- ripe-list - mailman.ripe.net

RIPE support for CVE foundation
by Michael Richardson 23 Apr '25

23 Apr '25

from a private thread: }The CVE Foundation has been formed to fund the CVE effort, due to }"longstanding concerns among members of the CVE Board about the }sustainability and neutrality of a globally relied-upon resource being tied }to a single government sponsor.": } } https://www.thecvefoundation.org/ I had previous opioned that it was time for EC/EU (maybe NATO) to take on funding this, and to move/replicate the effort outside of MITRE. That was before I knew of the foundation. I think that MITRE has done the best job possible ... for a beltway entity... but that it hasn't been very helpful. 3h webinar required to learn what a CVE is before you can get allocations. yes, useful to the unwashed C* masses... I'm of the opinion that RIPE can and ought to take on a role here as representatives of the ISP operator community. Both in a leadership role and as a source of funding. The FAQ says to contact info(a)thecvefoundation.org, and this email is BCC'ed to them. (Many open source projects get dozens to hundreds of "potential" CVEs from fuzzers who need a CVE number assigned in order to claim a bounty. There is now a cottage industry of fuzzers. It's a perverse result of the bounty programs... creating a huge amount of work to review potential issues, which often are impossible to actually exploit... and never come with fixes) -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

5 5

Publication of the RIPE Chair/Vice-chair nominees
by RIPE NomCom Chair 16 Apr '25

16 Apr '25

Dear RIPE community, The RIPE 2025 NomCom will select two persons for the roles of RIPE Chair and RIPE Vice Chair. We have five nominees who are well known to the community. They are, in the order of their nomination: Ferghas McKay, Mirjam Kühne, Olena Kushnir, Anna Wilson and Rob Evans. https://ripenomcom.org/ripe-chair-vice-chair-nominees/ Note that some of them have been nominated for Chair or Vice Chair specifically. We have set out the plans for collecting input from the community. Here is a quick outlook about what the NomCom will do between now and the RIPE meeting, during the meeting and after: Before RIPE 90 During the coming two weeks the NomCom will send some questions to the nominees and prepare for the RIPE meeting. We want to hear input from the community at between now and the end of the RIPE meeting. This is your chance to influence our selection. The best way to reach the whole committee is by e-mail via nomcom at ripenomcom.org. If you prefer you can also contact individual members of the NomCom; you can find them and their mail addresses here. Of course we will treat all input confidentially. To that end we have even set up a dedicated server, so that we can erase the electronic traces of our work as well as possible once we are done. We will also give the nominees the opportunity to publish posts on the NomCom blog. During RIPE 90 We will have an office and hold office hours during all lunch breaks. This is your opportunity to speak in person to the committee or arrange for separate meetings with committee members. We will also roam the hallways and be on hand during the community plenary session. Individual meeting slots will be allocated first-come first served. Mail contact at ripenomcom.org for an appointment. After RIPE 90 We will schedule interviews with the nominees and then make our selection during the following weeks. We will regularly report on our progress on this mailing list and the NomCom blog. After we have made our selection and the Executive Board of the RIPE NCC has confirmed that we properly followed the process set by the community, we will announce the new RIPE Chair and Vice Chair. Then our work will be done. During RIPE91 The new chairs will take over during RIPE91. Jan Žorž Chair RIPE 2025 NomCom

1 0

Feedback on Draft “RIR Governance Document” (ICP-2 Review)
by herve.clement＠orange.com 14 Apr '25

