From info at arin.net Wed Jan 28 12:59:11 2015 From: info at arin.net (ARIN) Date: Wed, 28 Jan 2015 12:59:11 -0500 Subject: [ARIN-Suggestions] New ACSP Suggestion 2015.1 - CLARIFICATION OF ARIN'S IPV4 COUNTDOWN PHASES Message-ID: <54C9236F.8070309@arin.net> A new suggestion was received through the ACSP, and was assigned number2015.1 upon receipt of confirmation. The text of the Suggestion is available at: https://www.arin.net/participate/acsp/suggestions/2015-1.html ARIN will issue an initial response within 10 business days. Regards, Communications and Member Services American Registry for Internet Numbers (ARIN) **** Suggestion: * Description: Submitter seeks clarification of ARIN's countdown phases (https://www.arin.net/resources/request/ipv4_countdown.html) and intended operational practices after the ARIN general free pool becomes empty, implying that we are substantially in a transfer-only ecosystem. Does ARIN remain in Phase 4 of the IPv4 Countdown Plan, and if not, what is Phase 5? Value to Community: There may be policy tweaks or further ACSP suggestions warranted based on ARIN's operational plans. -------------- next part -------------- An HTML attachment was scrubbed... URL: From info at arin.net Fri Jan 30 12:18:49 2015 From: info at arin.net (ARIN) Date: Fri, 30 Jan 2015 12:18:49 -0500 Subject: [ARIN-Suggestions] New ACSP Suggestion 2015.2: SUPPORT HSTS WHERE TECHNICALLY FEASIBLE Message-ID: <54CBBCF9.5060005@arin.net> A new suggestion was received through the ACSP, and was assigned number2015.2 upon receipt of confirmation. The text of the Suggestion is available at: https://www.arin.net/participate/acsp/suggestions/2015-2.html ARIN will issue an initial response within 10 business days. Regards, Communications and Member Services American Registry for Internet Numbers (ARIN) **** Suggestion: * Submitter has noticed that www.arin.net has for some time been https-only, with attempts to connect via http issued a 301 redirect to the https site. An improvement upon this practice would be to support HTTP Strict Transport Security (RFC 6797). At a high level, HSTS informs capable browsers [*] via an additional header in each HTTPS session that for a certain period of time (typically months to one year) they should never try to connect to the site via unencrypted HTTP. This is an additional layer of protection against man in the middle attacks. [*] At this writing, HSTS is widely supported (Chrome, Firefox, Opera, Safari, and upcoming in IE for Windows 10). Value to Community: Increased protection against spoofing/MITM attacks -------------- next part -------------- An HTML attachment was scrubbed... URL: