From jcurran at arin.net  Mon Mar  1 10:00:46 2021
From: jcurran at arin.net (John Curran)
Date: Mon, 1 Mar 2021 15:00:46 +0000
Subject: [ARIN-consult] 
 =?utf-8?q?Consultation_Now_Open_on_the_Future_of_?=
 =?utf-8?b?QVJJTuKAmXMgSVJS?=
In-Reply-To: <95DCBEB6-4124-4D35-86C4-1FBC11A3D148@seastrom.com>
References: <7FD68972-E36B-4AA0-B76F-A2BA4F8344EE@arin.net>
 <1B7F88F3-B359-42A2-9EF8-C4164C6E4B97@arin.net>
 <mailman.1176.1612802077.8317.arin-consult@arin.net>
 <43DC34D8-99EE-47DE-BB48-681E4823BDFA@delong.com>
 <95DCBEB6-4124-4D35-86C4-1FBC11A3D148@seastrom.com>
Message-ID: <4FCB5A09-7CED-480B-9DC3-BAB8C1B1367D@arin.net>

On 12 Feb 2021, at 2:54 PM, Rob Seastrom <rs at seastrom.com<mailto:rs at seastrom.com>> wrote:

I urge that Job's thoughts for orderly burndown be given heavy consideration.  Upon further discussion with Job I have the following points to make:

* Of the total of 62,352 entries in ARIN-NONAUTH about 10k of those routes show up in the DFZ and about 1,933 are rpki invalid.
...
RIPE has had over a year of operational experience with RIPE-731 deployed to remove RPKI-invalid routes from their non-auth (since January 2020) and nothing has blown up...  so maybe we can start by doing the same thing.  If you haven't read RIPE-731, please do - it's short and to the point.  https://www.ripe.net/publications/docs/ripe-731

RS -

Presuming RIPE-731 deployment and per your data above, we would presumably see removal of approximately two thousand of the 10K routes in the DFZ which correspond to ARIN-NONAUTH objects - is that correct?  If that?s the case, once the conflicting ARIN-NONAUTH objects were deleted, how does that affect the necessary wait time for a full shutdown of ARIN-NONAUTH?

You suggested that if ARIN does an aggressive outreach campaign and then waited a full year to ?pull the plug? that might be reasonable - my question is whether your suggestion for a one wait period changes to a date substantially sooner if RIPE-731 style IRR object grooming is also utilized?

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-consult/attachments/20210301/0d603f92/attachment.htm>

From job at fastly.com  Mon Mar  1 12:05:45 2021
From: job at fastly.com (Job Snijders)
Date: Mon, 1 Mar 2021 18:05:45 +0100
Subject: [ARIN-consult] =?utf-8?Q?Consultation_?=
 =?utf-8?Q?Now_Open_on_the_Future_of_ARIN=E2=80=99s?= IRR
In-Reply-To: <4FCB5A09-7CED-480B-9DC3-BAB8C1B1367D@arin.net>
References: <7FD68972-E36B-4AA0-B76F-A2BA4F8344EE@arin.net>
 <1B7F88F3-B359-42A2-9EF8-C4164C6E4B97@arin.net>
 <mailman.1176.1612802077.8317.arin-consult@arin.net>
 <43DC34D8-99EE-47DE-BB48-681E4823BDFA@delong.com>
 <95DCBEB6-4124-4D35-86C4-1FBC11A3D148@seastrom.com>
 <4FCB5A09-7CED-480B-9DC3-BAB8C1B1367D@arin.net>
Message-ID: <YD0e6UEBIC8BGa4k@snel>

On Mon, Mar 01, 2021 at 03:00:46PM +0000, John Curran wrote:
> On 12 Feb 2021, at 2:54 PM, Rob Seastrom
> <rs at seastrom.com<mailto:rs at seastrom.com>> wrote:
> 
> > I urge that Job's thoughts for orderly burndown be given heavy
> > consideration.  Upon further discussion with Job I have the
> > following points to make:
> 
>>  * Of the total of 62,352 entries in ARIN-NONAUTH about 10k of those
>>  routes show up in the DFZ and about 1,933 are rpki invalid.  ...
>>  RIPE has had over a year of operational experience with RIPE-731
>>  deployed to remove RPKI-invalid routes from their non-auth (since
>>  January 2020) and nothing has blown up...  so maybe we can start by
>>  doing the same thing.  If you haven't read RIPE-731, please do -
>>  it's short and to the point.
>>  https://www.ripe.net/publications/docs/ripe-731
>> 
>> RS -
> 
> Presuming RIPE-731 deployment and per your data above, we would
> presumably see removal of approximately two thousand of the 10K routes
> in the DFZ which correspond to ARIN-NONAUTH objects - is that correct?
> If that?s the case, once the conflicting ARIN-NONAUTH objects were
> deleted, how does that affect the necessary wait time for a full
> shutdown of ARIN-NONAUTH?

