- ripe-list - mailman.ripe.net

Attack on RIPE NCC Access - Please Enable Two-Factor Authentication
by RIPE NCC Security 19 Feb '21

19 Feb '21

Dear colleagues, Last weekend, RIPE NCC Access, our single sign-on (SSO) service was affected by what appears to be a deliberate ‘credential-stuffing’ attack, which caused some downtime. We mitigated the attack, and we are now taking steps to ensure that our services are better protected against such threats in the future. Our preliminary investigations do not indicate that any SSO accounts have been compromised. If we do find that an account has been affected in the course of our investigations, we will contact the account holder individually to inform them. We would like to ask you to enable two-factor authentication on your RIPE NCC Access account if you have not already done so to ensure that your account is secure. In general, using two-factor authentication across all your accounts can help limit your exposure to such attacks. We will keep you informed about any relevant developments. If you have noticed any suspicious activity in your RIPE NCC Access account, please contact us immediately at security(a)ripe.net. Best regards, Ivo Dijkhuis Senior Information Security Officer, RIPE NCC

3 3

Call for Presentations: RIPE 82
by Brian Nisbet 16 Feb '21

16 Feb '21

*RIPE 82 will be a free virtual event and will take place from 17-21 May 2021* The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, lightning talks and BoFs. Please note that no workshops or tutorials will be organised at this meeting. The RIPE 82 Meeting plan is available here: https://ripe82.ripe.net/programme/meeting-plan/ You have until *19 March 2021* to submit your presentations proposals. Proposals submitted after this date will be considered depending on the slots still available in the programme. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and should not attempt a product demonstration. --------------------------------------------------------------------- Submissions --------------------------------------------------------------------- The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe82.ripe.net/submit-topic/submission-form/ - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panelists, presenters and moderators. - Presenters should indicate how much time their presentations will require. Here’s an indication of the average duration of each session format: o Plenary presentations: 20-25 minutes presentation with 10-5 minutes discussion o Lightning talks: 10 minutes for both the presentation and discussion o BoFs: one hour - Lightning talks should also be submitted using the same meeting submission system and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced the week before the RIPE Meeting. - Presenters who propose a BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. More detail on the presentation formats can be found here: https://ripe82.ripe.net/submit-topic/presentation-formats/ --------------------------------------------------------------------- Plenary or Working Group? --------------------------------------------------------------------- Presenters should be clear on whether they wish to submit a presentation for a plenary or working group session. At present, most working groups will solicit policy proposals, discussion points or other content directly via their mailing lists. If you’re not sure what kind of session you should be presenting at, please visit: https://ripe82.ripe.net/submit-topic/plenary-or-wg/ --------------------------------------------------------------------- The RIPE Meeting Code of Conduct --------------------------------------------------------------------- To ensure that RIPE Meeting values are upheld and that attendees experience a professional, respectful and safe meeting is a priority, please read the RIPE Meeting Code of Conduct: https://www.ripe.net/participate/meetings/ripe-meetings/ripe-meeting-code-o… --------------------------------------------------------------------- If you have any questions or requests concerning content submissions, please email pc(a)ripe.net . Franziska, Brian & Jan On Behalf of the RIPE PC Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

RIPE WG Chairs Selection and Terms
by Mirjam Kuehne 12 Feb '21

12 Feb '21

Dear colleagues, I think we all agree that the overall goal is to have a good and diverse set of WG chairs and we want to work with all WGs to facilitate that. Following the recommendations from the Accountability Task Force, we've started looking at the chair selection criteria of all RIPE Working Groups. Currently most WGs have terms or regular calls for nominations defined as part of their selection criteria. We will continue this review. Kind regards, Mirjam

8 11

DBTF Questionnaire – Deadline Extended to 22 February 2021
by Bijal Sanghani 12 Feb '21

12 Feb '21

Dear colleagues, We’ve received 20 replies so far to the RIPE Database Requirements Task Force (DBTF) questionnaire. Thank you for that and the discussion on the mailing list. As we would like more feedback on these questions, we’ve decided to extend the deadline to 22 February 2021. The questionnaire takes less than 10 minutes and really will give us valuable feedback to consider for our final draft. You can take the questionnaire here: https://www.surveymonkey.com/r/ZM222M3 Thank you for your participation and support. Have a lovely weekend! Kind regards, Bijal Sanghani RIPE DBTF Chair

1 0

excuses for my response to provocations in the list yesterday
by JORDI PALET MARTINEZ 12 Feb '21

