- db-wg - mailman.ripe.net

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Rob Evans 19 Oct '17

19 Oct '17

Hi, > 1) Remove the "origin:" authorization requirement. RIPE is currently > the only RIR that requires this, the current implementation creates > data concurrency issues across Internet databases by requiring the > creation of duplicate autnums. > > 2) Flag "route:" objects for non-RIPE-managed space with "source: > RIPE-NONAUTH" to identify non-authoritative data. I support both of those. I’ll observe that there have been attempts to do (1) in the past that have floundered. > 3) Consider possible, simple options to allow non RIPE resource > holders to 'approve' (if not authorise) the creation of a foreign > ROUTE object. I wouldn’t want to lose the ability to make progress on (1) and (2) because we end up getting bogged down in the details of (3), which is what I fear will happen, so I’d put something like this on the back burner for now. Cheers, Rob

5 5

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Randy Bush 18 Oct '17

18 Oct '17

> 2) Flag "route:" objects for non-RIPE-managed space with "source: > RIPE-NONAUTH" to identify non-authoritative data. why not go the other, more positive, direction, and identify authorised data with RIPE-AUTH or whatever? no need to be pejorative. randy

4 6

Re: [db-wg] violation of DB T&C by DB-WG co-chair, is it acceptable?
by Nick Hilliard 18 Oct '17

18 Oct '17

Bill, a single issue has been addressed in your email, relating to the RIPE NCC's actions in dealing with a violation of the RIPE DB T&Cs. The core issue of the complaint, namely the actions of one of the WG co-chairs, remains completely unaddressed. Can you kindly inform the working group whether, and if so, when the Database WG chairs intend to address this? Nick William Sylvester via db-wg wrote: > This message is to follow up on thread created recently with regard to a > reported violation of the RIPE Database Terms and Conditions. Several > members have commented publically and a few privately on this matter and > we wanted to publically addresses these concerns. The working group > chairs after consulting with the RIPE NCC and the RIPE Chair have > identified two primary issues in question; > > > > 1. A violation of the terms and conditions has been reported to the > working group, this is out of scope for the working group. Concerns > over usage in regard to the terms and conditions should be reported > to the RIPE NCC directly and not on the Database working group > mailing list. RIPE NCC has the responsibility and the resources to > handle these violations appropriately. It is our understanding that > the RIPE NCC has a process they have followed, and have done so with > the complaint registered on the working group mailing list. It is > the RIPE NCC’s responsibility to investigate and take action as > appropriate. As the working group, with this item referred to RIPE > NCC, we consider this issue handled and closed. > > > > 2. Conduct of a co-chair for a working group. This is a much more > challenging issue, should a chair be held accountable for the > actions of an employer? What are examples of unacceptable behavior > for a chair and when misconduct is suspected, what action, if any, > should be taken? Currently in the RIPE community there are no > policies for the removal of a chair. In the history of the RIPE > community a working group chair has only been removed once. Chair > selection is conducted through the processes identified by each > working group. Lacking a defined process, it seems that the chair > selection process coming up is the primary way the working group > selects or changes the working group leadership. > > > > I have always found David to be a good person who cares deeply about the > RIPE community, as a working group chair he has always handled working > group business with the highest integrity. I urge the working group to > consider mistakes we have each made as individuals, by our employers, > and in life. As working group chairs, we serve the working group for the > benefit of the RIPE community, we embrace open discussion from all > working group members, and we strive to resolve issues transparently > through community feedback and rough consensus. We continue to seek > community guidance in all aspects of managing the working group and look > forward to facilitating the database work in our working group. > > > > Thanks, > > > > William on behalf of the > > Database Working Group Chairs >

1 0

Re: [db-wg] violation of DB T&C by DB-WG co-chair, is it acceptable?
by Randy Bush 18 Oct '17

18 Oct '17

this is a brilliant exercise to see how far the community will bend over in pseudo-politeness while it is being slimed and abused. randy

2 2

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by George Michaelson 17 Oct '17

