[arin-ppml] Draft Policy ARIN-2017-5: Equalization of Assignment Registration requirements between IPv4 and IPv6

[David R Huberman]

Hello Joe,

Thanks for the reply. A reminder that I'm *asking* a genuine question. 
Now, I wrote:

>> Whois reassignments are not the proper place for the information LE 
>> wants, in my opinion, and has almost no value to NOCs.

Joe replied:

> I find this assertion at odds with both my experience and direct
> inquiries to those in the anti-abuse community.  Upon what basis
> is it made?

So a few things.

1) I specifically said 'reassignments', and by that I meant end-user data. 
I have always been in favor of 'reallocations' (to downstream ISPs) being 
in Whois.

2) The *vast* majority (and we're talking 99%+ -- I've studied the data 
many times) of end-user SWIP data is things like:

AT&T Internet Services SBCIS-SIS80-1005 (NET-69-0-0-0-1) 69.0.0.0 - 
69.0.127.255
THE MEDICINE SHOPPE SBC069000000000030204 (NET-69-0-0-0-2) 69.0.0.0 - 
69.0.0.7

When you lookup the specific /29, you get:

CustName:       THE MEDICINE SHOPPE
Address:        310 ORANGE ST
City:           NEW HAVEN
StateProv:      CT
PostalCode:     06510
Country:        US

... with vanilla AT*T contact information from the parent /17.

Yes: I assert this data has no value to NOCs or general internetworking 
operations, in my experience, and I wrote that I do not believe this is 
the proper place for LE to be gleaning it's info. (That's a whole other 
conversation, but it's my opinion here.)

I don't understand how this SWIP data provides value in terms of 
transparency?  It is, as others have noted, just giving out customer lists 
-- information which is typically considered confidential.  ARIN policy 
*can* require this information, but *should* it?

Additing to this conversation, two other items:

3) Since 2004, when Dave Barger first got up to a microphone at an ARIN 
meeting (Reston) and admitted that his company's SWIPs were non-compliant 
because of software issues, we've had huge swaths of SWIP data that is 
just wrong.  It's very difficult (especially at scale) to both publish and 
maintain accurate SWIP data.  There's a real cost to requiring accurate 
SWIP data for providers -- large and small.  If we're going to put this 
cost on them for IPv6, I'd really like us to have a solid justification 
that's relevant to 2017 network operations, and not based on what was true 
in 1999.

4) And finally, we go back to an early convversation point that as 
presently drafted, this policy idea (required SWIPs for IPv6) is not 
enforceable by ARIN.  In a world where you generally do not go back to the 
RIR for additional IPv6 prefixes, ARIN has no enforcement tools in the 
policy -- and the one's they could have that I can envisage, I don't 
support.

David