- ncc-services-wg - mailman.ripe.net

RIPE Database Proxy Service Issues
by Axel Pawlik 04 Jan '13

04 Jan '13

[Apologies for duplicate emails] Dear colleagues, There has been discussion on various mailing lists regarding the status of the RIPE Database Proxy Service. Before I address the issues that arose, I'd like to give you some background information on the service itself that may help with the discussions. Technical Background -------------------- To prevent the automatic harvesting of personal information (real names, email addresses, phone numbers) from the RIPE Database, there are PERSON and ROLE object query limits defined in the RIPE Database Acceptable Use Policy. This is set at 1,000 PERSON or ROLE objects per IP address per day. Queries that result in more than 1,000 objects with personal data being returned result in that IP address being blocked from carrying out queries for that day. Users of the RIPE Database have unlimited access to Network Information Centre (NIC)-related objects. They can use the -r flag in order to filter out personal objects and query NIC objects without any limitations. The RIPE Database Proxy Service allows websites to provide a third party interface to the RIPE Database. Without the proxy service, the third parties would quickly run into the limits set on RIPE Database queries. With the proxy service, we whitelist the third party IP address and ask them to pass their user's IP address to us, so limits are only set on the user's IP address, not the third party's. There is no technical way to ensure that the user IP addresses passed to us by the third party are valid. Potentially, third party users of the proxy service could harvest all personal data in the RIPE Database (approximately 2 million objects) in a matter of hours. To ensure that the RIPE NCC's Terms and Conditions are followed, we require a contract between the third party and the RIPE NCC. Users of the Proxy Service -------------------------- In the past ten years, the RIPE NCC has had 31 requests for the proxy service and over the past year, there have been only four active users of the service. Of these four, one is already a RIPE NCC member. NIC Information --------------- All NIC information is still available without access to the proxy service. In the normal presentation of whois data, there is a redirect system that allows users with a normal whois client to deal directly with the RIPE Database whois service. There is no need for a proxy service in this scenario. The proxy service is only necessary if the data needs to be presented in alternative forms, such as on a third party's website. The limits imposed on RIPE Database queries only apply to personal data. Users can always access NIC data in any form they like if they are happy not to receive personal data. On 6 March 2012, the RIPE NCC proposed to change the default behaviour of the query system to instead return only "ALLOWED" results if a user had reached their daily personal data query limit, but there was disagreement over this on the mailing list so the change was not implemented. The proposal is available at: http://www.ripe.net/ripe/mail/archives/db-wg/2012-March/003885.html Legal Considerations -------------------- The RIPE NCC operates under European Data Protection laws, so to avoid risk in this area we insist on having a contract with third parties who wish to use the proxy service. The RIPE NCC and its Executive Board believes that the proxy service should become a member service because it tightens the contractual relationship between the RIPE NCC and third parties. Currently, no such agreement that meets the EU Data Protection legislation is in place between the RIPE NCC and the proxy service users. In order to tighten the contractual relationship between the RIPE NCC and the Proxy service users, taking into account the recent approval of the Charging Scheme 2013 that caused a simplification of the contractual agreements between the RIPE NCC and its service users, the RIPE NCC offered to conclude the membership agreement for continuation of the service. Next Steps? ------------ The Executive Board approved changes to the draft version of the Activity Plan and Budget 2013, and the RIPE NCC published the final version on 13 December 2012: http://www.ripe.net/internet-coordination/news/announcements/ripe-ncc-activ… We do apologise, however, that the changes regarding the proxy service were not more explicitly communicated to the members and the RIPE community in advance of the final publication of the Activity Plan. The RIPE NCC asks that non-RIPE NCC member proxy service users become members but we propose to waive their membership fee until the discussion of the RIPE NCC Charging Scheme 2014 takes place. This will give the membership and community the opportunity to discuss the best way forward for the proxy service in the coming months while ensuring a strong contractual bond between the RIPE NCC and users of this service. In the meantime, there will be no changes to the proxy service and no loss of functionality for the community. The RIPE NCC and its Executive Board will return to its members with proposals for ways to ensure that their wishes are met with regard to service developments while allowing the RIPE NCC to be operate efficiently and responsively. If you have any comments on this issue, please direct them to this mailing list. Best regards, Axel Pawlik Managing Director RIPE NCC

14 29

Fwd: GeekTools Whois Proxy and RIPE/RIPE-NCC
by Nick Hilliard 02 Jan '13

02 Jan '13

This seems odd. I can't seem to find any mention of charging for bulk whois access in the RIPE NCC AGM or the PDP. Am I missing something here? Nick -------- Original Message -------- Subject: GeekTools Whois Proxy and RIPE/RIPE-NCC Date: Mon, 31 Dec 2012 10:41:54 -0500 From: Rodney Joffe <rjoffe(a)centergate.com> To: nanog(a)nanog.org NANOG and ARIN Friends, 14 Years ago, at the suggestion of Jon Postel and some of the early participants in NANOG, we developed the GeekTools Whois proxy to make it easier for *us* - network security and abuse techs - to deal with the expanding number of gtlds and registrars and the varied whois servers that were appearing. The service had both a CLI and web interface. The service also led directly to the creation of whois-servers.net, which now seems to be part of a number of *nix distributions. The service has been up for 14 years, and over that time we have fulfilled the requirements of all of the whois server operators in regards to minimizing and stopping abuse of the GT whois proxy by domain scrapers, spammers, etc, while enabling the security folks to do their jobs. In some cases we have even written code to pass the ip address of the requestor to the whois server registry operator when they wanted to manage quota's directly. We think we have a really good relationship with all of the whois server operators, and I think we provide a useful service to the community, and is widely used. And in 14 years we have never been tarred as an enabler of abuse of "the whois" system. There has obviously never been any kind of charge or fee for using the proxy, or any of the other tools on GeekTools. In about 2002 we started placing a banner ad on the web interface page to offset some of the costs for the bandwidth that the proxy consumes. An average of about $70 a month for over the last 10 years. Actual bandwidth costs are higher than that of course, but it was a thought in 2002 that we had frankly forgotten about until recently. Two weeks ago RIPE-NCC, who provide the whois data for IP addresses in the RIPE region, informed us that based on decisions by their members, as of January 1st 2013, tomorrow, they would no longer provide whois proxy query response services to GeekTools unless we ponied up $1,800 a year for RIPE membership. I don't work very well above layer 7. It is what it is. So I wanted to let you know that as of midnight tonight, apparently, you won't be able to use GeekTools for RIPE related queries. If you have automated scripts, and you are one of the users who has expanded access to GeekTools, you'll need to find an alternative for RIPE queries *today*. My guess is that you will be able to query RIPE directly, once you have worked out that the address space is within RIPE's assignments. I think its wrong to have to pay for whois data that is part of a community resource . So I won't do it.