17 Oct '17

Yes, I would support these changes. Half of the concerns with APNIC resource management disappears if we cease depending on aut-num authorization for route objects. I prefer that ultimately the open maintainer method cease. But a step along the way is to mark foreign objects clearly, so their status and role can be understood. -George On Tue, Oct 17, 2017 at 9:23 AM, William Sylvester via db-wg <db-wg(a)ripe.net> wrote: > > > ---------- Forwarded message ---------- > From: William Sylvester <william.sylvester(a)addrex.net> > To: Database WG <db-wg(a)ripe.net> > Cc: > Bcc: > Date: Mon, 16 Oct 2017 23:22:55 +0000 > Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? > Db-wg members, > > Now that there has been substantial discussion on this topic, I wanted to try to bring the conversation back to a more practical and actionable path forward. Clearly this is a topic where there are a lot of opinions. From seeing the discussion and receiving additional feedback, I wanted to point out some re-occurring themes and request a revised proposal for working group consideration. > > > 1) Remove the "origin:" authorization requirement. RIPE is currently the only RIR that requires this, the current implementation creates data concurrency issues across Internet databases by requiring the creation of duplicate autnums. > > 2) Flag "route:" objects for non-RIPE-managed space with "source: RIPE-NONAUTH" to identify non-authoritative data. > > > I’d like to seek input from the group; > > - Do you feel these options are straight forward and easy to understand? > - Does this provide a reasonable security posture? > - Will this make a positive impact for RIPE DB and the greater Internet? > - Do you support these concepts? > > > Thanks, > William > Db-wg co-chair > >

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by denis walker 17 Oct '17

17 Oct '17

Hi Job I agree with your assessment and, although it should be in a separate thread later, I think it's worth having a discussion about notifying resource holders if a foreign ROUTE object is created in the RIPE Database. But lets focus on the main points for now. cheersdenis co-chair DB WG From: Job Snijders via db-wg <db-wg(a)ripe.net> To: den is <denis1(a)gmail.com> Cc: Database WG <db-wg(a)ripe.net> Sent: Tuesday, 17 October 2017, 10:06 Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? Dear Denis, Just to make sure we are on the same page, the 2 items presented by Bill are not two mutually exclusive options, I think both need to be done. On Tue, Oct 17, 2017 at 01:04:08AM +0000, den is via db-wg wrote: > 3) Consider possible, simple options to allow non RIPE resource > holders to 'approve' (if not authorise) the creation of a foreign > ROUTE object. An even simpler option is to not even attempt to authorize the creation of non-RIPE route objects, but simply flag them as "RIPE-NONAUTH". If people want to create authoritive route objects for non-RIPE-managed space they can create those objects in the DB from the RIR where the space is managed (APNIC, AFRINIC, etc). While on the surface of things, it looks trivial to have the RIPE database software fire off an email to what most probably is the legitimate 'foreign' owner of the IP block, it introduces quite some complexity such as "what if the resource is transfer to a new owner" "what if the resource is transferred to a new owner and a new RIR". Even though at some point in the past a form of approval was given, a day later that approval may have been revoked. The RIPE DB would have to continuously track movement of IP space. The continuously tracking of ownership aspects in other databases certainly can be done, but now the project no longer is simple low hanging fruit. I see some value if the RIPE DB could notify owners of non-RIPE IP blocks when non-authoritative data is created in the RIPE DB, but I think that would be something to consider in the future. Kind regards, Job

1 1

Fw: Foreign ROUTE objects in RIPE Database - final decision?
by denis walker 17 Oct '17

17 Oct '17

Hi Randy I don't think anyone cares how much work a script has to do, whether it's the one that writes or reads the data. But keep in mind that the RIPE Database was designed to be, and still largely is, human readable. So for the poor humans who delve into the database manually it's probably better not to confuse them with extra, new tags on 95% of the data that has the same meaning as before, and just tag that little 5% (or so) that can now be interpreted differently. cheersdenisco-chair DB WG From: Randy Bush via db-wg <db-wg(a)ripe.net> To: job(a)instituut.net Cc: Nick Hilliard via db-wg <db-wg(a)ripe.net> Sent: Tuesday, 17 October 2017, 19:34 Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? >>> 2) Flag "route:" objects for non-RIPE-managed space with "source: >>> RIPE-NONAUTH" to identify non-authoritative data. >> >> why not go the other, more positive, direction, and identify authorised >> data with RIPE-AUTH or whatever? no need to be pejorative. > > This is not meant to be pejorative. "RIPE-NONAUTH" was brought up > because that way we don't touch the majority of objects that actually > are valid, and belong with RIPE. ahh, the poor overworked script will have less to do so we will have to pay it less. good plan. > If you have a different suggestion than "RIPE-NONAUTH" I think the group > would be all ears. "RIPE-2", "RIPE-OTHER", all is fine with me. for those old enough to remember, RARE

