From linda at sat-tel.com Mon Oct 1 08:50:20 2001 From: linda at sat-tel.com (Linda) Date: Mon, 01 Oct 2001 08:50:20 -0400 Subject: RWHOIS Update References: Message-ID: <3BB8668C.D50B923F@sat-tel.com> Good Morning, Satellite Communication Systems does not plan on downloading the RWHOIS. We as well as our customers solely use SWIP. Regards, Linda ginny listman wrote: > At the ARIN Open Policy and Member Meeting in San Francisco (2-4 Apr 2001) > there was consensus that RWHOIS was in dire need of repair. This echoed > similar sentiments that had been raised on various mail lists. In > response to this desire, work begun on "fixing" RWHOIS. > > On September 6, ARIN's Engineering Department announced the release of a > beta version of the RWHOIS software. Details are at: > > http://www.arin.net/mailinglist/dbwg/0153.html > > Since that time, there has been approximately 30 downloads from our ftp > site. I have receive only one comment from someone who had problems > compiling the software. > > My questions to the community are: > > 1. Is RWHOIS an option for your company to replace SWIP? > 2. If you haven't download it yet, do you plan on downloading at a later > time? Are you busy establishing a test site? > 3. If you have downloaded it, have you done any testing? Have you found > any bugs? Can you make any recommendations for improvement? > 4. Is investing in RWHOIS development a good allocation of ARIN > Engineering resources? > > These issues will be discussed at the ARIN Member Meeting scheduled for > late October in Miami. However, discussing these questions now will help > facilitate that discussion. Please send all responses to dbwg at arin.net. > > Ginny Listman > Director of Engineering > American Registry for Internet Numbers (ARIN) From lhoward at uu.net Mon Oct 1 10:44:40 2001 From: lhoward at uu.net (Lee Howard) Date: Mon, 1 Oct 2001 10:44:40 -0400 (EDT) Subject: Policy Proposal 2001-7 Message-ID: --From the archives of last week: ARIN currently provides a bulk copy of WHOIS output only to organizations that will use the data for technical research purposes and sign an acceptable use policy. Point of contact information is excluded from these bulk copies. APNIC and RIPE NCC provide bulk copies of their WHOIS output on their FTP sites for any organization that wishes to obtain the data providing they agree to the acceptable use policy that accompanies the data. Proposal: It is proposed ARIN provide a bulk copy of WHOIS output, minus point of contact information, on the ARIN FTP site for download by any organization that wishes to obtain the data providing they agree to ARIN's acceptable use policy that would accompany the data. --- The only difference I see between the current practice and the proposed policy is that access will not be limited to those conducting research. Can anyone provide an example of a legitimate non-research use for bulk WHOIS, or other rationale for this proposed policy? I would think the membership would be more interested in tightening access to WHOIS, rather than loosening it. For instance, what enforcement is available to ARIN if someone violates the AUP? What mechanisms exist to prevent massive database queries? I dimly remember discussion at the last public policy meeting that a measure like this might be introduced to reduce load on the WHOIS servers. Is there consensus that this is the best method for doing so? Lee From jkd at cyberspace.org Mon Oct 1 11:13:44 2001 From: jkd at cyberspace.org (John K. Doyle, Jr.) Date: Mon, 1 Oct 2001 11:13:44 -0400 (EDT) Subject: Policy Proposal 2001-7 In-Reply-To: Message-ID: On Mon, 1 Oct 2001, Lee Howard wrote: > The only difference I see between the current practice and the proposed > policy is that access will not be limited to those conducting research. > Can anyone provide an example of a legitimate non-research use for bulk > WHOIS, or other rationale for this proposed policy? One _potentially_ legitimate use would be the identification of address space assigned to those countries on the U.S. DoJ/DoC "no export" list. I know that, flawed as the mechanism may be, this is ONE of the checks run by at least one large corporate software repository ("download") site in order to comply with the law. Yes, I do realize that such a check, by itself, is not going to be effective. I mention it here to illustrate that there are "legitimate" (non-SPAM) uses for such access to the database. John From linda at sat-tel.com Tue Oct 2 08:37:58 2001 From: linda at sat-tel.com (Linda) Date: Tue, 02 Oct 2001 08:37:58 -0400 Subject: RWHOIS Update References: <5.1.0.14.0.20011002054252.04ec8a80@pop3.access.net.id> Message-ID: <3BB9B525.E77AD756@sat-tel.com> Good Morning Teddy, > > My questions to the community are: > > > > 1. Is RWHOIS an option for your company to replace SWIP? The question listed above was a question given to the community by Ginny Listman. RWHOIS is not an option for our company to replace SWIP. We use Shared WHOIS Project (SWIP) to submit IP space reassignment information to the WHOIS database. We do not plan on establishing a Referral WHOIS (RWHOIS) server. The information listed below is an excerpt from the swipinstructions.txt which can be found on the ARIN web site. ftp://ftp.arin.net/pub/swip/swipinstruction.txt Please let me know if this does not clarify what I meant by my prior statement. SWIP is the process that Internet Service Providers (ISPs) use to submit customer IP space reassignment information to the WHOIS database. ISPs that receive CIDR blocks of IP addresses from ARIN either directly or indirectly (as a downstream customer of another ISP) MUST select either SWIP or RWHOIS to provide reassignment information to ARIN. SWIP automates the IP address space assignment process. ISPs use SWIP templates to submit reassignment to ARIN via E-mail. Regards, Linda "Teddy A. PURWADI" wrote: > Linda, > > I don't understand what do you mean by this. > IMHO: RWHOIS nothing to do with your system. > Please corrected me, if it is wrong. > Regards, > -teddy > > At 08:50 AM 10/1/01 -0400, Linda wrote: > >Good Morning, > > > >Satellite Communication Systems does not plan on downloading the RWHOIS. We > >as well as our customers solely use SWIP. > > > >Regards, > >Linda > > > >ginny listman wrote: > > > > > At the ARIN Open Policy and Member Meeting in San Francisco (2-4 Apr 2001) > > > there was consensus that RWHOIS was in dire need of repair. This echoed > > > similar sentiments that had been raised on various mail lists. In > > > response to this desire, work begun on "fixing" RWHOIS. > > > > > > On September 6, ARIN's Engineering Department announced the release of a > > > beta version of the RWHOIS software. Details are at: > > > > > > http://www.arin.net/mailinglist/dbwg/0153.html > > > > > > Since that time, there has been approximately 30 downloads from our ftp > > > site. I have receive only one comment from someone who had problems > > > compiling the software. > > > > > > My questions to the community are: > > > > > > 1. Is RWHOIS an option for your company to replace SWIP? > > > 2. If you haven't download it yet, do you plan on downloading at a later > > > time? Are you busy establishing a test site? > > > 3. If you have downloaded it, have you done any testing? Have you found > > > any bugs? Can you make any recommendations for improvement? > > > 4. Is investing in RWHOIS development a good allocation of ARIN > > > Engineering resources? > > > > > > These issues will be discussed at the ARIN Member Meeting scheduled for > > > late October in Miami. However, discussing these questions now will help > > > facilitate that discussion. Please send all responses to dbwg at arin.net. > > > > > > Ginny Listman > > > Director of Engineering > > > American Registry for Internet Numbers (ARIN) > > http://www.isoc-id.org > [+ INFORMATION-INTERNET SOCIETY +] > ANTIMONOPOLY: LAW NO. 5 Of 1999 > "Ban On Monopolistic Practices & Unfair Business Competition" From lhoward at uu.net Thu Oct 4 10:55:09 2001 From: lhoward at uu.net (Lee Howard) Date: Thu, 4 Oct 2001 10:55:09 -0400 (EDT) Subject: RWHOIS proposal Message-ID: We've begun evaluating using RWHOIS. Among the advantages I see are instant updates, local access control, restricted access for bulk queries, privacy protection, and if I'm lucky, a chance to integrate RWHOIS and IRR. The problems I'm having are that I will have to modify the code to query an existing SQL database, change the output to RPSL, and cost- justify the work to the business. I think ARIN can help me with the last point. Presumably, organizations using RWHOIS create less work on ARIN's resources, whether staff, servers, or bandwidth. In my point of view, organizations who create more work for ARIN should pay more (e.g., companies with multiple networks, each of which is considered separately). A corollary to that would be that organizations who generate less work for ARIN should pay less. I would like advice from ARIN staff on the proposition that RWHOIS users require less work from them and their network and servers. If that is the case, I would like to propose that organizations using RWHOIS instead of SWIP be assessed lower annual fees. I ask for a recommendation from ARIN of how much lower, proportional to the reduced work. So, ultimately, if the membership agrees that RWHOIS is a Good Thing, this would create an incentive for them to use it. If it creates less work for ARIN, so much the better. Thanks, Lee Howard From jiml at mrtg.noc.adelphia.net Thu Oct 4 11:12:17 2001 From: jiml at mrtg.noc.adelphia.net (James W. Laferriere) Date: Thu, 4 Oct 2001 11:12:17 -0400 (Eastern Daylight Time) Subject: RWHOIS proposal In-Reply-To: Message-ID: Hello All , Is there an active URL: for the rwhois server software ? Tia , JimL James W. Laferriere Research Engineer jlaferriere at adelphia.net 814.260.3697 Voice 814.260.3760 Fax From martind at uu.net Thu Oct 4 11:22:45 2001 From: martind at uu.net ( dawn martin) Date: Thu, 4 Oct 2001 11:22:45 -0400 Subject: RWHOIS proposal In-Reply-To: Message-ID: <001501c14ce8$6b80eea0$0a0a0a0a@lteng122> ftp://rs.arin.net/pub/rwhois/ -----Original Message----- From: dbwg-request at arin.net [mailto:dbwg-request at arin.net]On Behalf Of James W. Laferriere Sent: Thursday, October 04, 2001 11:12 AM To: dbwg at arin.net Subject: Re: RWHOIS proposal Hello All , Is there an active URL: for the rwhois server software ? Tia , JimL James W. Laferriere Research Engineer jlaferriere at adelphia.net 814.260.3697 Voice 814.260.3760 Fax From lhoward at uu.net Thu Oct 4 11:23:17 2001 From: lhoward at uu.net (Lee Howard) Date: Thu, 4 Oct 2001 11:23:17 -0400 (EDT) Subject: RWHOIS proposal In-Reply-To: Message-ID: Yes, Ginny Listman posted on September 6: The Engineering Department at ARIN has release a BETA version of the Referral Whois (RWhois) server software. rwhoisd-1.5.8 is a release version that is being distributed by ARIN for testing purposes only. It can be retrieved from ftp://ftp.arin.net/pub/rwhois/rwhoisd-1.5.8.tgz in tar-gzip format. It does have a dependency that will need to be installed beforehand. The str library from Ralph Engelschall (rse at engelschall.com) can be obtain from either ftp://ftp.arin.net/pub/rwhois/str-0.9.5.tar.gz or http://www.engelschall.com/sw/str/str-0.9.5.tar.gz . . . For the rest of the message and related threads, search the DBWG archives at: http://www.arin.net/mailinglists/dbwg/index.html HTH, Lee On Thu, 4 Oct 2001, James W. Laferriere wrote: > Date: Thu, 4 Oct 2001 11:12:17 -0400 (Eastern Daylight Time) > From: James W. Laferriere > To: dbwg at arin.net > Subject: Re: RWHOIS proposal > > > Hello All , Is there an active URL: for the rwhois server > software ? Tia , JimL > > James W. Laferriere > Research Engineer > jlaferriere at adelphia.net > 814.260.3697 Voice > 814.260.3760 Fax > From jiml at mrtg.noc.adelphia.net Thu Oct 4 12:02:37 2001 From: jiml at mrtg.noc.adelphia.net (James W. Laferriere) Date: Thu, 4 Oct 2001 12:02:37 -0400 (Eastern Daylight Time) Subject: RWHOIS proposal In-Reply-To: Message-ID: Hello All , Thank you . On Thu, 4 Oct 2001, Lee Howard wrote: > Yes, Ginny Listman posted on September 6: Sorry I was not a member of dbwg at that time . > The Engineering Department at ARIN has release a BETA version of the > Referral Whois (RWhois) server software. rwhoisd-1.5.8 is a release > version that is being distributed by ARIN for testing purposes only. > It can be retrieved from ftp://ftp.arin.net/pub/rwhois/rwhoisd-1.5.8.tgz > in tar-gzip format. > It does have a dependency that will need to be installed beforehand. > The str library from Ralph Engelschall (rse at engelschall.com) can be > obtain from either ftp://ftp.arin.net/pub/rwhois/str-0.9.5.tar.gz > or http://www.engelschall.com/sw/str/str-0.9.5.tar.gz > . . . Thank you for these pointers . > For the rest of the message and related threads, search the DBWG > archives at: > http://www.arin.net/mailinglists/dbwg/index.html And especially this one . It doesn't appear in the dbwg 'info' information . In fact their isn't any . Tnx Again , JimL > HTH, > Lee James W. Laferriere Research Engineer jlaferriere at adelphia.net 814.260.3697 Voice 814.260.3760 Fax From shane at time-travellers.org Fri Oct 5 02:55:04 2001 From: shane at time-travellers.org (Shane Kerr) Date: Fri, 5 Oct 2001 08:55:04 +0200 Subject: Bulk WHOIS access, was: Policy Proposal 2001-7 In-Reply-To: ; from lhoward@uu.net at 2001-10-01 10:44:40 -0400 References: Message-ID: <20011005085503.B26722@mars.lab.time-travellers.org> On 2001-10-01 10:44:40 -0400, Lee Howard wrote: > > Proposal: It is proposed ARIN provide a bulk copy of WHOIS output, > minus point of contact information, on the ARIN FTP site > for download by any organization that wishes to obtain the > data providing they agree to ARIN's acceptable use policy > that would accompany the data. > --- > > The only difference I see between the current practice and the > proposed policy is that access will not be limited to those conducting > research. Can anyone provide an example of a legitimate non-research > use for bulk WHOIS, or other rationale for this proposed policy? valid questions about public access to Whois data removed concern about Whois load removed Who could know? Running a mirror for speed? Investigating if any of your competitors is getting space unfairly? Building tables to be used in commercial products (IDS, firewalls,etc.)? Gathering evidence for a court case? In 1990 I probably wouldn't have thought of a legitmate use for putting hundreds of IP addresses on a single server, but people running hosting services need to do it every day. The point being that all because two dozen or so people actually paying attention to this discussion can't think of any "legitimate non-research use" doesn't means that there isn't any. I guess I'm not sure why you are opposed to somebody getting a list that consists of company name, IP address, DNS server lists, and assignment dates. Perhaps if you could clarify your concern...? -- Shane The opinions expressed here are not necessarily those of anyone else. From richardj at arin.net Fri Oct 5 03:27:19 2001 From: richardj at arin.net (Richard Jimmerson) Date: Fri, 5 Oct 2001 03:27:19 -0400 (EDT) Subject: RWHOIS proposal In-Reply-To: Message-ID: Hello Lee, Thank you for your comments. As you know the ARIN Board of Trustees is responsible for setting fee schedules. In that light, the ARIN staff will evaluate the points that you have raised in your proposal in order to inform the Board and ARIN members of any resource impacts that your proposal may have. We will place this item on the agenda for the Wednesday, October 31, Member meeting. Richard Jimmerson Director of Operations American Registry for Internet Numbers (ARIN) On Thu, 4 Oct 2001, Lee Howard wrote: > We've begun evaluating using RWHOIS. Among the advantages I see are > instant updates, local access control, restricted access for bulk > queries, privacy protection, and if I'm lucky, a chance to integrate > RWHOIS and IRR. > > The problems I'm having are that I will have to modify the code to > query an existing SQL database, change the output to RPSL, and cost- > justify the work to the business. I think ARIN can