[anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)

Hi,


On Wed, 20 Mar 2019, Sascha Luck [ml] wrote:

(...)
>> Isn't that a contract? If a party breaches a contract, isn't it normal for 
>> the other party to terminate it?
>
> Not for the RIPE NCC. The NCC aims to restore compliance with the
> SSA and not to punish the member unless as a last resort.

If the member keeps breaking compliance........

Where do you exactly see in 2019-03 the suggestion that anyone will get a 
red card at first time?



(...)
> Please state exactly how advertising someone else's resources
> constitutes "abuse against the RIPE NCC" unless the offender also
> registers wrong data in the ripedb.

The RIPE NCC is a RIR. If its own members *repeateadly* don't respect the 
RIR's distribution of resources, then the RIR's usefulness quickly tends 
to zero.



(...)
>> If it has, please point me out to where i can find it in writing.
>> The NCC is a Regional Internet Registry. Its purpose (as i see it) is to 
>> distribute Internet resources. So, if it distributes resource X to party Y, 
>> then if party Z takes over the resource without party Y's consent, the 
>> whole concept and purpose of having a registry is broken.
>
> No. The purpose of a registry is to keep a *register* of data (in
> this case, resources).

And also do distribute resources, according to a specific set of rules.


> This aids members and others in finding out who the rightful "owner" of 
> a resource is. The Land Registry records who owns a bit of land, it 
> does not enforce who can live on it. If someone takes over someone 
> else's land, the *courts* deal with it.

A "Land Registry" is NOT distributing land.

Question: So, forgetting about that bit (distribution) and introducing the 
need to go to courts is a stalling mechanism by design?



(...)
> In the SSA. The SSA describes exactly what happens in case of
> policy violations and it is crystal clear that these steps are
> intended to rectify the situation rather than to punish the
> offender after the fact.

Although (as you stated before) if rectification is not possible then SSA 
termination (punishment?) is possible.



>>> If the NCC determines that a policy violation has occurred,
>> 
>> This proposal suggests clearly it is NOT the NCC who is determining if a 
>> policy violation has occurred.
>
> Pretty sure it is the NCC only who can determine that. Others may
> state opinions as to whether or not something is a policy
> violation but it's the NCC's *job* to make that determination.

At some point it *might* be the NCC's Board, through the ratification 
phase. The proposal doesn't suggest NCC staff to be involved other than 
providing the means to allow anyone to file a report.



(...)
>> So, where exactly do you see in the suggested process, the lack of 
>> opportunity (or opportunities) for the presumed "offender" to cooperate?
>
> Not my claim. I was paraphrasing the terms of the SSA

2019-03 doesn't try to change the SSA. I thought this thread was about 
2019-03. It should be abundantly clear that any presumable offender will 
have several occasions to cooperate.



(...)
>> From what i read from you, a speedy process will be undesirable, but a 
>> process with all the checks & balances will also be undesirable. 
>> Understood.
>
> A due process is ineffective as the hijack will be long over by
> the time anyone makes a determination.

2019-03 doesn't aim to stop intentional hijacks while they are happenning. 
The proposal is intended to show everyone that consequences might happen 
if they engage in these practices, and also reduce the amounts of hijacks 
from the same source.



(...)
> A speedy process (terminate the member on some expert's say-so?)
> is unacceptable (I hope, the membership may feel suicidal).
>
> So, the proposal makes no sense either way.

I already understood "speed" is irrelevant for you. But if you are happy 
that intentional hijacks keep going on a daily basis, and RIPE and RIPE 
NCC's reputation going down the drain, others are not. :-)



(...)
>> So, if a set of people agrees do this on a voluntary basis, you would 
>> consider to support the idea?
>
> If so, I'll concede *this* point, it won't make me support this
> proposal.

Understood. You will not support 2019-03, regardless of the "speed" or the 
"cost" axis, or depending on any other variable.



(...)
>> My employer is also part of the NCC Membership. I wouldn't mind discussing 
>> this during an AGM, if the Board allows it.
>
> I suspect at some point in time it will come to this. Not least
> because the membership will have to vote on any changes to the
> SSA.

But again, 2019-03 is not proposing any changes to the current SSA.



(...)
>> "activist randomers on a mailing list", just for sake of clarity, is aimed 
>> only at the two co-authors, or also at other people which have already 
>> expressed support for the idea/proposal? :-))
>
> It is a somewhat jesting term for the RIPE community in general.
> Because at the end of the day, that's what it is. Some email
> accounts on a list. Some people I know, most I don't, some use
> pseudonyms, others I suspect of being sockpuppets for the same
> person... Generally not a forum I would want to make decisions on
> punishment for the fee-paying members.
> But that is a discussion for another day.

If so, i really don't understand why do you spend your time participating 
:-)


Best Regards,
Carlos


> rgds,
> Sascha Luck
>