The 10K and 2K are disjoint sets. The 2K was brought up as it is the
lowest hanging fruit, the first step really, towards cleaning up the
source.

In order to shut down ARIN-NONAUTH, one has to *first* perform clean-up,
and after multiple clean-up steps (at each step trying to measure
impact), the community will have clear visiblity into what still is in
ARIN-NONAUTH and what its importance is.

> You suggested that if ARIN does an aggressive outreach campaign and
> then waited a full year to ?pull the plug? that might be reasonable -
> my question is whether your suggestion for a one wait period changes
> to a date substantially sooner if RIPE-731 style IRR object grooming
> is also utilized?

That is not what is being suggested. Waiting a full year still is an
incredibly aggressive timeline which to me doesn't seem warranted.

I would appreciate if ARIN takes their feet off the gaspedal on this
project. ARIN would do well to perform an 'impact analysis' and share
their conclusions with the community before proceeding. Use Routeviews,
use IRR data from other registries, intersect those with each other...
this is the same work I've been doing.

The answer to "can we just delete all of ARIN-NONAUTH?" is a firm "NO!".

The answer to "can we delete stale & invalid bits and pieces from
ARIN-NONAUTH?" is "yes... but lets talk about methodology, go/nogo
criteria, community communication, timelines..."

Kind regards,

Job


From jcurran at arin.net  Mon Mar  1 12:43:36 2021
From: jcurran at arin.net (John Curran)
Date: Mon, 1 Mar 2021 17:43:36 +0000
Subject: [ARIN-consult] 
 =?utf-8?q?Consultation_Now_Open_on_the_Future_of_?=
 =?utf-8?b?QVJJTuKAmXMgSVJS?=
In-Reply-To: <YD0e6UEBIC8BGa4k@snel>
References: <7FD68972-E36B-4AA0-B76F-A2BA4F8344EE@arin.net>
 <1B7F88F3-B359-42A2-9EF8-C4164C6E4B97@arin.net>
 <mailman.1176.1612802077.8317.arin-consult@arin.net>
 <43DC34D8-99EE-47DE-BB48-681E4823BDFA@delong.com>
 <95DCBEB6-4124-4D35-86C4-1FBC11A3D148@seastrom.com>
 <4FCB5A09-7CED-480B-9DC3-BAB8C1B1367D@arin.net> <YD0e6UEBIC8BGa4k@snel>
Message-ID: <4ADB24DF-CAE8-40FE-92F1-7CD4BC663EBD@arin.net>

On 1 Mar 2021, at 12:05 PM, Job Snijders <job at fastly.com> wrote:
> 
> On Mon, Mar 01, 2021 at 03:00:46PM +0000, John Curran wrote:
>> On 12 Feb 2021, at 2:54 PM, Rob Seastrom
>> <rs at seastrom.com<mailto:rs at seastrom.com>> wrote:
>> 
>>> I urge that Job's thoughts for orderly burndown be given heavy
>>> consideration.  Upon further discussion with Job I have the
>>> following points to make:
>> 
>>> * Of the total of 62,352 entries in ARIN-NONAUTH about 10k of those
>>> routes show up in the DFZ and about 1,933 are rpki invalid.  ? 
>> Presuming RIPE-731 deployment and per your data above, we would
>> presumably see removal of approximately two thousand of the 10K routes
>> in the DFZ which correspond to ARIN-NONAUTH objects - is that correct?
>> If that?s the case, once the conflicting ARIN-NONAUTH objects were
>> deleted, how does that affect the necessary wait time for a full
>> shutdown of ARIN-NONAUTH?
> 
> The 10K and 2K are disjoint sets. The 2K was brought up as it is the
> lowest hanging fruit, the first step really, towards cleaning up the
> source.

Acknowledged,

I was trying to figure out the merits of focusing on that portion of ARIN-NONAUTH which should be deleted (due to being overtaken by valid ROAs) rather than the portion which actually is present in the DFZ.  

> In order to shut down ARIN-NONAUTH, one has to *first* perform clean-up,
> and after multiple clean-up steps (at each step trying to measure
> impact), the community will have clear visiblity into what still is in
> ARIN-NONAUTH and what its importance is.

That?s certainly one approach - taking that which is known invalid and removing it, and continuing that process until there is a small amount of relevant data left.  

There is also the approach of focusing on what is relevant and operational today and working to migrate those entries elsewhere. 

It is not inevitable that one approach must be done before the other, but rather the priority should depend to a great extent on how much is known relevant, known invalid, and those ratios to the entire corpus. 

> That is not what is being suggested. Waiting a full year still is an
> incredibly aggressive timeline which to me doesn't seem warranted.
> 
> I would appreciate if ARIN takes their feet off the gaspedal on this
> project. ARIN would do well to perform an 'impact analysis' and share
> their conclusions with the community before proceeding. Use Routeviews,
> use IRR data from other registries, intersect those with each other...
> this is the same work I've been doing.

