[db-wg] Role of RIPE NCC in geofeed, abuse-c checks, etc

Hi Denis,

On Thu, Apr 08, 2021 at 12:55:32AM +0200, denis walker via db-wg wrote:
> I don't see the issue of what, if anything, should be validated as a
> show stopper for introducing the "geofeed:" attribute. This is my idea
> of utilising the RIRs to improve the value of services with increased
> validation. That's why I changed the subject line and started it as a
> different thread. We can come back to this later. Apologies for taking
> you down a side road, but at least I got some initial feelings from
> you on this more general issue.

I recognize value in your suggestions on RIR-driven validation, and
definitely agree on the desired outcomes, but I'm not convinced its the
RIRs that should take on (as permanent task) to do outreach about
'broken geofeeds'. 

While keeping in mind that 'geofeed:' is a new utility for this industry
and we (as collective of producers & consumers) have yet to see how
things will work out exactly. One thing stood out to me in what Denis
wrote: "This geofeed attribute will delegate this information process
out to thousands of organisations." (src:
https://www.ripe.net/ripe/mail/archives/db-wg/2021-April/006893.html)

While indeed globally thousands of organizations are now being guided
and enabled towards populating geofeeds, this in itself is not an
indicator that a decentralized approach will 'overtake' the current
market for "GeoIP information".

It doesn't strike me as unfeasible that the likes of MaxMind,
IPinfo.info, or any other GeoIP aggregators will take on the role of
'patrolling' the feeds and providing tools/notifications to those who
appear to publish broken information.

The (commercial) 'GeoIP market' is far more advanced than a mere IP
Address <> Geographical location mapping. Another layer of advancement
that exists: customers of GeoIP information oftentimes will correlate
the purchased GeoIP information with their own internal records on fraud
and other activities of interest, and also acquire GeoIP from multiple
(possibly even non-database) sources. Some companies measure latency to
help approximate geography.

To me it seems unlikely the 'geofeed' mechanism will 'wipe out' the
existing market, but rather geofeeds might be a (significant!)
enhancement for existing practises.

I do think that 'geofeed:' in some ways democratizes the market in the
sense that an industry standard publication mechanism and easier access
to this type of access means that more people can cheaply acquire
GeoIP information which means that existing GeoIP providers will have to
step up their game .... which is a positive! :)

I think we should only ask the RIRs 'to do something' when it has become
clear the industry itself is unable to organize it themselves. RIPE
Atlas probably is a great example of someting only an RIR could've
pulled off.

Kind regards,

Job

ps. An example where data quality urgently needed to increase were RPKI
ROAs in the 2019-2020 time frame. To help the BGP Default-Free Zone get
rid of 'RPKI Invalid' BGP announcements, it was not the RIRs that 'did
the cleanup', it was the efforts of individuals such as 'nusenu_',
Anurag Bhatia, Massimo Candela's BGPAlerter, and hundreds of network
operators actually deploying RPKI ROV that resulted in significant
industry-wide cleanup. RIPE NCC indeed does have a 'wrong-ROA' alerting
mechanism but it only applied to RIPE managed space, and (imho) is too
crude of an alerting mechanism to be useful in most corporate contexts. 

pps. Another example of global cleanup led by an individuals is Jared
Mauch's "Open Resolver Project" for which he was awarded the M3AAWG J.D.
Falk Award.