14 Apr '25

Dear colleagues, I am happy to share that the Number Resource Organization Number Council (NRO NC) has published the draft "Governance Document for the Recognition, Maintenance, and Derecognition of Regional Internet Registries" to update ICP-2: https://www.nro.net/policy/internet-coordination-policy-2/rir-governance-do… As a part of the Regional Internet Registry (RIR) system, the RIPE community has been called to contribute to the ongoing global multistakeholder discussion on the revision of ICP-2. We invite you to share your feedback on this document via the RIPE Discussion list until Tuesday, 27 May 2025. The feedback received from the RIPE community during this period will be provided to the NRO NC for their consideration during the revision process of the draft RIR Governance Document. We would like to clarify that the updated criteria will continue to reflect the fundamental principles required for recognizing and evaluating new RIRs in keeping with the Internet landscape of today. There is no intention to fundamentally change or redesign the existing RIR system. We ask you to please keep the following in mind while preparing your comments: - Please share feedback that is specific to this draft - We are particularly interested in hearing your views on the new requirements in the draft - Whether the draft provides sufficient clarity regarding the ongoing obligations of an RIR and the remediation steps if the obligations are not met - This document does not address the implementation of the RIR criteria; comments on implementation will be considered out of scope - Constructive comments are highly appreciated ----------------------- Join a Session ----------------------- We invite the RIPE community to join us for the following sessions: - RIPE NCC Open House: Updating ICP-2 Tuesday, 29 April at 11:00 CEST (09:00 UTC) This session will take place online and the RIPE community representatives of the NRO NC will share information on the work done so far and introduce the draft RIR Governance Document. https://www.ripe.net/meetings/open-house/updating-icp-2/ - BoF at RIPE 90 We will hold a BoF at RIPE 90 to hear the community's input on the draft RIR Governance Document. You can register and participate online for free, if you are not attending RIPE 90 in person: https://ripe90.ripe.net/ We, the RIPE NRO NC representatives, Constanze Bürger, Andrei Robachevsky and myself, Hervé Clément, will be available to answer your questions at the online session and at RIPE 90. All the planned sessions during which the NRO NC will share information on the draft “RIR Governance Document” and the process to update ICP-2 will be listed on the NRO website. The sessions will also be recorded and archived, links to the recordings will also be listed on the same webpage. You can follow the community engagements across all regions via the Community Engagements web page: https://www.nro.net/policy/internet-coordination-policy-2/community-engagem… For more information about ICP-2, please visit: https://www.nro.net/policy/internet-coordination-policy-2/ Thank you for your participation in this important global Internet discussion and we look forward to hearing your input. Regards, Hervé Clément ASO AC Chair Sent on behalf of the NRO NC ----------------------- Important Dates ----------------------- 14 April: Draft “RIR Governance Document” published 14 April: Consultation on draft document opens 29 April: RIPE NCC Open House: Updating ICP-2 12-16 May: BoF on ICP-2 review during RIPE 90 27 May: Consultation closes 9-12 June: NRO NC reviews input during ICANN 83 ____________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

RIPE NCC Community Projects Fund Discontinued
by Hisham Ibrahim 09 Apr '25

09 Apr '25

Dear colleagues, We have decided to discontinue the RIPE NCC Community Projects Fund (CPF). I would like to briefly explain our thinking here. In 2024 we paused the CPF’s funding cycle so we could review our project management processes and the CPF’s overall effectiveness [1]. Our initial plan, explained in a RIPE Labs article last year, was to hold further discussions with the community on possible future formats for the CPF [2]. However, our review found that to continue delivering the CPF in a meaningful way would require more resources while the direct benefit to members was unclear. We shared these considerations with the RIPE NCC Executive Board at its recent meeting in March and provided a few options with their associated costs. This included the option of restructuring the Community Projects Fund at a smaller scale. Given that challenges would still remain in this approach, the Executive Board agreed with our proposal to discontinue the Fund entirely and approved a corresponding resolution which is available in the recently published Board meeting minutes: https://www.ripe.net/about-us/executive-board/minutes/2025/183rd-executive-… The Community Projects Fund was launched in 2016 to support projects that work for ‘the Good of the Internet’ by enhancing the operations, resilience and sustainability of the Internet. Nearly 50 projects received funding over nine years, with a total of EUR 1.6 million euros distributed. We are proud of the work that the fund has enabled, and we thank everyone who has supported these efforts. It is also important to note that the people who received grants in 2024 and are delivering on their work will not be affected by this. We would also like to thank everyone who has worked with us on the RIPE NCC Community Projects Fund, particularly volunteers from the RIPE community who have worked with us on the Selection Committee and our funding recipients for their efforts to make the Internet better for all. Kind regards, Hisham Ibrahim Chief Community Officer RIPE NCC [1] https://www.ripe.net/about-us/news/ripe-ncc-community-projects-fund-paused-… [2] https://labs.ripe.net/author/alastair_strachan/ripe-ncc-community-projects-…

