- db-wg - mailman.ripe.net

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by William Sylvester 16 Oct '17

16 Oct '17

Db-wg members, Now that there has been substantial discussion on this topic, I wanted to try to bring the conversation back to a more practical and actionable path forward. Clearly this is a topic where there are a lot of opinions. From seeing the discussion and receiving additional feedback, I wanted to point out some re-occurring themes and request a revised proposal for working group consideration. 1) Remove the "origin:" authorization requirement. RIPE is currently the only RIR that requires this, the current implementation creates data concurrency issues across Internet databases by requiring the creation of duplicate autnums. 2) Flag "route:" objects for non-RIPE-managed space with "source: RIPE-NONAUTH" to identify non-authoritative data. I’d like to seek input from the group; - Do you feel these options are straight forward and easy to understand? - Does this provide a reasonable security posture? - Will this make a positive impact for RIPE DB and the greater Internet? - Do you support these concepts? Thanks, William Db-wg co-chair

1 0

Re: [db-wg] Whois release 1.90 in Release Candidate environment, production release planned for 16 October
by denis walker 16 Oct '17

16 Oct '17

Hi Tim Thanks for working through this in time for the RIPE Meeting. It may not be the last word on "abuse-c:" but it will please a lot of people. cheersdenisco-chair DB WG From: Tim Bruijnzeels via db-wg <db-wg(a)ripe.net> To: Database WG <db-wg(a)ripe.net> Sent: Monday, 16 October 2017, 16:21 Subject: Re: [db-wg] Whois release 1.90 in Release Candidate environment, production release planned for 16 October Dear Working Group, Whois release 1.90 has now been deployed to production. Kind regards Tim Bruijnzeels Assistant Manager Software Engineering and Senior Technical Officer RIPE NCC > On 27 Sep 2017, at 10:28, Tim Bruijnzeels via db-wg <db-wg(a)ripe.net> wrote: > > > From: Tim Bruijnzeels <tim(a)ripe.net> > Subject: Whois release 1.90 in Release Candidate environment, production release planned for 16 October > Date: 27 September 2017 at 10:26:44 GMT+2 > To: Database WG <db-wg(a)ripe.net> > > > Dear working group, > > RIPE Database Release 1.90 was deployed to the Release Candidate Environment, last week on 22 September 2017. If no issues are raised, we plan to deploy this version to production on Monday 16 October 2017 > > Release 1.90 introduces the following main features in support of NWI-7 (abuse-c implementation): > > = Allow adding an "abuse-c:" attribute to INET(6)NUM and AUT-NUM objects > = Disallow adding "abuse-c:" to object types other than ROLE, INET(6)NUM and AUT-NUM > > Release 1.90 contains a number of small improvements: > > = Make org-name validation case-sensitive (no longer consider case changes a no-op) > = Support to remove generated AUT-NUM "remarks:" regarding legacy status > > The complete list of other minor issues solved by this release can be found here: > https://github.com/RIPE-NCC/whois/blob/master/changes.txt > > Please let us know if you see any issues with this release in the RC environment. > > Kind regards > > Tim Bruijnzeels > > Assistant Manager Software Engineering and Senior Technical Officer > RIPE NCC > > >

1 0

Re: [db-wg] Whois release 1.90 in Release Candidate environment, production release planned for 16 October
by Tim Bruijnzeels 16 Oct '17

16 Oct '17

Dear Working Group, Whois release 1.90 has now been deployed to production. Kind regards Tim Bruijnzeels Assistant Manager Software Engineering and Senior Technical Officer RIPE NCC > On 27 Sep 2017, at 10:28, Tim Bruijnzeels via db-wg <db-wg(a)ripe.net> wrote: > > > From: Tim Bruijnzeels <tim(a)ripe.net> > Subject: Whois release 1.90 in Release Candidate environment, production release planned for 16 October > Date: 27 September 2017 at 10:26:44 GMT+2 > To: Database WG <db-wg(a)ripe.net> > > > Dear working group, > > RIPE Database Release 1.90 was deployed to the Release Candidate Environment, last week on 22 September 2017. If no issues are raised, we plan to deploy this version to production on Monday 16 October 2017 > > Release 1.90 introduces the following main features in support of NWI-7 (abuse-c implementation): > > = Allow adding an "abuse-c:" attribute to INET(6)NUM and AUT-NUM objects > = Disallow adding "abuse-c:" to object types other than ROLE, INET(6)NUM and AUT-NUM > > Release 1.90 contains a number of small improvements: > > = Make org-name validation case-sensitive (no longer consider case changes a no-op) > = Support to remove generated AUT-NUM "remarks:" regarding legacy status > > The complete list of other minor issues solved by this release can be found here: > https://github.com/RIPE-NCC/whois/blob/master/changes.txt > > Please let us know if you see any issues with this release in the RC environment. > > Kind regards > > Tim Bruijnzeels > > Assistant Manager Software Engineering and Senior Technical Officer > RIPE NCC > > >

1 0

Re: [db-wg] DB signatures
by Job Snijders 16 Oct '17

16 Oct '17

Thanks Tim!

