could be automatically determined by a reverse WHOIS query based on some ORG handle. The bottom line is that although I have found it quite easy to deduce that the handle ORG-SI6-RIPE represents the offending organization that I would now like to block, a reverse (org) WHOIS query against the RIPE WHOIS server using that handle yields only a subset of the IP block allocations currently assigned to that organisation. More specifically, although the vast majority of IP blocks assigned to this organization do in fact have corresponding WHOIS records in the data base that -do- contain an org: field designating ORG-SI6-RIPE as the registrant organization, the following two blocks, both marked as "status: LEGACY", have no org: field present in their respective RIPE WHOIS records, and thus these allocation records are effectively invisible to any reverse WHOIS query using -any- ORG handle (e.g. ORG-SI6-RIPE) as lookup key: 136.144.128.0/17 157.97.168.0/22 I don't know how to say this delicately, so I will just say it. It is, in my opinion, fundamentally idiotic that every other one of the five Regional Internet Registries make it trivially easy to find ALL of the IP allocations associated with a given ORG handle, but that RIPE, for reasons that are apparently shrouded in mystery and/or which have long ago been lost to the sands of time, continues to insist on making what should be simple difficult. The last time I checked there were only on the order of about 122 "top level" RIPE IP block allocations whose corresponding WHOIS records failed to include an org: field. In each of these cases it would be trivially possible for RIPE NCC to manufacture an appropriate organization: record out of the information already in the data bases and/or information which is readily available on the web or from the actual organizations themselves. Once these new organisation: records were created it would also be trivial for RIPE NCC to insure that every single IP block allocation in the data base is associated with some ORG handle, thus simplifying automated processing of the data base -and- bringing its functionality into line with that of the other four RIR data bases. The fact that this has not already been done, especially in a case like the legacy blocks which clearly belong to ORG-SI6-RIPE, is, I think, indicative of some narrow-minded insistance on the preservation of past practices, even when those practices are, as in this case, provably detrimental to reasonable and serious users of the data base. Regards, rfg P.S. I have always and will always argue in favor of anything that simplifies the parsing and/or automated processing of WHOIS data base records. Having *every* IP block allocation record include an org: field would do just that. Furthermore, quite frankly I am both flummoxed and flabberghasted that a call was made here, some time ago, for suggestions on how to make it simpler to parse the data base, EVEN AS my simple, straightforward, and (I would have thought) obvious suggestion to represent all handles in the data base only and consistantly in upper case garnered -no- response from this working group whatsoever.

2 3

NWI-8 LIR´s SSO Authentication Groups
by denis walker 25 Apr '22

25 Apr '22

Colleagues This work item had two defined stages. Stage 1 was to introduce a default authentication group for LIRs. This has been implemented and is in widespread use now. Stage 2 was to introduce user defined authentication groups. This has had no discussion with little support or objection. If anyone feels this would be a useful extension please let the working group know. Otherwise the co-chairs will recommend that stage 2 is cancelled and NWI-8 is marked as Finished. cheers denis co-chair DB-WG

1 0