7 11

RIPE NCC Webinars - new dates
by Training Mailbox 21 Dec '12

21 Dec '12

[Apologies for duplicate e-mails] Dear colleagues, We are pleased to announce the launch of new dates for our Webinars for LIRs. The RIPE NCC Webinars are live, one hour online training courses that allow participants to interact with our trainers without leaving their desks. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/lir-services/training/e-learning/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <e-learning(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 1

New on RIPE Labs: Conclusions Drawn from Reverse DNS Event
by Mirjam Kuehne 21 Dec '12

21 Dec '12

[apologies for duplicates] Dear colleagues, On Wednesday 13 June 2012, an unknown error caused the removal of several zone files from the configuration of our reverse DNS provisioning system. Following up from the initial report published on RIPE Labs, we further analysed what caused the incident and implemented a number of procedures to decrease the likelihood of this happening in the future. Please see the report on RIPE Labs: https://labs.ripe.net/Members/dfk/conclusions-drawn-from-reverse-dns-event Kind regards, Mirjam Kuehne RIPE NCC

1 0

New RIPE NCC PGP Key
by Andrea Cima 21 Dec '12

21 Dec '12

[Apologies for duplicate e-mails] Dear Colleagues, On Monday, 7 January 2013 we will start using our 2013 key to sign e-mails from our ticketing system. The new key has been signed by the old key as described in the key-management policy on our web site: https://www.ripe.net/lir-services/resource-management/contact/pgp-authentic… The old key remains valid until Thursday, 31 January 2013. If you have any questions about this, please contact <ops(a)ripe.net>. Kind Regards, Andrea Cima RIPE NCC

1 0

Problem in payment of invoices
by Shahin Gharghi 10 Dec '12

10 Dec '12

Dear madam/sir We are a LIR in Iran. So we have to pay our invoices frequently. But the problem is we are banned from SWIFT and every money transfer company or bank. So there is no legal way to pay our invoices. Even we don't have any credit card or Paypal too. We must resort to third parties to make payments. This does not work well. Why is the Paypal system blocked for us? This is not fair. Is there any way for us? Thank you. -- Best Regards Reza Madadi

4 3

New Statistics Dashboard on RIPE Labs
by Mirjam Kuehne 26 Nov '12

26 Nov '12

[apologies for duplicates] Dear colleagues, Following up from the list of statistics we published on RIPE Labs recently, we created a statistics dashboard that shows many automatically updated graphs and allows you to search for certain topics by tags: https://labs.ripe.net/statistics/ If you have any comments or suggestions, please do not hesitate to let me know. Kind regards, Mirjam Kuehne RIPE NCC

1 0

RIPE NCC Training Courses January-March 2013 - BG, DE, UK, PT, NL, SA, DK, UA, LV, KG
by Training Mailbox 26 Nov '12

26 Nov '12

Dear Colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Sofia, Düsseldorf, London, Lisbon, Milan, Amsterdam, Riyadh, Copenhagen, Kiev, Riga, Bishkek. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - IPv6 for LIRs Training Course - Routing Registry and Resource Certification Training Course For more information visit: http://www.ripe.net/lir-services/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

New on RIPE Labs: LIR and IPv6 Statistics
by Mirjam Kuehne 13 Nov '12

13 Nov '12

Dear colleagues, Please find a new article on RIPE Labs: https://labs.ripe.net/Members/wilhelm/ripe-ncc-membership-statistics-novemb… At the end of Q3 2012, we looked at the number of new LIRs and the resources allocated over the last few months. We were particularly interested to see if there are any significant changes since the RIPE NCC started allocating from the last /8. Kind regards, Mirjam Kuehne RIPE NCC

1 0

RIPE NCC Listing Service: Streamlining Resource Transfers
by Andrew de la Haye 07 Nov '12

07 Nov '12

Dear colleagues, A year ago the RIPE NCC introduced the Listing Service, aimed at streamlining the resource transfer process: https://www.ripe.net/lir-services/resource-management/listing At this time, it only enables RIPE NCC members to list the IPv4 address space they hold and no longer need. Since the depletion of the available IPv4 address pool, there has been an increasing demand from the membership for a service that allows LIRs to request IPv4 address space for transfer. To fulfil this demand, we are currently building an addition to the Listing Service to provide this functionality. RIPE NCC Members will be able to post a request on the Listing Service indicating a prefix size, whether a permanent or temporary transfer is desired, and any other details they wish to disclose. Only RIPE NCC members will be able to view the details in the LIR Portal. On the public website, we will display the total size of all address space that is being requested, without disclosing the identity or other details of the requesters. If you have any questions, please do not hesitate to contact us. Kind regards, Andrew de la Haye COO RIPE NCC

1 0