help me with the > last point. > > Presumably, organizations using RWHOIS create less work on ARIN's > resources, whether staff, servers, or bandwidth. In my point of view, > organizations who create more work for ARIN should pay more (e.g., > companies with multiple networks, each of which is considered > separately). A corollary to that would be that organizations who > generate less work for ARIN should pay less. > > I would like advice from ARIN staff on the proposition that RWHOIS > users require less work from them and their network and servers. If > that is the case, I would like to propose that organizations using > RWHOIS instead of SWIP be assessed lower annual fees. I ask for a > recommendation from ARIN of how much lower, proportional to the > reduced work. > > So, ultimately, if the membership agrees that RWHOIS is a Good Thing, > this would create an incentive for them to use it. If it creates less > work for ARIN, so much the better. > > Thanks, > > Lee Howard > > From lhoward at uu.net Fri Oct 5 09:15:15 2001 From: lhoward at uu.net (Lee Howard) Date: Fri, 5 Oct 2001 09:15:15 -0400 (EDT) Subject: Bulk WHOIS access, was: Policy Proposal 2001-7 In-Reply-To: <20011005085503.B26722@mars.lab.time-travellers.org> Message-ID: On Fri, 5 Oct 2001, Shane Kerr wrote: > Date: Fri, 5 Oct 2001 08:55:04 +0200 > From: Shane Kerr > To: Lee Howard > Cc: dbwg at arin.net > Subject: Bulk WHOIS access, was: Policy Proposal 2001-7 > > On 2001-10-01 10:44:40 -0400, Lee Howard wrote: > > > > Proposal: It is proposed ARIN provide a bulk copy of WHOIS output, > > minus point of contact information, on the ARIN FTP site > > for download by any organization that wishes to obtain the > > data providing they agree to ARIN's acceptable use policy > > that would accompany the data. > > --- > > > > The only difference I see between the current practice and the > > proposed policy is that access will not be limited to those conducting > > research. Can anyone provide an example of a legitimate non-research > > use for bulk WHOIS, or other rationale for this proposed policy? > > valid questions about public access to Whois data removed > concern about Whois load removed > > In 1990 I probably wouldn't have thought of a legitmate use for putting > hundreds of IP addresses on a single server, but people running hosting > services need to do it every day. The point being that all because two > dozen or so people actually paying attention to this discussion can't > think of any "legitimate non-research use" doesn't means that there > isn't any. Fair enough. I'm conservative--I don't like changing policy unless there's a reason to do so. > I guess I'm not sure why you are opposed to somebody getting a list that > consists of company name, IP address, DNS server lists, and assignment > dates. Perhaps if you could clarify your concern...? I don't object, I was really more interested in the reason for the policy change. I asked, "Why?" and you said, "Why not?" Go for it. > -- > Shane > The opinions expressed here are not necessarily those of anyone else. Heck, the opinions I express aren't always *mine* so you couldn't expect me to be representing anyone else. Lee From shane at time-travellers.org Tue Oct 9 06:16:54 2001 From: shane at time-travellers.org (Shane Kerr) Date: Tue, 9 Oct 2001 12:16:54 +0200 Subject: RWHOIS proposal In-Reply-To: ; from lhoward@uu.net at 2001-10-04 10:55:09 -0400 References: Message-ID: <20011009121653.C31159@mars.lab.time-travellers.org> On 2001-10-04 10:55:09 -0400, Lee Howard wrote: > We've begun evaluating using RWHOIS. Among the advantages I see are > instant updates, local access control, restricted access for bulk > queries, privacy protection, and if I'm lucky, a chance to integrate > RWHOIS and IRR. True, true. > The problems I'm having are that I will have to modify the code to > query an existing SQL database, change the output to RPSL, and cost- > justify the work to the business. I think ARIN can help me with the > last point. When you say "change the output to RPSL" do you mean making an RWHOIS schema that is also valid RPSL? I think this should be possible, as RWHOIS syntax is (mostly) a subset of RPSL. > So, ultimately, if the membership agrees that RWHOIS is a Good Thing, > this would create an incentive for them to use it. If it creates less > work for ARIN, so much the better. Does the membership agree RWHOIS is a Good Thing? IIRC, it was something that the IP registration office at InterNIC (then run by Network Solutions) had proposed and set up. Was there any community involvement or discussion before this? (There may have been, but it was not a member community the way ARIN is.) I agree less work for ARIN is a good thing, but there are disadvantages to a distributed database. Among these are: 1. No guarantee of data integrity. I consider this a real problem for RWHOIS data because there is some incentive for operators to provide a reduced subset of data, or even incorrect, information. With SWIP, ARIN has a record of all database changes so this kind of switcheraoo is impossible. 