12 Feb '21

Hi all, Yesterday I should have reacted in a different way, ignoring the provocations, so I want to ask excuses for that. I think we (all) in those situations must privately ask the chairs to enforce he AUP and call to the order to the authors of inappropriate postings. I need to make clear that I still believe (not just this time) it is wrong to issue any subtle "warning" (or whatever you want to call it) to participants in any discussion. We, as it can't be other way, can disagree if a proposal, idea, problem statement, solution, is good or bad; that's it and that's what the discussion should be about. We are all free to ignore/delete emails from anyone if we believe that he/she is sending too many emails, but those emails, in general, except in clear cases that we all remember for spam, publicity of electoral candidates, etc., need to be allowed without restriction, because people are discussing about something that is in the scope of the list (apply this to any WG list as well). If we believe that something is out of the scope, we should call the chairs to tell to the poster, but not do ourselves and even less, do what I did: responding to them. If we look into previous discussions, same people that attacked me yesterday has sent (many times) more than "n" emails. So, if we want to define that, let's have it in the PDP or AUP, so it applies to everybody in the same way. My response to their provocation is only upsetting more people from the community against my proposals or ideas, so I'm helping them to achieve what they wanted: to ruin the discussion. Is not an excuse, but you also need to understand that this is not a consequence of a few minutes of "bad energy" from my side, but also a cumulus of private emails (sometimes from the same people that exposed themselves in the list), and attacks in different lists (often from the same people as well), such as mentions to the "Spanish Inquisition", among others. I tend to not overreact to those, even ignore them, or answer politely, but it seems that I should instead, report every single case to the chairs and avoid forming "dark clouds" and then having "storms". I'm not alone on this (and I got a couple of people writing me about that this time). We discussed long time ago, I think it was in the Diversity TF, how people take advantage of better knowledge of English to abuse and attack non-native speaker ones (or people that is not so fluent). We have mention about the lack of participation. Those subtle attacks definitively don't help to improve that, on the other way around, some people get scared, overreact, or go away. It is even more sad that some of those provocations come from people that are (or have been) chairs of WGs and I think they must be exemplary. It looks like some of them believe they are kings. Maybe one more thing to change in the PDP is a maximum number of terms to avoid this. I think also sanctions of the AUP should be stricter in those cases and this shows that also we are missing in the PDP a procedure for recalling chairs. For those that aren’t aware, this just happened in AFRINIC (a Recall Committee has decided that both cochairs are recalled with immediate effect, in short because they violated the PDP and took decisions or attributions beyond what is set in the PDP). Regards, Jordi @jordipalet ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

10 16

Paging: A Microsoft engineer, preferably in charge of Outlook 365 mail service
by Carsten Schiefner 11 Feb '21

11 Feb '21

Dear all - could this person please be in touch by PM? Or be recommended to me by somebody else, also by PM? Thanks & best, -C.

1 0

Re: [ripe-list] RIPE Working Group Chair Collective Meeting Summary
by JORDI PALET MARTINEZ 10 Feb '21

10 Feb '21

Yesterday I avoided responding to the list and responded only to Leo, as I did to other emails, but I think that's wrong. We have the list to discuss about any relevant topic, and should not refrain despite of provocations, otherwise, the list becomes useless. So here is it: Fully agree, your text is precise. I forgot that not everybody in the list is participating ... Is like in the IETF, you are "a member" just by subscribing. Tks! Regards, Jordi @jordipalet El 9/2/21 16:29, "Leo Vegoda" <leo(a)vegoda.org> escribió: On Tue, Feb 9, 2021 at 5:56 AM JORDI PALET MARTINEZ via ripe-list <ripe-list(a)ripe.net> wrote: [...] > To be part of this community you just need to participate. No. To be a member of this community you only need to be present. That presence only requires joining a mailing list so that a person can choose to observe or participate. Posting to mailing lists is not a requirement. Regards, Leo ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

New on RIPE Labs: RIPE Chair Team Report - January 2021
by Alun Davies 10 Feb '21

10 Feb '21

Dear colleagues, The RIPE Chair reports on the RIPE Chair team's activities so far in 2021 and looks at a number of noteworthy community developments that have taken place so far this year. Read more on RIPE Labs: https://labs.ripe.net/Members/mirjam_kuhne/ripe-chair-team-report-january-2… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

repeated and continued PDP violation - WG chairs delaying or denying proposal publication - new policy proposal "Ensure Neutrality of PDP Appeals Procedure"
by JORDI PALET MARTINEZ 09 Feb '21