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by den is 17 Oct '17

17 Oct '17

3) Consider possible, simple options to allow non RIPE resource holders to 'approve' (if not authorise) the creation of a foreign ROUTE object. cheers denis co-chair DB WG On 17 October 2017 at 01:23, William Sylvester via db-wg <db-wg(a)ripe.net> wrote: > > > ---------- Forwarded message ---------- > From: William Sylvester <william.sylvester(a)addrex.net> > To: Database WG <db-wg(a)ripe.net> > Cc: > Bcc: > Date: Mon, 16 Oct 2017 23:22:55 +0000 > Subject: Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision? > Db-wg members, > > Now that there has been substantial discussion on this topic, I wanted to try to bring the conversation back to a more practical and actionable path forward. Clearly this is a topic where there are a lot of opinions. From seeing the discussion and receiving additional feedback, I wanted to point out some re-occurring themes and request a revised proposal for working group consideration. > > > 1) Remove the "origin:" authorization requirement. RIPE is currently the only RIR that requires this, the current implementation creates data concurrency issues across Internet databases by requiring the creation of duplicate autnums. > > 2) Flag "route:" objects for non-RIPE-managed space with "source: RIPE-NONAUTH" to identify non-authoritative data. > > > I’d like to seek input from the group; > > - Do you feel these options are straight forward and easy to understand? > - Does this provide a reasonable security posture? > - Will this make a positive impact for RIPE DB and the greater Internet? > - Do you support these concepts? > > > Thanks, > William > Db-wg co-chair > >

2 1

Re: [db-wg] violation of DB T&C by DB-WG co-chair, is it acceptable?
by Brian Nisbet 17 Oct '17

17 Oct '17

On 14/10/17 12:37, Carsten Schiefner wrote: >> William, >> >> On 13.10.2017 21:56, William Sylvester wrote: >>> [...] >>> >>> 2. Conduct of a co-chair for a working group. This is a much more >>> challenging issue, should a chair be held accountable for the >>> actions of an employer? >> >> are we really talking about an action by some random colleagues of David >> he'd barely know as they would work in another department across the >> street and therefore he'd almost never have anything to do with them? > > I can speak to this from personal experience. > > When I worked for BT, a misguided salesdroid mined the RIPE DB and > used it to send spam to possible customers. When I found out I > arranged for the salesdroid to be suitably formally warned, extracted > an apology from them and passed the apologies of the company to the > RIPE NCC and the community. At the time I was a co-chair of the DB WG. > > I would expect any member of the community (not just a WG chair) to do > likewise. > > Nigel I would very much like to see, at the very least, something similar to the above, very clearly and formally. There are, it should be pointed out, processes for removal of WG Chairs, however the DB WG has not decided to have one. There are examples out there that the WG could adopt if it wishes. The problems that occurred in Rome were one of the reasons the community felt that a process was a good idea, but remember, lack of documented process didn't stop things happening on that occasion. The WG has the power to effect change if needed. This is *still* not a great state of affairs and while I don't want to take away from the points that must be discussed in Dubai, I would, at this point, expect it to be on the agenda at the meeting. Thanks, Brian

1 0

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Nick Hilliard 17 Oct '17

17 Oct '17

Daniel Shaw via db-wg wrote: > On 17/10/2017, 03:24, William Sylvester via db-wg typed: >> > >> > >> > 1) Remove the "origin:" authorization requirement. RIPE is currently the only RIR that requires this, the current implementation creates data concurrency issues across Internet databases by requiring the creation of duplicate autnums. >> > >> > 2) Flag "route:" objects for non-RIPE-managed space with "source: RIPE-NONAUTH" to identify non-authoritative data. >> > >> > >> > I’d like to seek input from the group; >> > >> > - Do you feel these options are straight forward and easy to understand? >> > - Does this provide a reasonable security posture? >> > - Will this make a positive impact for RIPE DB and the greater Internet? >> > - Do you support these concepts? >> > > > Yes. There isn't really any downside to these. There are clear benefits to both. Agreed. This sounds like a sensible thing to do. Nick

1 0