April 2016 - ncc-announce - mailman.ripe.net

[training] RIPE NCC Training Courses April-June 2016
by Training Services 01 Jun '16

01 Jun '16

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Budapest, Tirana, Manchester, Lisbon, Bologna, Munich, Tallinn, Moscow, Vienna, Valletta, Reykjavik. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - Basic IPv6 Training Course - DNSSEC Training Course - 2 days Advanced IPv6 Training Course - 2 days BGP Operations and Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 1

[news] RIPE Policy Proposals - April Update
by Marco Schmidt 29 Apr '16

29 Apr '16

Dear colleagues, Here is our monthly overview of open policy proposals and their stage in the RIPE Policy Development Process (PDP). If you wish to join the discussion about a particular proposal, please do so on the relevant working group mailing list. Proposals Open for Discussion: 2015-05, "Revision of Last /8 Allocation Criteria" Proposals Awaiting Input: 2015-04, "RIPE Resource Transfer Policies" 2016-01, "Include Legacy Internet Resource Holders in the Abuse-c Policy" Proposal Overviews: PROPOSAL: 2015-05, "Revision of Last /8 Allocation Criteria" OVERVIEW: Aims to allow LIRs to request an additional /22 IPv4 allocation from the RIPE NCC every 18 months. The latest version of the proposal suggests several requirements, such as the LIR cannot hold more than a /20 IPv4, must document their IPv6 deployment and has not transferred any IPv4 address space before. STATUS: Discussion Phase WHERE TO COMMENT: Address Policy Working Group: address-policy-wg(a)ripe.net DEADLINE: 13 May 2016 FULL PROPOSAL: https://www.ripe.net/participate/policies/proposals/2015-05 ===== The following proposals are awaiting input before they can go any further in the PDP. PROPOSAL: 2015-04, "RIPE Resource Transfer Policies" OVERVIEW: Aims to create a single transfer policy with all relevant information on the transfer of Internet number resources, replacing text in several RIPE Policies. The proposal also introduces a 24-month holding period for IPv4 addresses and 16-bit ASNs after any change of holdership. RIPE NCC IMPACT ANALYSIS: Includes the point how the 24-month holding period for scarce resources will be applied. STATUS: Review Phase – Awaiting decision from working group chair FULL PROPOSAL: https://www.ripe.net/participate/policies/proposals/2015-04 PROPOSAL: 2016-01, "Include Legacy Internet Resource Holders in the Abuse-c Policy" OVERVIEW: Aims for a mandatory abuse contact for Legacy Internet Resource holders in the RIPE Database. STATUS: Discussion Phase – Awaiting decision from proposer FULL PROPOSAL: https://www.ripe.net/participate/policies/proposals/2016-01 The RIPE NCC provides an overview of current RIPE Policy Proposals on www.ripe.net: https://www.ripe.net/participate/policies/current-proposals/current-policy-… We look forward to your involvement in the PDP. Kind regards, Marco Schmidt RIPE Policy Development Officer RIPE NCC

1 0

[news] RIPE-NCC-RPSL-MNT removed from "mnt-by:" on objects
by Tim Bruijnzeels 28 Apr '16

28 Apr '16

Dear Colleagues, As you may know, the RIPE-NCC-RPSL-MNT is used to authorise the creation of out-of-region AUT-NUM and ROUTE(6) objects. This maintainer has a well-known password so that anyone can create such objects in the RIPE Database. For the time being this maintainer is still used to authorise the creation of out-of-region objects, but the community has recognised that this model should be improved, and discussion on this topic is on the agenda of the coming RIPE Meeting. However, the RIPE NCC was instructed by the RIPE Database Working Group to limit the use of this maintainer on "mnt-by:" as a first step of improvement. The RIPE Database documentation as well as the "descr:" of this maintainer have always instructed that this maintainer should not be used on "mnt-by:", because it leaves objects vulnerable to hijacking by any database user. Therefore, as part of release 1.86 of the RIPE Database that was deployed to production on 21 March 2016, the RIPE NCC introduced a business rule that prevents the use of this maintainer on "mnt-by:" of new objects. As agreed with the RIPE Database Working Group, the RIPE NCC also removed RIPE-NCC-RPSL-MNT from "mnt-by:" on 13,630 existing objects on 25 April 2016. Holders of these objects were sent individual emails about the pending removal of this maintainer on 12 April 2016, and notifications about the update were sent. Of the objects affected, 2,571 objects did not have any other maintainer, and as a result these objects are now locked. The legitimate holder of the resources of these objects can contact ripe-dbm(a)ripe.net in case the objects need to be unlocked. Now that these changes are complete, there are no remaining objects in the RIPE Database that are vulnerable to hijacking because of the use of this maintainer, and no new cases can be introduced. We did not send an earlier general warning about this change to ncc-announce because in our judgement this would have given too much exposure to how these objects could be hijacked by any user. Kind regards Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group

