<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-IE" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><span lang="EN-GB">Hi Cynthia, <o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-GB">Support from the RIPE NCC can be stopped around 2021-01-01, as the software is already open source … <o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-GB">If you want to write a bug-fix and implement that.. you can do that today. You don’t need the NCC for that.. <o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-GB">The only that the RIPE NCC would have to do is to update the README.md on github and state that it is no longer maintained. <o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-GB">And probably also close the option to create new issues.. <o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-GB">But feel free to fork if you like. <o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-GB">Regards,<o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-GB">Erik Bais <o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Cynthia Revström <me@cynthia.re><br> <b>Date: </b>Monday 28 September 2020 at 09:47<br> <b>To: </b>Erik Bais <ebais@a2b-internet.com><br> <b>Cc: </b>Hans Petter Holen <hph@ripe.net>, Members Discuss <members-discuss@ripe.net>, "exec-board@ripe.net" <exec-board@ripe.net><br> <b>Subject: </b>Re: [members-discuss] Draft Activity Plan 2021 - RPKI development<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Hi, <o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I fully agree that while the budget on RPKI deployment should not be reduced currently, it should be used in other ways.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I think 2021-01-01 is a bit too early as last I looked there was still a considerable number of RIPE NCC validators running. 2022-01-01 is probably more reasonable.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Though feature updates could stop on 2020-01-01, fixes need to be done for at least a year more I would say.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Potential other ways to use the budget includes setting up a way for resource holders to use delegated RPKI published to repositories hosted by the RIPE NCC. Such as I believe <a href="http://NIC.BR">NIC.BR</a> is doing.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">- Cynthia<o:p></o:p></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <div> <p class="MsoNormal">On Wed, 23 Sep 2020, 08:26 Erik Bais, <<a href="mailto:ebais@a2b-internet.com">ebais@a2b-internet.com</a>> wrote:<o:p></o:p></p> </div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"> <p class="MsoNormal">Dear Hans Petter and fellow members, <br> <br> In the draft activity plan, there is a page about the current RPKI cost and plans of the further development. <br> <br> The plans state on Page 14 - 1.6 RPKI: <br> <br> 6 FTE and a 963.000 euro budget ... <br> <br> <begin quote> <br> <br> Activities in 2021<br> Our priority over the coming period will be ensuring a stable and resilient RPKI Trust Anchor and Certificate Authority.<br> In 2020, we carried out a third-party security and risk assessment of our RPKI platform. We are now working to define a<br> complete audit framework for RPKI, with the aim of having the audit performed early next year by a third party. Next year<br> we will implement changes to our internal processes and documented procedures on the basis of this audit, as well as<br> things like more granular monitoring and small technical changes that ensure compliance with the relevant RFCs. Aside<br> from that, we are planning significant improvements in our infrastructure to allow high availability and resiliency for the<br> RPKI repositories.<br> In last year’s Activity Plan, we said we would consider whether we should continue to support our RPKI Validator, as it<br> needed further development to match the quality of alternative tools that were now available. Because our RPKI Validator<br> remains the second most widely used tool (with 32% “market share”), we decided that we will continue to support it in 2021<br> and we aim to make a longer-term decision soon.<br> Finally, we will continue to build awareness of RPKI through training, outreach and promotion efforts. <br> <br> </end quote> <br> <br> I would like to argue that further development of Proof of Concept software (the RPKI validator) isn't required anymore now that there are multiple open source tools available on the market. <br> <br> The RIPE NCC isn't a software development house .. and I don't recall the RIPE NCC has the planning to become one ... <br> I would like to see further development of the RIPE NCC RPKI Validator discontinued as of Jan. 1st 2021.<br> <br> The backend software / infra for the signing of the RPKI environment still needs a lot of work and so does the training (awareness) about RPKI .. so I don't think that the resources or budgeted cost should be reduced, but is needs to be revised... <br> I think that the efforts should be put somewhere else on RPKI.<br> <br> That the RIPE NCC RPKI Validator is widely used, is because of the training efforts from the RIPE NCC.. and I think the community is better served with a more open approach about the usage of other validators, instead of trying to keep members to use a Java based software package. <br> <br> When the RIPE NCC started with the development of the RPKI Validator, there was a lack of other software ... but as things stand today, there are multiple open source implementations and this is a nice moment to go back to the core activity of the RIPE NCC. <br> <br> I know that with the above, I would probably not give the internal development team enough credits for their work and effort in the past years. <br> I do value their work to where they brought this, but it is time to put the focus on the core activities like the signing side of the RPKI and a more robust RPKI infra instead of the validation software. <br> <br> Regards,<br> Erik Bais<br> <br> <br> <br> <br> _______________________________________________<br> members-discuss mailing list<br> <a href="mailto:members-discuss@ripe.net" target="_blank">members-discuss@ripe.net</a><br> <a href="https://mailman.ripe.net/" target="_blank">https://mailman.ripe.net/</a><br> Unsubscribe: <a href="https://lists.ripe.net/mailman/options/members-discuss/me%40cynthia.re" target="_blank"> https://lists.ripe.net/mailman/options/members-discuss/me%40cynthia.re</a><o:p></o:p></p> </blockquote> </div> </div> </body> </html>