2. No guarantee of reliability. Unlike DNS, where it is in the interest of the administrator to keep the service running, with RWHOIS the only users that the administrator cares about are internal, customers, or ARIN staff. There is simply no incentive to produce a reliable public database by ISP's. ARIN, however, does have incentive to provide this database. Surely this is not an exhaustive list. There are, of course, advantages to RWHOIS, but personally I'd prefer a robust, user-friendly ARIN-run database to a distributed database. -- Shane Carpe Diem Any opinions expressed are not necessarily those of anyone else. From jiml at mrtg.noc.adelphia.net Tue Oct 9 08:42:05 2001 From: jiml at mrtg.noc.adelphia.net (James W. Laferriere) Date: Tue, 9 Oct 2001 08:42:05 -0400 (Eastern Daylight Time) Subject: RWHOIS proposal In-Reply-To: <20011009121653.C31159@mars.lab.time-travellers.org> Message-ID: Hello Shane On Tue, 9 Oct 2001, Shane Kerr wrote: > On 2001-10-04 10:55:09 -0400, Lee Howard wrote: ...snip... > > So, ultimately, if the membership agrees that RWHOIS is a Good Thing, > > this would create an incentive for them to use it. If it creates less > > work for ARIN, so much the better. > > Does the membership agree RWHOIS is a Good Thing? IIRC, it was > something that the IP registration office at InterNIC (then run by > Network Solutions) had proposed and set up. Was there any community > involvement or discussion before this? (There may have been, but it was > not a member community the way ARIN is.) I have recommended to my (ABS) representitive that a resounding 'Yes' should be reported . > I agree less work for ARIN is a good thing, but there are disadvantages > to a distributed database. Among these are: > > 1. No guarantee of data integrity. > I consider this a real problem for RWHOIS data because there is > some incentive for operators to provide a reduced subset of data, or > even incorrect, information. With SWIP, ARIN has a record of all > database changes so this kind of switcheraoo is impossible. And not sending in a SWIP is valid data ??? Too many providers (whether mis-informed or just lazy) are not reporting all or any data via swip or rwhoisd . At least with a rwhoisd there is a another tool they may use to provide -some- data to Arin/Ripe/Apnic/... & if by chance someone create(s/d) a nice browser front end and made it easy to use without a 2 step process (w/ integrity checking as well) rwhoisd could be just that much more easy to use . > 2. No guarantee of reliability. > Unlike DNS, where it is in the interest of the administrator to keep > the service running, with RWHOIS the only users that the > administrator cares about are internal, customers, or ARIN staff. > There is simply no incentive to produce a reliable public database > by ISP's. ARIN, however, does have incentive to provide this > database. Yup , $'s . Even if it is non-profit . That said , I am almost sure that very few if any providers would supply a accurate(*) database of their alloc's unless an agency such as Arin were about . (* = some definition of accurate) > Surely this is not an exhaustive list. There are, of course, advantages > to RWHOIS, but personally I'd prefer a robust, user-friendly ARIN-run > database to a distributed database. I have to semi-disagree . rwhoisd is just another tool in the never ending battle to allow the (arin/...) customer to interface with them . > -- > Shane > Carpe Diem > Any opinions expressed are not necessarily those of anyone else. James W. Laferriere Research Engineer jlaferriere at adelphia.net 814.260.3697 Voice 814.260.3760 Fax From lhoward at uu.net Tue Oct 9 09:45:43 2001 From: lhoward at uu.net (Lee Howard) Date: Tue, 9 Oct 2001 09:45:43 -0400 (EDT) Subject: RWHOIS proposal In-Reply-To: <20011009121653.C31159@mars.lab.time-travellers.org> Message-ID: On Tue, 9 Oct 2001, Shane Kerr wrote: > Date: Tue, 9 Oct 2001 12:16:54 +0200 > From: Shane Kerr > To: Lee Howard > Cc: dbwg at arin.net > Subject: Re: RWHOIS proposal > > On 2001-10-04 10:55:09 -0400, Lee Howard wrote: > > We've begun evaluating using RWHOIS. Among the advantages I see are > > instant updates, local access control, restricted access for bulk > > queries, privacy protection, and if I'm lucky, a chance to integrate > > RWHOIS and IRR. > > True, true. > > > The problems I'm having are that I will have to modify the code to > > query an existing SQL database, change the output to RPSL, and cost- > > justify the work to the business. I think ARIN can help me with the > > last point. > > When you say "change the output to RPSL" do you mean making an RWHOIS > schema that is also valid RPSL? I think this should be possible, as > RWHOIS syntax is (mostly) a subset of RPSL. Exactly. Should be nearly trivial, right? > > So, ultimately, if the membership agrees that RWHOIS is a Good Thing, > > this would create an incentive for them to use it. If it creates less > > work for ARIN, so much the better. > > Does the membership agree RWHOIS is a Good Thing? IIRC, it was > something that the IP registration office at InterNIC (then run by > Network Solutions) had proposed and set up. Was there any community > involvement or discussion before this? (There may have been, but it was > not a member community the way ARIN is.) RWHOIS has been a recurring topic at public policy meetings. Come to think of it, most of those discussions were after you left ARIN. There has been enough interest/support to keep the conversations going. > I agree less work for ARIN is a good thing, but there are disadvantages > to a distributed database. Among these are: > > 1. No guarantee of data integrity. > I consider this a real problem for RWHOIS data because there is > some incentive for operators