1 0

[GM] Reminder: Executive Board Nominations Deadline Approaching
by Axel Pawlik 20 Apr '16

20 Apr '16

Dear RIPE NCC member, This is a reminder that the RIPE NCC is calling for nominations to the RIPE NCC Executive Board. The deadline for submitting nominations is *4 May 2016*. The election will be for two vacant seats and will take place at the RIPE NCC General Meeting (GM) from 25-27 May 2016. The seats are for three-year terms and are to fill the places currently held by Remco van Mook and Nigel Titley, whose terms expire in May 2016. All information relating to the Executive Board nominations process is available in the original announcement at: https://www.ripe.net/participate/meetings/gm/meetings/may-2016/call-for-nom… The form for making nominations or supporting a candidate is available at: https://www.ripe.net/participate/meetings/gm/meetings/may-2016/agm-nominati… Currently, there are three confirmed candidates for the election: https://www.ripe.net/participate/meetings/gm/meetings/may-2016/confirmed-ca… GM Participation ---------------- To take part in the GM and cast your vote in the election and on the resolutions, you need to register via the LIR Portal: https://www.ripe.net/participate/meetings/gm/meetings/may-2016/registration The supporting documents for the GM are published at: https://www.ripe.net/participate/meetings/gm/meetings/may-2016/supporting-d… The draft agenda for the GM contains the items to be discussed and voted on at the meeting: https://www.ripe.net/participate/meetings/gm/meetings/may-2016/agenda The RIPE NCC and its Executive Board encourage all members to participate in the GM and to make their voice heard by voting in the election and on the resolutions. If you have any questions about the GM, please email us at <agm(a)ripe.net>. Best regards, Axel Pawlik Managing Director RIPE NCC Important Dates 23 March - Call for nominations to RIPE NCC Executive Board 30 March - Open registration for GM 30 March - Open voting registration 13 April - Publish all GM documents, including RIPE NCC Annual Report and Financial Report 2015 4 May - Close nominations for Executive Board elections 11 May - Deadline for proxy vote nominations 11 May - Deadline for members to propose resolutions 11 May - Deadline to publish final GM agenda 25 May - Close registration for electronic voting 25 May - GM begins with main meeting 27 May - GM closes with votes announcement

1 0

[news] RIPE Database: Cleaning-up Organisation Names in "descr:"
by Tim Bruijnzeels 19 Apr '16

19 Apr '16

Dear colleagues, We want to let you know about a clean-up that we have been planning with the RIPE Database Working Group (WG) and explain why this is being done. As this is currently being discussed on the WG mailing list, there is still time to comment if you wish. Background ---------------- For a long time, there has been a requirement that the first "descr:" attribute of resource objects that were allocated/assigned by the RIPE NCC must match the name of the organisation that holds the resource. However, these resource objects have also had a reference to the organisation object of the holder of these resources for quite some time, and the RIPE NCC ensures that this organisation object matches what we have in the RIPE Registry. This means that we have been using two parallel approaches to achieve the same goal. Since we began using organisation objects, requiring the organisation name in the “descr:” attribute has become redundant. It creates the potential for a mismatch between the name recorded here and the name on the actual organisation object. It also leads to confusion about where the correct name of the organisation can be found, along with a number of other issues. This has been discussed at length on the RIPE Database WG mailing list and during WG sessions at RIPE 70, 71 and 72. Consensus was reached that going forward: - Organisation names should no longer be enforced in "descr:" attributes - LIRs should be allowed to modify the "descr:” attribute[1] and will be responsible for maintaining this (it will not be verified by the RIPE NCC) - The RIPE NCC should clean up existing cases where the organisation name is enforced - "descr:” should become an *optional* attribute Last Week’s Reverted Clean-up ------------------------------------------ The WG decided that a clean-up was needed to remove any confusion about where the organisation name should be found. Because there are 93,105 objects that need to be updated, it is not practical to send notifications to all of these resource holders individually. As this change was expected to have little operational impact, it was decided that this should be done as a silent update. However, while the WG was informed of our intention to run the clean-up, it was an oversight on our part not to send a notification to the wider RIPE community. We proceeded with our implementation of these changes in the RIPE Database and deployed release 1.86 to production on 21 March. We then communicated our intent to run the clean-up on 11 April to the Database WG[2]. When we ran the update last week, a community member alerted us to a problem and the clean-up was reverted the following day after it was completed[3]. There is now a discussion about how or whether to continue with this clean-up on the RIPE Database WG mailing list[4]. If the WG determines that we should proceed with this, we have a tentative date set for 9 May 2016. We invite you to discuss this further on the mailing list at <db-wg(a)ripe.net> if you have any opinions or concerns that you would like to share. We will also be reviewing our processes to ensure we give adequate notification for such changes in the future. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group [1] "descr:" is currently not editable in the Allocation Object Editor, but will become editable by LIRs in the near future. [2] https://www.ripe.net/ripe/mail/archives/db-wg/2016-March/005136.html [3] https://www.ripe.net/ripe/mail/archives/db-wg/2016-April/005172.html [4] https://www.ripe.net/ripe/mail/archives/db-wg/2016-April/005173.html

