[ncc-services-wg] [policy-announce] 2012-08 New Policy Proposal (Publication of Sponsoring LIR for Independent Number Resources)

On 15/10/2012 17:48, Sascha Luck wrote:
> That is an argument against RPKI rather than one in favour of
> sponsoring-LIR registration, IMO. To whit, the imposition of a
> hierarchical structure on a non-hierarchical internet and the creation
> of "chains-of-responsibility" from thin air where none exist (and shouldn't
> exist).
> It would be better to have the end-user rpki-register their own
> resources with the RIR (who can easily verify their validity)

Nevertheless, we are where we are and although you may not like RPKI, it
exists and we have to deal with.  Part of this is to put sensible policies
in place to handle it.

Regarding PI resources, a contractual link between the RIPE NCC and the end
user exists, and the NCC has implemented RPKI using this chain of
contracts.  Changing this would require a direct contractual link between
the end user and the RIPE NCC.  If you want to change it, then why not fly
a policy proposal in that direction?  Or if you feel strongly enough, float
a policy proposal to drop rpki?

But as it is, my point stands: there is no easy visibility into the rpki
contractual side of things according to current RIPE policy, and this is a
weakness which harms abuse handling.

This, btw, is separate to the general abuse issue noted in the "Arguments
For" section of the proposal for providing a mechanism for being able to
contact a LIR to apply their AUP to an abusing End User.  Not sure why
you're arguing that there is a problem with it.  Abusing end users exist
and hide where they can.

> Not all of these relationships are actually registered, viz DSL or
> wireless broadband dynamic ranges.

No, not all, but every one where the address range is >= /29. This is a
very large number of assignments indeed.

> With PI it's not the same situation *at all*. PI space is
> provider-*independent* and thus may be one last way to prevent a LIR 
> becoming collateral damage in an attack on the end-user (eg a
> politically controversial organisation)

This makes very little sense.  If there's a perceived issue with a PI
resource End User, then their legal name and contact details are already in
the RIPE database so for the most part, it will be the end user who gets
the flack.  And if for some reason their LIR ends up with collateral damage
and feels they need to drop them as clients (I'm sure this happens from
time to time), then there are 8000 other LIRs in the RIPE service region
who can take the transfer.

Nick