to provide a reduced subset of data, or > even incorrect, information. With SWIP, ARIN has a record of all > database changes so this kind of switcheraoo is impossible. I think it's easier to provide accurate data (as accurate as our database of record) than false data. For false data, I'd have to have a database that doesn't reflect my database of record, then manually falsify data. There are guidelines as to what data should be presented. I honestly think that maintaining data on my own server is more likely to result in more accurate, current data than having it on ARIN's server. For example, say a customer calls our support line to give us updated contact information. If our hypothetical RWHOIS server is based on our database of record, RWHOIS is automatically updated. As it is, our level one support tech might or might not remember to modify the SWIP record. > 2. No guarantee of reliability. > Unlike DNS, where it is in the interest of the administrator to keep > the service running, with RWHOIS the only users that the > administrator cares about are internal, customers, or ARIN staff. > There is simply no incentive to produce a reliable public database > by ISP's. ARIN, however, does have incentive to provide this > database. Well, it has to be up at least once in a while, so ARIN staff can review the data to approve the next allocation. But I see your point. If an animald existed where a server functioned as both an RWHOIS server and a routing registry, the incentive is built in, since customer connectivity might be impaired by an IRRd failure. > Surely this is not an exhaustive list. There are, of course, advantages > to RWHOIS, but personally I'd prefer a robust, user-friendly ARIN-run > database to a distributed database. I'd also love to see universally-distributed whois clients capable of recursive lookups, a la DNS, to make RWHOIS more user-friendly. > -- > Shane > Carpe Diem > Any opinions expressed are not necessarily those of anyone else. Lee copy Shane's disclaimer From jiml at mrtg.noc.adelphia.net Tue Oct 9 10:40:22 2001 From: jiml at mrtg.noc.adelphia.net (James W. Laferriere) Date: Tue, 9 Oct 2001 10:40:22 -0400 (Eastern Daylight Time) Subject: To which mailing list to send Trouble reports for rwhois-client ? In-Reply-To: Message-ID: Hello All , The subject line says it all . JimL James W. Laferriere Research Engineer jlaferriere at adelphia.net 814.260.3697 Voice 814.260.3760 Fax From jiml at mrtg.noc.adelphia.net Tue Oct 9 11:10:42 2001 From: jiml at mrtg.noc.adelphia.net (James W. Laferriere) Date: Tue, 9 Oct 2001 11:10:42 -0400 (Eastern Daylight Time) Subject: To which mailing list to send Trouble reports for rwhois-client ? In-Reply-To: Message-ID: Hello All , Please ignore . :-} . Tia , JimL On Tue, 9 Oct 2001, James W. Laferriere wrote: > Hello All , The subject line says it all . JimL James W. Laferriere Research Engineer jlaferriere at adelphia.net 814.260.3697 Voice 814.260.3760 Fax From susanh at arin.net Fri Oct 12 16:10:49 2001 From: susanh at arin.net (Susan Hamlin) Date: Fri, 12 Oct 2001 16:10:49 -0400 Subject: No subject Message-ID: From susanh at arin.net Fri Oct 12 16:44:22 2001 From: susanh at arin.net (Susan Hamlin) Date: Fri, 12 Oct 2001 16:44:22 -0400 Subject: Apologies Message-ID: Sorry for the blank message sent a moment ago. I inadvertently hit send instead of delete while checking on the link in a new posting. Susan From jim.meck at erols.com Wed Oct 17 09:00:04 2001 From: jim.meck at erols.com (Jim Meck) Date: Wed, 17 Oct 2001 09:00:04 -0400 Subject: DBWG introduction Message-ID: <005301c1570b$a3d9c7e0$9001a8c0@mtgmry1.md.home.com> Greetings. General DBWG Items of Interest/Potential Contribution: - Customer data protection, vulnerability, privacy, competition impact - Data security, in transmission and at rest - GLBA, HIPAA regulatory compliance - Security policy capture, compliance, and enforcement mechanisms Specific Questions and Immediate concerns: 1. Is the DBWG email archive available/searchable? I suspect the majority, if not all, of my questions have already been raised, I simply need to know where to search. Is this strictly a mailing list or is there a news server as well? 2. My most pressing line of inquiry is in the area of vulnerability. I have grave concerns over the competitive impact relating to the unsecure submission and posting of customer information. For many in our DC client base, this is a non-starter. What solutions or waivers have been derived to address this issue? I appreciate the assistance. From ginny at arin.net Wed Oct 17 09:31:02 2001 From: ginny at arin.net (ginny listman) Date: Wed, 17 Oct 2001 09:31:02 -0400 (EDT) Subject: DBWG introduction In-Reply-To: <005301c1570b$a3d9c7e0$9001a8c0@mtgmry1.md.home.com> Message-ID: On Wed, 17 Oct 2001, Jim Meck wrote: > Greetings. > General DBWG Items of Interest/Potential Contribution: > - Customer data protection, vulnerability, privacy, competition impact > - Data security, in transmission and at rest > - GLBA, HIPAA regulatory compliance > - Security policy capture, compliance, and enforcement mechanisms > > Specific Questions and Immediate concerns: > 1. Is the DBWG email archive available/searchable? I suspect the majority, if > not all, of my questions have already been raised, I simply need to know where > to search. Is this strictly a mailing list or is there a news server as well? > The dbwg