1 0

Re: [db-wg] DB signatures
by Tim Bruijnzeels 16 Oct '17

16 Oct '17

Dear Aliaksei, working group, The split files, and all other content of the ftp site, are also available on https: https://ftp.ripe.net/ https://ftp.ripe.net/ripe/dbase/split/ They have been available here for quite a while but I realise that this was not widely announced, nor documented. I will make sure that documentation is updated. The files are generated using a snapshot of data at midnight CEST - but take over 2 hours to complete - because we have to filter out personal data. Because this is resource intense, and because there may be scripts out there running at various times in the day and expecting to retrieve the ‘midnight’ snapshot, I am not keen on increasing the frequency unless it’s clear that there is great demand for this. Dependent on your needs the NRTM service may also be a fit for you: https://www.ripe.net/manage-ips-and-asns/db/nrtm-mirroring Kind regards, Tim Bruijnzeels > On 16 Oct 2017, at 11:30, Horváth Ágoston János via db-wg <db-wg(a)ripe.net> wrote: > > > From: Horváth Ágoston János <horvath.agoston(a)gmail.com> > Subject: Re: [db-wg] DB signatures > Date: 15 October 2017 at 12:22:03 GMT+2 > To: Aliaksei Sheshka <sheshkaoss(a)gmail.com> > Cc: "db-wg(a)ripe.net >> Database WG" <db-wg(a)ripe.net> > > > The gzip format already contains checksum. > Signing is a different issue. But the first question one might ask is > why this data is still offered through FTP. Using https would also > make most of the signing requirements obsolete. > > On Sat, Oct 14, 2017 at 1:02 AM, Aliaksei Sheshka via db-wg > <db-wg(a)ripe.net> wrote: >> >> >> ---------- Forwarded message ---------- >> From: Aliaksei Sheshka <sheshkaoss(a)gmail.com> >> To: db-wg(a)ripe.net >> Cc: >> Bcc: >> Date: Fri, 13 Oct 2017 19:01:56 -0400 >> Subject: Re: [db-wg] DB signatures >> I assume time stamps are UTC, ftp shows 10/12/17, 10:12:00 PM, now it is Fri Oct 13 22:57:17 2017 UTC >> I would say 24h+ update for such data is too much. >> Also having signatures / checksums is a standard security measure for any downloads and are very easy to implement. >> >> >> On Fri, Oct 13, 2017 at 1:58 PM, denis walker <ripedenis(a)yahoo.co.uk> wrote: >>> >>> Hi Aliaksei >>> >>> The files are regenerated daily. There are some checks done on the files as part of the generation process, like zero size check or size difference more than some percentage from yesterday. Perhaps the RIPE NCC can comment on the possibility of signing or checksum files? >>> >>> cheers >>> denis >>> co-chair DB WG >>> >>> ________________________________ >>> From: Aliaksei Sheshka via db-wg <db-wg(a)ripe.net> >>> To: db-wg(a)ripe.net >>> Sent: Friday, 13 October 2017, 19:45 >>> Subject: [db-wg] DB signatures >>> >>> Hello! >>> >>> I would like to know if there is a plan to sign / checksum files located at >>> ftp://ftp.ripe.net/ripe/dbase/split/ ? >>> Currently there is no mechanism to know if files aren't tampered or corrupted. >>> >>> My second question is how often those files are updated? >>> >>> Thanks!

1 0

Re: [db-wg] DB signatures
by Horváth Ágoston János 15 Oct '17

15 Oct '17

The gzip format already contains checksum. Signing is a different issue. But the first question one might ask is why this data is still offered through FTP. Using https would also make most of the signing requirements obsolete. On Sat, Oct 14, 2017 at 1:02 AM, Aliaksei Sheshka via db-wg <db-wg(a)ripe.net> wrote: > > > ---------- Forwarded message ---------- > From: Aliaksei Sheshka <sheshkaoss(a)gmail.com> > To: db-wg(a)ripe.net > Cc: > Bcc: > Date: Fri, 13 Oct 2017 19:01:56 -0400 > Subject: Re: [db-wg] DB signatures > I assume time stamps are UTC, ftp shows 10/12/17, 10:12:00 PM, now it is Fri Oct 13 22:57:17 2017 UTC > I would say 24h+ update for such data is too much. > Also having signatures / checksums is a standard security measure for any downloads and are very easy to implement. > > > On Fri, Oct 13, 2017 at 1:58 PM, denis walker <ripedenis(a)yahoo.co.uk> wrote: >> >> Hi Aliaksei >> >> The files are regenerated daily. There are some checks done on the files as part of the generation process, like zero size check or size difference more than some percentage from yesterday. Perhaps the RIPE NCC can comment on the possibility of signing or checksum files? >> >> cheers >> denis >> co-chair DB WG >> >> ________________________________ >> From: Aliaksei Sheshka via db-wg <db-wg(a)ripe.net> >> To: db-wg(a)ripe.net >> Sent: Friday, 13 October 2017, 19:45 >> Subject: [db-wg] DB signatures >> >> Hello! >> >> I would like to know if there is a plan to sign / checksum files located at >> ftp://ftp.ripe.net/ripe/dbase/split/ ? >> Currently there is no mechanism to know if files aren't tampered or corrupted. >> >> My second question is how often those files are updated? >> >> Thanks! >> >> >> >> > >