1 0

[news] 105th RIPE NCC Executive Board Meeting Summary
by Axel Pawlik 14 Apr '16

14 Apr '16

Dear colleagues, The RIPE NCC Executive Board held its 105th meeting on 31 March 2016. A summary of the meeting minutes is now available: https://www.ripe.net/publications/news/announcements/105th-ripe-ncc-executi… You can give feedback on the minutes by emailing the Executive Board directly at: <exec-board at ripe.net> RIPE NCC members can also discuss matters among the entire membership by emailing: <members-discuss at ripe.net> Kind regards, Axel Pawlik Managing Director RIPE NCC

1 0

[news] RIPE NCC Members and Multiple LIR Accounts - Decisions and Next Steps
by Nigel Titley 14 Apr '16

14 Apr '16

Dear members, The RIPE NCC Executive Board would like to thank the members for their contributions to the discussion on the ability of RIPE NCC members to open additional LIR accounts. The Board initiated this discussion because it was concerned that, contrary to the spirit of the last /8 policy, there was the possibility of people acquiring IPv4 address space by opening multiple LIR accounts with the aim of transferring that address space to another entity. There were many considered and well-thought-out suggestions that represented a diverse range of opinions. Many of the suggestions put forward that could have a positive effect were matters for the Policy Development Process (PDP) to consider rather than the RIPE NCC membership. The Board believes that the matter should be taken up again at the next RIPE NCC General Meeting (GM) to be held on 25 May 2016. At the meeting, the members will be given the opportunity to hear from the Board, have a further discussion and vote on the matter. Until then, the Board resolution to temporarily suspend the ability to create additional LIRs will remain in place. The Board has decided on a measure to be taken immediately to deter the acquiring of /22s of address space with the sole purpose of transferring it to another legal entity. The RIPE NCC will therefore broaden the definition of policy transfers by including network acquisitions in the scope of the transfer policy. Therefore, all network acquisitions will fall under the RIPE transfer policy unless they are part of an organisation merger, organisation acquisition, bankruptcy or liquidation. Resources received following a policy transfer may not be transferred again to another organisation within 24 months, a limitation imposed by the RIPE community policy. This limitation does not apply to resources received through an organisation merger, acquisition, bankruptcy or liquidation. Mergers, acquisitions, bankruptcies and liquidations must be supported by official documentation issued by national authorities (e.g. Chamber of Commerce) whereas policy transfers are based on the RIPE community policies and supported by the transfer agreement signed by both parties. The RIPE NCC will update the "Transfer of Internet Number Resources and Change of a Member’s Official Legal Name" procedure and other relevant procedural documents. We will handle ongoing network acquisition requests using our current procedures for a 28-day period starting from today. All those who have requested a network acquisition will be contacted to make them aware of the situation. The Board has instructed the RIPE NCC to strengthen its due diligence procedures to clarify that transfer agreements are signed by a party that is officially authorised to do so according to national authority registration. We look forward to further discussion of the multiple LIR issue at the upcoming GM. The Board of course encourages you to continue the discussion on the members-discuss mailing list if you so wish. Registration for the upcoming GM is open and we urge all members to register so they can take part in the discussions and exercise their right to vote on this important matter. https://www.ripe.net/participate/meetings/gm/meetings/may-2016 Best regards, Nigel Titley RIPE NCC Executive Board Chairman