1 0

Reminder: Register for RIPE 90!
by Meeting Mailbox 02 Apr '25

02 Apr '25

Dear colleagues, RIPE 90 is quickly approaching, and we’re excited to share some important details to help you with your participation. The meeting will take place online and in person at the EPIC SANA Lisboa Hotel, Lisbon, Portugal, from 12 - 16 May 2025. You can register for the meeting at: https://ripe90.ripe.net/attend/register/ ------------------- Ticket Options ------------------- Week ticket: EUR 400 Day ticket: EUR 130 Student (week) ticket: EUR 50 You can find more information about ticket options at: https://ripe90.ripe.net/attend/register/ --------------------- Accommodation --------------------- EPIC SANA Lisboa Hotel Av. Eng. Duarte Pacheco 15, 1070-100 Lisbon, Portugal There is a negotiated rate available for RIPE Meeting attendees, subject to limited availability. To secure your reservation and avoid disappointment, please follow the instructions provided on the official meeting venue website: https://ripe90.ripe.net/attend/meeting-venue/ ---------------------------------------- Call for Presentations and WG Topics ---------------------------------------- The Call for Presentations (CfP) deadline has been extended to 8 April 2025. Lightning talk proposals can be submitted until 2 May 2025. Working groups are also seeking content proposals. Please contact the relevant WG chairs if there is a topic you would like to discuss. More information at: https://ripe90.ripe.net/submit-topic/cfp/ ----------------------- Call for Sponsors ----------------------- If you're interested in sponsoring RIPE 90 and getting your logo onto our digital materials, get in touch. Supporting a RIPE Meeting through sponsorship gives your organisation great exposure in the global Internet community. The sponsorship deadline is on 21 April 2025 if you would like your organization to be featured on our printed material. More information: https://ripe90.ripe.net/about/sponsors/become-a-sponsor/ ------------------ Social Events ------------------ More information about the social events can be found here: https://ripe90.ripe.net/programme/social-events/ -------------------------------- Safety and Accessibility -------------------------------- We want all our attendees to enjoy a safe RIPE Meeting. Please familiarise yourselves with information on health, safety and security: https://ripe90.ripe.net/attend/health-safety-and-security/ If you have any accessibility requirements, please email <meeting(a)ripe.net>. ----------------------------------------- Important Dates and Deadlines ----------------------------------------- 08 Apr: Deadline to submit a talk 09 Apr: Childcare application deadline 15 Apr: Final programme published 21 Apr: Sponsorship deadline 28 Apr: Mentoring application deadline 02 May: Lightning Talk submission deadlined 05 May: Deadline to send recorded presentations to be published on the website 12 – 16 May 2025: RIPE 90 takes place in Lisbon More information on RIPE 90 can be found at: https://ripe90.ripe.net/ We want to ensure a safe and welcoming meeting. The RIPE Code of Conduct applies to all RIPE Meeting attendees, and can be found at: https://ripe90.ripe.net/attend/code-of-conduct/ For the latest meeting updates, follow the #RIPE90 hashtag on social media. Kind regards, RIPE Meetings Organisation Team

1 0

Call for Topics for RIPE 90 Community Plenary
by Mirjam Kuehne 31 Mar '25

31 Mar '25

Dear colleagues, The RIPE 90 Community Plenary will take place on Thursday, 15 May 2025 at 16:00 local Lisbon time. If there are any specific topics you would like to discuss during this session, please let me know. You can find more about the purpose of the RIPE Community Plenary and minutes of previous sessions here: https://www.ripe.net/participate/ripe/ripe-community-plenary Kind regards, Mirjam Kühne RIPE Chair

1 0

New on RIPE Labs: "Unlocking UX: A User-Centred Journey for RIPEstat"
by Antonella De Bellis 27 Mar '25

27 Mar '25

Dear colleagues, As many of you know, we recently launched a new version of the RIPEstat UI. In this article on RIPE Labs, we delve into more detail on how we reconciled user feedback with user behaviour to get a better understanding of how best to improve RIPEstat: https://labs.ripe.net/author/antonella-de-bellis/unlocking-ux-a-user-centre… Kind regards, Antonella De Bellis Senior UX Designer

1 0

DNSSEC Root Key Signing Key (KSK) for the Domain Name System
by Christopher Hawker 27 Mar '25