archives are located at: http://www.arin.net/mailinglists/dbwg/index.html However, the issues you have addressed have not be discussed. You should also visit the other ARIN archived lists to see what the community has been discussing, at: http://www.arin.net/members/mailing.htm Please feel free to bring up any topic you feel is relevant to the ARIN community on any of the public lists from this site. > 2. My most pressing line of inquiry is in the area of vulnerability. I have > grave concerns over the competitive impact relating to the unsecure submission > and posting of customer information. For many in our DC client base, this is a > non-starter. What solutions or waivers have been derived to address this issue? As far as posting customer information, ARIN does have a policy to accept "PRIVATE RESIDENCE" for those reassignments that need to be SWIP, but the information needs to remain private. However, if you are reassigning or reallocating IP space to a business where the technical contact is from the downstream we will require a valid address and POC. The critical piece of information is the POC, and can be used in the event that there are problems with the network. > > I appreciate the assistance. > Ginny Listman Director of Engineering American Registry for Internet Numbers (ARIN) From shane at time-travellers.org Thu Oct 18 05:40:32 2001 From: shane at time-travellers.org (Shane Kerr) Date: Thu, 18 Oct 2001 11:40:32 +0200 Subject: DBWG introduction In-Reply-To: <005301c1570b$a3d9c7e0$9001a8c0@mtgmry1.md.home.com>; from jim.meck@erols.com at 2001-10-17 09:00:04 -0400 References: <005301c1570b$a3d9c7e0$9001a8c0@mtgmry1.md.home.com> Message-ID: <20011018114031.D7996@mars.lab.time-travellers.org> On 2001-10-17 09:00:04 -0400, Jim Meck wrote: > Greetings. > General DBWG Items of Interest/Potential Contribution: > - Customer data protection, vulnerability, privacy, competition impact > - Data security, in transmission and at rest > - GLBA, HIPAA regulatory compliance > - Security policy capture, compliance, and enforcement mechanisms > 2. My most pressing line of inquiry is in the area of vulnerability. > I have grave concerns over the competitive impact relating to the > unsecure submission and posting of customer information. For many in > our DC client base, this is a non-starter. What solutions or waivers > have been derived to address this issue? While I find the "privacy" issues of the ARIN database somewhat interesting, this is an angle that I hadn't really considered a problem. What problems do you expect to find? Competitors cold-calling your customers based on contact information found in the Whois database? I can see that customers don't like having their information published in Whois, but since all ISP's ultimately have to get their space from ARIN (or another RIR), this shouldn't impact competition. Of course, sooner or later some state is going to make the information that ARIN requires illegal to ask for and/or publish. But that's the future, right? :P -- Shane Speaking only for myself, if even that. From barbara at gblx.net Thu Oct 18 11:57:50 2001 From: barbara at gblx.net (Barbara Roseman) Date: Thu, 18 Oct 2001 08:57:50 -0700 (MST) Subject: DBWG introduction In-Reply-To: <20011018114031.D7996@mars.lab.time-travellers.org> Message-ID: On Thu, 18 Oct 2001, Shane Kerr wrote: > On 2001-10-17 09:00:04 -0400, Jim Meck wrote: > > Greetings. > > General DBWG Items of Interest/Potential Contribution: > > - Customer data protection, vulnerability, privacy, competition impact > > - Data security, in transmission and at rest > > - GLBA, HIPAA regulatory compliance > > - Security policy capture, compliance, and enforcement mechanisms > > > > > 2. My most pressing line of inquiry is in the area of vulnerability. > > I have grave concerns over the competitive impact relating to the > > unsecure submission and posting of customer information. For many in > > our DC client base, this is a non-starter. What solutions or waivers > > have been derived to address this issue? > > While I find the "privacy" issues of the ARIN database somewhat > interesting, this is an angle that I hadn't really considered a problem. > What problems do you expect to find? Competitors cold-calling your > customers based on contact information found in the Whois database? > Yes, this has actually happened to me. I get calls and snail mail all the time from competitors to my current service (my company), especially because we've been in the financial news recently. Wouldn't happen if the information wasn't available. Competitors actively mine the swip archive for exactly this kind of information. -Barb --- Barbara Roseman Sr. Manager, FACT Global Crossing Office: +1 408-542-0147 Cell: +1 917-498-1677 broseman at gblx.net From barbara at gblx.net Thu Oct 18 15:18:33 2001 From: barbara at gblx.net (Barbara Roseman) Date: Thu, 18 Oct 2001 12:18:33 -0700 (MST) Subject: Privacy and Registration (fwd) Message-ID: Let me clarify my earlier reply: yes, I believe companies use the WHOIS db to find competitors' customers and solicit them, however I don't necessarily think this is a Bad Thing. I just wanted to point out that it does happen. I do think privacy options should be readily available for non-commercial end-users with residential connectivity and I don't think we do enough as a community to offer that option to our customers, but that is a different