1 0

[GM] RIPE NCC Annual Report 2015 and Proposed Charging Scheme 2017
by Serge Radovcic 13 Apr '16

13 Apr '16

Dear members, The RIPE NCC Annual Report 2015, including the Financial Report 2015, is now available online. The Annual Report is a supporting document for the RIPE NCC General Meeting (GM), which takes place from 25-27 May 2016. The supporting documents also include the proposed Charging Scheme 2017 that members will vote on at the upcoming GM. All the documentation, including the Annual Report, is available at: https://www.ripe.net/participate/meetings/gm/meetings/may-2016/supporting-d… You can find out about the GM and the elections, including how to register for voting, at: https://www.ripe.net/participate/meetings/gm/meetings/may-2016 Annual Report Highlights ---------------------------------- The Annual Report documents the activities of the RIPE NCC in 2015 and contains the Financial Report 2015. Some other highlights in the Annual Report include: - Detailed statistics on the RIPE NCC’s allocation and assignment of Internet number resources - Statistics on IPv4, IPv6 and ASN transfers - Maps and statistics showing the various meetings and training courses held across our service region - Address hijacking in 2015 - Updates from the Chairman of the RIPE NCC Executive Board, the Managing Director of the RIPE NCC, the Executive Board Treasurer, and the RIPE NCC Senior Management Team - Much, much more… The Annual Report is only available online. It can be downloaded for those who wish to print it. We hope you take the time to read the report. If you have any feedback on it, please email <agm(a)ripe.net>. Best regards Serge Radovcic Chief Communications Officer RIPE NCC

1 0

[news] Locking unmaintained PERSON and ROLE objects in the RIPE Database
by Trudy Prins 07 Apr '16

07 Apr '16

Dear colleagues, The RIPE NCC Executive Board (EB) endorsed a proposal on how to deal with a vulnerability for RIPE Database users. Following their advice, the RIPE NCC proactively locked 848,986 unmaintained PERSON objects and 1,206 unmaintained ROLE objects on 6 April 2016. Since reaching the last /8, IPv4 address space has become more susceptible to hijacking. Unmaintained PERSON and ROLE objects are highly at risk of being found and hijacked. In addition, unmaintained PERSON and ROLE objects are an issue with regards to data protection obligations. The potential impact of abuse led us to consult with the EB on this intermediary solution before engaging with the community on the next steps. Exposing this issue without taking adequate measures would have left the RIPE NCC liable to third party damages. The proposed solution we outline below is a starting point, to be discussed by the community. Background: =========== Since 2010 it has been mandatory to protect PERSON and ROLE objects in the RIPE Database using a maintainer on "mnt-by:". A large number of PERSON and ROLE objects dating from before 2010 are still not protected in this way. Objects can be created that reference these unmaintained objects, but doing so will generate a warning. In recent years, given the scarcity of IPv4 address space, there is a higher risk of people searching for unmaintained PERSON or ROLE objects in order to pose as a resource holder to sell IPv4 space. In the case of legacy space, this could take place outside the view of the RIPE NCC if the address space is not registered with the RIPE NCC. Proposal: ========= 1) All unmaintained ROLE and PERSON objects are now locked. As the RIPE NCC will not be able to correctly check all claims on unmaintained database objects, unlocking is not available. Offering to unlock these objects could leave the RIPE NCC liable to third party damages if due diligence is not followed. 2) Furthermore, the RIPE NCC modifies the existing warning about referencing unmaintained persons/roles to a similar warning about referencing locked persons/roles. 3a) The locked objects can remain as they are. In time, all locked PERSON or ROLE objects no longer referenced by other objects could be automatically deleted: the current thinking is a 180-day deletion timeout for these locked, unreferenced objects. 3b) If there is an operational need, new PERSON or ROLE objects should be created by the object owners. This solution puts control back into the hands of the object owners. The user can follow the existing process for creating and referencing new objects. If there is a use case for supporting bulk migrations where a reference to a locked PERSON or ROLE object should be replaced, the RIPE NCC can create a wizard in the RIPE Database webupdates section of www.ripe.net <http://www.ripe.net/>. We look forward to your feedback. Kind regards, Trudy Prins Manager Software Engineering RIPE NCC

1 0