[ncc-services-wg] Incident Response Service (IRS) [was: Unneeded RIPE tasks] (fwd)

At 10:35 AM 25-08-03 +0200, Henk Uijterwaal (RIPE-NCC) wrote:
>Dear Hank,
>
> >
> > And you do not see this a procedurally wrong?  Wherever I work, whenever
> > they want to do "something new", they need to write it up fully, indicate
> > the budget and manpower needed and then submit to management.  Based on
> > that info, management can make an intelligent decision.
>
>I've seen this approach.  I've also worked at places where the LOI/TDR
>approach was used: the first document ("Letter of Intent") gave a global
>outline of the activity, goals, deadlines, costs, manpower, etc.  Only
>when this was approved, a second document ("Technical Design Report") was
>written discussing all the details.  I personally believe that this
>approach makes much more sense, why waste time/money to work out details
>_before_ there is consensus that the activity should be persued in the
>first place.

I would have been very happy to see an LOI/TDR approach where a global 
outline would contain just costs and manpower.  No such document on IRS has 
ever been presented.



> > Instead, we have 1 paragraph describing what will be done in general and
> > once the AP2004 is approved based on that, only then do we find out how
> > much all this cost.
>
>This is not correct.  There is indeed only one paragraph in the AP2004,
>due to space constraints.  However, there is also the strategy paper:
>
>   http://www.ripe.net/ripe/docs/hostcount.html

A title of "RIPE NCC Hostcount in the 21st Century - A New Direction for 
Measurements by the RIPE NCC" does not give any indication of Incident 
Response content, sorry.  Including security inside a hostcount document is 
wrong.  I would have thought that the techseg-wg would be far more 
appropriate to discuss an Incident Response Service.


>with more details about the IS activity.  This paper was discussed at
>RIPE45 and people have been invited to comment on this document on the
>tt-wg at ripe.net list.  Then the proposed budget:

The test-Traffic WG, as per its charter states:
"The purpose of the Test Traffic Measurements is to independently measure 
the performance parameters of the Internet using test traffic boxes located 
in the networks of participating ISP's.

...

Although the working group was set up as a result of the test traffic 
project the scope of the group should allow any new performance measuring 
techniques to be included and proposals for such devices are most welcome.

The data collected is analysed for the purpose of network trouble shooting, 
capacity planning and other such worthwhile reports. It is not the purpose 
of the working group to compare different ISP's network performance nor 
should the data be used for marketing purposes of any kind."

Nothing about Incident Response.


>   http://www.ripe.net/ripe/draft-documents/budget2004-aoa97.html and
>   http://www.ripe.net/ripe/draft-documents/budget2004-aoa03.html
>
>does contain an estimated budget for this activity.

No it does not!  It contains an aggregated budget of 1.4Meuro for 
Information Services with no indication of manpower.  In addition, 
Information Services, based on 
http://www.ripe.net/ripe/draft-documents/ap2004.html includes from section 
5: RIS, AMS, SCS, and IRS.  There is *NO* way to know how much IRS will 
take in budget or manpower.


>If you have any specific questions about the 2 documents mentioned above,
>I suggest that we take them to the tt-wg at ripe.net list.

I went thru the archives of the tt-wg and found nothing being discussed 
about Incident Response Service.  The two above documents you list:
RIPE NCC Budget 2004
has very little to do with the tt-wg and much more with the ncc-services WG.

-Hank


>Henk
>
>------------------------------------------------------------------------------
>Henk Uijterwaal                             Email: henk.uijterwaal at ripe.net
>RIPE Network Coordination Centre            WWW: http://www.ripe.net/home/henk
>P.O.Box 10096          Singel 258           Phone: +31.20.5354414
>1001 EB Amsterdam      1016 AB Amsterdam    Fax: +31.20.5354445
>The Netherlands        The Netherlands      Mobile: +31.6.55861746
>------------------------------------------------------------------------------
>
>That problem that we weren't having yesterday, is it better? (Big ISP NOC)