discussion. -Barb On Thu, 18 Oct 2001, Shane Kerr wrote: > On 2001-10-17 09:00:04 -0400, Jim Meck wrote: > > Greetings. > > General DBWG Items of Interest/Potential Contribution: > > - Customer data protection, vulnerability, privacy, competition impact > > - Data security, in transmission and at rest > > - GLBA, HIPAA regulatory compliance > > - Security policy capture, compliance, and enforcement mechanisms > > > > > 2. My most pressing line of inquiry is in the area of vulnerability. > > I have grave concerns over the competitive impact relating to the > > unsecure submission and posting of customer information. For many in > > our DC client base, this is a non-starter. What solutions or waivers > > have been derived to address this issue? > > While I find the "privacy" issues of the ARIN database somewhat > interesting, this is an angle that I hadn't really considered a problem. > What problems do you expect to find? Competitors cold-calling your > customers based on contact information found in the Whois database? > Yes, this has actually happened to me. I get calls and snail mail all the time from competitors to my current service (my company), especially because we've been in the financial news recently. Wouldn't happen if the information wasn't available. Competitors actively mine the swip archive for exactly this kind of information. -Barb --- Barbara Roseman Sr. Manager, FACT Global Crossing Office: +1 408-542-0147 Cell: +1 917-498-1677 broseman at gblx.net From richardj at arin.net Wed Oct 24 19:01:51 2001 From: richardj at arin.net (Richard Jimmerson) Date: Wed, 24 Oct 2001 19:01:51 -0400 (EDT) Subject: RWHOIS Discussed At NANOG 23 Message-ID: ARIN conducted an open microphone session at the NANOG 23 meeting this week in Oakland. One of the questions coming from the NANOG meeting attendees had to do with RWHOIS. A meeting attendee pointed out that all ISPs are required to report their reassignment information to ARIN via SWIP or RWHOIS. He further explained that implementing RWHOS for a large ISP has always been an issue in the past and that the code is very raw. He wanted to know if there were efforts underway to produce a more stable RWHOIS to reduce the implementation time for ISPs. ARIN explained that they were aware of this issue and that they were tasked to make improvements to RWHOIS at their last public policy meeting (April 2001). Since the last public policy meeting ARIN hired a developer to make the improvements and that there is currently a new beta available for testing. Attendees were asked to review the DBWG mailing list archives or to contact ARIN for more information about beta testing. Another meeting attendee observed that the code for RWHOIS is insufficient and that ARIN needs to refocus their effort. He encourage the other meeting attendees to get involved and give the developers at ARIN the requirements needed to develop RWHOIS to be more effective and easier to use. Following this discussion Global Crossing announced they are about to release an open source suite of tools used for address space management along with RWHOIS integration. Richard Jimmerson Director of Operations American Registry for Internet Numbers (ARIN) From ginny at arin.net Fri Oct 26 10:50:39 2001 From: ginny at arin.net (ginny listman) Date: Fri, 26 Oct 2001 10:50:39 -0400 (EDT) Subject: RWHOIS Bug Fix Message-ID: Regarding the recent vunerabilities discovered in the RWhois code, ARIN Engineering has released a patch. This patch can be found at: ftp://ftp.arin.net/pub/rwhois/rwhoisd-1.5.7-1.tar.gz Questions can be addressed to dbwg at arin.net Ginny Listman Director of Engineering ARIN From jiml at mrtg.noc.adelphia.net Fri Oct 26 12:22:50 2001 From: jiml at mrtg.noc.adelphia.net (James W. Laferriere) Date: Fri, 26 Oct 2001 12:22:50 -0400 (Eastern Daylight Time) Subject: RWHOIS Bug Fix In-Reply-To: Message-ID: Hello Ginny , I sure hope this is really 1.5.8 ? If not could someone also place a corrected 1.5.8 on te server ? Tia , JimL On Fri, 26 Oct 2001, ginny listman wrote: > Regarding the recent vunerabilities discovered in the RWhois code, ARIN > Engineering has released a patch. This patch can be found at: > > ftp://ftp.arin.net/pub/rwhois/rwhoisd-1.5.7-1.tar.gz > > Questions can be addressed to dbwg at arin.net > Ginny Listman > Director of Engineering > ARIN James W. Laferriere Research Engineer jlaferriere at adelphia.net 814.260.3697 Voice 814.260.3760 Fax From ginny at arin.net Fri Oct 26 12:44:48 2001 From: ginny at arin.net (ginny listman) Date: Fri, 26 Oct 2001 12:44:48 -0400 (EDT) Subject: RWHOIS Bug Fix In-Reply-To: Message-ID: Since 1.5.8 is still in testing, we decided to patch 1.5.7, the current production version. We will get to 1.5.8 sometime next week. Ginny On Fri, 26 Oct 2001, James W. Laferriere wrote: > > Hello Ginny , I sure hope this is really 1.5.8 ? If not could > someone also place a corrected 1.5.8 on te server ? Tia , JimL > > On Fri, 26 Oct 2001, ginny listman wrote: > > Regarding the recent vunerabilities discovered in the RWhois code, ARIN > > Engineering has released a patch. This patch can be found at: > > > > ftp://ftp.arin.net/pub/rwhois/rwhoisd-1.5.7-1.tar.gz > > > > Questions can be addressed to dbwg at arin.net > > Ginny Listman > > Director of Engineering > > ARIN > James W. Laferriere > Research Engineer > jlaferriere at adelphia.net > 814.260.3697 Voice > 814.260.3760 Fax >