1 0

violation of DB T&C by DB-WG co-chair, is it acceptable?
by Elvis Daniel Velea 14 Oct '17

14 Oct '17

Dear RIPE NCC, can you please present a report showing how many LIRs have reported RIPE DB T&C violations? How many were resolved and what was the outcome? - Specifically, how many times has the RIPE NCC taken any action other than a warning message. Dear DB-WG, should we accept that one of the chairs of this WG is purposely violating the T&Cs of the RIPE DB? Please see below one of the e-mails received from David, the RIPE DB-WG co-chair, by a RIPE NCC member named /<company>/. (I'd like to mention that /<company>/ has never had a business relationship with Larus Cloud Service Limited, has never subscribed to any mailing list and has never requested the message below - which I find to be spam as it was never solicited). regards, elvis From: Larus Team <vendors(a)laruscloudservice.net> Subject: Unused IPv4 space of /<company>/ Dear Colleagues, We are contacting you regarding potential unused IPv4 address currently registered to your organisation /<company>/. Organisations like yours have in the past received address IPv4 space, it sometimes remains unused after changes to networks. Based on the available information it appears that your organisation is currently holding IPv4 space that appears unused or underutilised. We would like to offer you the possibility to capitalise on these addresses, we can assist you in either finding organisation to permanently transfer (sell) towards, or assist you in finding and forging long term relationships with some of our clients by leasing the unused space to them, generating a long-term income. We are a company based in Hong Kong, our CEO Heng Lu, has over ten years’ experience in managing Internet resources across the globe. Our IP manager David Hilario previously worked for the RIPE NCC one of the five RIR and as such has an intricate knowledge of the policies in the RIR policies especially when it comes to transfers and leasing the address space. We have clients lined up waiting for permanent transfers or long-term lease, so we can fulfil any of your requirements. We offer clients with available IP space a 3 months exclusivity contract. based on your requirements, we will match our waiting list clients with your criteria so that your IP space can be capitalise as soon as possible at the best possible rate. Please note that if you are leasing out your address space, we will offer it on a minimum of yearly basis with advance payment from our clients. Please find attached to this email our NDA to be filled in from your side and returned to us before we can proceed any further in our cooperation in regard to these transfers or long-term lease. We can lease and sell IP space to and from ARIN (North America) APNIC (Asia Pacific) and RIPE NCC (Europe, Middle East and parts of Central Asia). Kind Regards, David Hilario IP Manager Larus Cloud Service Limited p: +852 29888918 m: +359 89 764 1784 f: +852 29888068 a: Flat B5, 11/F, TML Tower, No.3 Hoi Shing Road, Tsuen Wan, HKSAR w: laruscloudservice.net e: d.hilario(a)outsideheaven.com Larus Team www.laruscloudservice.net <http://sctrack.mail.laruscloudservice.net/track/click/eyJ1c2VyX2lkIjogNDE4M…>

4 3

Re: [db-wg] Foreign ROUTE objects in RIPE Database - final decision?
by Sascha Luck [ml] 14 Oct '17

14 Oct '17

On Wed, Oct 11, 2017 at 02:46:54PM +0100, Nick Hilliard via db-wg wrote: >Job Snijders wrote: >> I think this touches upon an incredibly important question: how do we >> distinguish between garbage and properly authenticated "route:" >> objects covering RIPE-managed space? > >and more to the point: are there good reasons and community support for >continuing not to distinguish between the two. Well, distinguishing in the irrdb is one thing, but how would you distinguish between them in RealLife(tm)? It's not like you can not route/accept a cross-RIR route: object (at least not without Breaking The Internet) Also, what would the distinguisher be for eg. a route: with prefix from RIPE and ASN from ARIN? RIPE-PARTIALLY-AUTHENTICATED? cheers, Sascha Luck

3 2

Re: Geoloc Object
by Erik Bais - A2B Internet 14 Oct '17

14 Oct '17

Hi Milad, If you can share the range (can be off-list if you prever) and the desired geo loc. I’ll be more than happy to assist. We fix these kind of things for customers a lot .. Regards, Erik Bais Verstuurd vanaf mijn iPad > Op 14 okt. 2017 om 11:02 heeft Milad Afshar <afshar.milad89(a)gmail.com> het volgende geschreven: > > Hi Folks, > I hope this email finds you well. > I have problem on some of my IP ranges location showing in RIPEstat,I would like to know that does the "geoloc" object in RIPE Database help the geolocation database providers(Maxmind and etc.) to find the correct location of IP Ranges? > Many thanks. > Milad Afshari >

1 0

Geoloc Object
by Milad Afshar 14 Oct '17

14 Oct '17

Hi Folks, I hope this email finds you well. I have problem on some of my IP ranges location showing in RIPEstat,I would like to know that does the "geoloc" object in RIPE Database help the geolocation database providers(Maxmind and etc.) to find the correct location of IP Ranges? Many thanks. Milad Afshari

1 0