09 Feb '21

Hi all, Across the years, I've suffered this situation several times and I think this community must not allow it anymore and I wish the PDP has explicit actions against those situations, so they don't happen over and over. Briefly, in several situation I've written policy proposals, and the chairs of the WG, tried to convince me to not publish it, or actually decided not to publish it, or delayed it. Of course, this is a clear violation of the PDP (RIPE-710). The PDP states: "Discussions may be started by anyone at any time. Participants are welcome to discuss broad ideas as well as to make detailed policy proposals" Also: "A proposal is discussed publicly in the relevant RIPE Working Group (WG)[1]. The proposal is usually submitted via the chair of that WG." Actually, and since many years, "usually", you submit the proposal to the Policy Officer and if you already know the appropriate WG, you copy to the WG chairs. It is normal that the publication is delayed for a few days, as the WG chairs can provide some inputs, the staff as well (including editorial suggestions), questions to the staff, even the Board, etc., etc. HOWEVER, there is no way for the WG chairs to delay or deny a publication or reject a proposal (unless is clearly out of the scope of the WG). Actual specific example of the situation I'm facing (approximate dates, just to show the unacceptable delay in a policy proposal publication): 1) 9th September 2020: Anti-abuse-wg chairs decided to declare non-consensus in proposal 2019-04 and I announce that I've asked them for more details and if I'm not satisfied, I will start an appeal. A couple of community members, in private, tell me that it will not happen. I re-read the PDP and get convinced that they're right, but I must do it anyway. 2) I write a policy proposal ("Ensure Neutrality of PDP Appeals Procedure") to update the PDP to avoid this happening in the future (so clearly knowing that it will be relevant for my appeal). Submitted formally on 5th October. This proposal is sent to the Policy Officer and copied the chairs-team (as the PDP update is done via the "plenary" WG). 3) In the following few days/weeks, there are some updates of the policy proposal, thanks to the inputs of the Policy Officer and even there is a request to the Board for their confirmation in one detail (no longer relevant in the attached version). 4) At the end of October, as a result of several inputs from the Policy Officer and the Board I've a final version, which however, gets new inputs from the chairs-team so my very last version is really final by 12 of November and I ask for immediate publication. 5) Chairs-team try to convince me that they don't agree with a paragraph from the proposal on December 1st, also they indicate that Xmas is a bad timing (which never minds because the discussion phase could be extended if there are no inputs, etc.). 6) Even if there have been several requests from my side for publication (we have been discussing a parallel topic for a report on the appeal process, which doesn't change my perspective on my proposal), I've asked several times for the immediate publication, which has not yet been done. I agree that a month, for an initial discussion with the staff, editorial inputs, etc., is acceptable, even if most of those discussions could actually happen just in 1-2 weeks, because they could take place in parallel, instead of sequentially as it has been the case. However, we have got 3 extra months (November, December, January), and the proposal is NOT YET PUBLISHED. Even worst, the last times I asked for the publication, I got NO RESPONSE from the chairs. As a consequence, in addition to make sure that this NEVER HAPPENS AGAIN (I mean in general, no violation of the PDP), I attach the proposal, so the staff, *following the mandate of the PDP* (not the chairs, which have no voice on this according to the PDP) publish it IMMEDIATELY and we can start a discussion of it, immediately. Thanks. Regards, Jordi @jordipalet ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

12 29

Re: [ripe-list] repeated and continued PDP violation - WG chairs delaying or denying proposal publication - new policy proposal "Ensure Neutrality of PDP Appeals Procedure"
by Niall O'Reilly 09 Feb '21

09 Feb '21

Hi, Ondřej. Apologies for any confusion; I received two copies of this message and replied already to what looked like a private, off-list message. On 9 Feb 2021, at 14:08, Ondřej Surý wrote: > > also with my Arbiter hat on, this seems like quite widening the area that > RIPE Arbiters would have to cover. I don't think that enlisting the > Arbiters to cover the Appeals is something that could be done with their > consent. Agreed. Any change to the mandate of the RIPE NCC Arbiters could only be by consent. Indeed, I think that even to seek such consent from existing Arbiters would be to exercise undue pressure. If the RIPE Community were to decide to set up some kind of “RIPE PDP Appeal Panel”, I think that this would have to be formally quite separate from the RIPE NCC Panel of Arbiters. I don’t see any reason in principle not to allow anyone who might wish to volunteer for both panels do do so. I hope this reassures you. Niall

1 0