27 Mar '25

Hello Everyone, As many of you may know, one of the functions of the Internet Assigned Numbers Authority (IANA) is the global coordination of the DNS Root Zone. One of the core components to DNS is DNSSEC. The Root Key Signing Key (KSK) acts as the trust anchor for DNSSEC for the Domain Name System, and this trust anchor is configured in DNSSEC-aware resolvers to facilitate validation of DNS data. This is how your DNS servers are able to cryptographically validate the authenticity of DNS records they receive and serve. For more information pertaining to DNSSEC, how it operates, the KSK and the relevant policies and procedures, I recommend visiting https://www.iana.org/dnssec for more info. In order to ensure the security of the KSK, IANA utilises Hardware Security Modules (HSM) to generate the KSK pair of public and private keys, which in turn are used to sign the Zone Signing Key (ZSK), that itself is used to sign DNS records (RRsets) within a DNS zone. As it currently stands, both of these HSMs currently reside in high-security Key Management Facilities (KMFs) in the USA, with one facility located in Culpeper VA, and the other in El Segundo CA. Now, while the locations of these HSMs are highly secure, both of them are located on US soil. As most people who are familiar with redundancy, this is not a good idea for a number of reasons (which I won't go into detail here as it's outside the scope of this email). What we as a community MUST DO, is look at the relocation of one of these HSMs to an alternate country such as Singapore or Switzerland (regarded as two safe countries) to ensure the continued integrity of the Root KSK. Unfortunately, section 4.2(b) of the IANA Naming Function Contract (https://pti.cdn.icann.org/resources/151/IANA_Naming_Function_Contract.pdf) between the Internet Corporation for Assigned Names and Numbers (ICANN) and Public Technical Identifiers (PTI) that govern how IANA performs its functions prohibits the operation of functions outside of the US. Given that the Internet is one of the most critical pieces of global (and not just US-based) infrastructure, I feel that this section of the contract must be reviewed (and deleted or modified to allow for PTI to perform the functions from Singapore, Switzerland or another safe jurisdiction) to maintain the integrity of the Domain Name System. The Second IANA Naming Function Review Team (IFRT2) have released an initial draft report of its analysis, issues and recommendations which also incorporates a review of the Contract between ICANN and PTI. The IFRT2 have opened a public call for comments on the draft report, before they submit their Final Report to ICANN's Board of Directors which they expect to do before June this year. The Public Comment period closes for submissions on 28 April 2025 at 23:59hrs UTC, and I strongly encourage everyone to read the report and provide input regarding support to relocating one of the Key Management Facilities across the Pacific or Atlantic Oceans. To view the report and submit a comment, please go to https://www.icann.org/en/public-comment/proceeding/second-iana-naming-funct…. In order to submit a comment on the report, you will need an account on https://account.icann.org/. In closing, I cannot stress one thing enough - this is in no way speaks to the professionalism of ICANN's staff. The team at ICANN perform some of the hardest work out there, ensuring the integrity and stability of the Internet as we know it today and for that they cannot be thanked enough. This recommendation to move one of the KMFs overseas is simply to help protect it from potential political instability, bias, and to encourage neutralism. We're already doing it with the operation of the DNS Root Zone, let's take it one step further and strengthen the security of DNSSEC and the Root KSK. If you have any questions, please do feel free to ask, either on-list or off-list. Regards, Christopher Hawker

1 0

Second Call for Presentations for RIPE90
by Massimiliano Stucchi 19 Mar '25

19 Mar '25

Dear colleagues, The RIPE Programme Committee (PC) is now opening the second call for presentations seeking for content proposals from the RIPE community for the plenary sessions, lightning talks and BoFs. RIPE90 is going to be a hybrid meeting so both in-person and virtual presentations would be accepted and encouraged. The deadline to submit a presentation proposal is 8th of April 2025. Proposals submitted after this date will only be considered if there are still time slots available. Already submitted presentations which have not received an acceptance or rejection notification yet are still under consideration. Read more about the CfP and submit your presentation proposal at: https://ripe90.ripe.net/submit-topic/cfp/ More about RIPE90 meeting: https://ripe90.ripe.net/ Regards, Massimiliano Stucchi (On Behalf of the RIPE Programme Committee)

1 0

2024 IANA Numbering Services Review Committee Report Published
by Ulka Athale 18 Mar '25

18 Mar '25

This message is sent on behalf of the NRO Secretariat. The announcement can be viewed at: https://www.nro.net/2024-iana-numbering-services-review-committee-report-pu… ---------------------------------------- 2024 IANA Numbering Services Review Committee Report Published ---------------------------------------- The IANA Numbering Services Review Committee (IANA RC) is pleased to announce that it has published the 2024 IANA Numbering Services Review Committee Report. The IANA RC was formed in 2016 and is responsible for publishing an annual report as advice to the NRO EC for its evaluation of the IANA numbering services. This report follows a 30-day public comment period on the RIR IANA Numbering Services Review Matrix published by the RIRs seeking input from the broader community. It is based on the 2024 RIR IANA Numbering Services Review Matrix, as well as on any input gathered from the global number community. The 2024 IANA Numbering Services Review Committee Report is now published at: https://www.nro.net/wp-content/uploads/2024-IANA-RC-Report.pdf On behalf of the IANA Review Committee Nick Nugent Chair, IANA Numbering Services Review Committee ---------------------------------------- Background Information The IANA Numbering Services Review Committee (“RC”) committee, comprising of community representatives from each Regional Internet Registry (“RIR”) region, advises RIRs on the IANA Functions Operator’s performance of the IANA Numbering Services and adherence to the Service Level Agreement (“SLA”) between the IANA Numbering Services Operator and the RIRs (as defined in the Number Community Proposal). Their role is to advise and assist the Number Resource Organization Executive Committee (“NRO EC”) in a periodic review of SLA compliance for the IANA Numbering Services provided to the Number Community. The RC submits an annual report of its findings to the NRO EC. This committee was established in October 2016 for this purpose with representatives from all five RIR regions upon the recommendation of the Internet Number Community as part of the IANA Stewardship Transition. You can find information at: https://www.nro.net/internet-governance/iana/ ---------------------------------------- Kind regards, Ulka Athale RIPE NCC www.ripe.net

2 1