An excellent suggestion - well worth considering, particularly given the relatively modest amount on ARIN-NONAUTH entries germane to the DFZ. 

Thanks for the feedback!
/John

John Curran
President and CEO
American Registry for Internet Numbers






From info at arin.net  Mon Mar  1 13:21:15 2021
From: info at arin.net (ARIN)
Date: Mon, 01 Mar 2021 13:21:15 -0500
Subject: [ARIN-consult] =?utf-8?q?Reminder_-_Consultation_on_the_Future_o?=
 =?utf-8?q?f_ARIN=E2=80=99s__Unauthenticated_IRR_Closes_8_March?=
Message-ID: <7F29EBF5-0C18-4416-818A-3B1259AB2CEE@arin.net>

The community feedback provided during this consultation will help inform how we move forward. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at:

http://lists.arin.net/mailman/listinfo/arin-consult

This consultation will remain open through 5:00 PM ET on Monday, 8 March.

***

ARIN has been engaged in a multi-year project to create and deploy a new and improved Internet Routing Registry (IRR). On 10 June 2020 (https://www.arin.net/announcements/20200610-irr/), we launched IRR-online, an authenticated and web-based service designed to make it simple for users to publish routing information via ARIN?s website. At that time, the existing IRR-email system was temporarily left in place to allow organizations to continue using email-based updates to publish routing information (in the ARIN-NONAUTH data stream).

On 1 February 2021 (https://www.arin.net/announcements/20210201-rn/), we deployed a RESTful API to provide a way to securely automate updates to objects in ARIN?s authenticated IRR service.

With the availability of automation for ARIN?s new IRR system, we intend to retire ARIN?s previous non-authenticated, email-based IRR service at the end of September 2021. We are providing advance notice of this plan so that organizations using the non-authenticated and email-based IRR will have time to switch publication of their routing registry information to a more current solution. Similarly, by establishing a firm end date for the non-authenticated and email-based IRR, organizations making use of the outdated and non-authenticated IRR data stream can be ready for when ARIN ceases publishing the ARIN-NONAUTH data stream.

The authenticated IRR is available to all ARIN resource holders that have resources covered by a signed Registration Services Agreement (RSA) or Legacy Registration Services Agreement (LRSA). Organizations with resources not currently under an RSA/LRSA that wish to use the authenticated IRR may contact ARIN?s Registration Services Department for assistance with bringing those registrations under an RSA/LRSA.

We recognize that this change will have significant impacts on our customers and, as always, we?re interested in your feedback regarding this proposed transition. In particular, we would appreciate hearing from the ARIN community regarding these aspects of the proposed transition:

1. For those using ARIN?s email-based and non-authenticated IRR system, does the proposed shutdown date of 30 September 2021 provide sufficient time for migration to another IRR system?
2. For those making use of the ARIN-NONAUTH data stream, is there any reason to provide this information beyond the system shutdown date?

Regards,

John Curran
President and CEO
American Registry for Internet Numbers (ARIN)




From job at fastly.com  Mon Mar  1 13:28:21 2021
From: job at fastly.com (Job Snijders)
Date: Mon, 1 Mar 2021 19:28:21 +0100
Subject: [ARIN-consult] =?utf-8?Q?Consultation_?=
 =?utf-8?Q?Now_Open_on_the_Future_of_ARIN=E2=80=99s?= IRR
In-Reply-To: <4ADB24DF-CAE8-40FE-92F1-7CD4BC663EBD@arin.net>
References: <7FD68972-E36B-4AA0-B76F-A2BA4F8344EE@arin.net>
 <1B7F88F3-B359-42A2-9EF8-C4164C6E4B97@arin.net>
 <mailman.1176.1612802077.8317.arin-consult@arin.net>
 <43DC34D8-99EE-47DE-BB48-681E4823BDFA@delong.com>
 <95DCBEB6-4124-4D35-86C4-1FBC11A3D148@seastrom.com>
 <4FCB5A09-7CED-480B-9DC3-BAB8C1B1367D@arin.net>
 <YD0e6UEBIC8BGa4k@snel>
 <4ADB24DF-CAE8-40FE-92F1-7CD4BC663EBD@arin.net>
Message-ID: <YD0yRa2kfn1GVPhB@snel>

Dear John,

On Mon, Mar 01, 2021 at 05:43:36PM +0000, John Curran wrote:
> That?s certainly one approach - taking that which is known invalid and
> removing it, and continuing that process until there is a small amount
> of relevant data left.  
> 
> There is also the approach of focusing on what is relevant and
> operational today and working to migrate those entries elsewhere. 
> 
> It is not inevitable that one approach must be done before the other,
> but rather the priority should depend to a great extent on how much is
> known relevant, known invalid, and those ratios to the entire corpus. 

Right, I would caution against 'running all these mechanisms in
parallel'. I recommend to start with RPKI RIPE-731 mechanism as that is
the most obvious (and modest sized) 'invalid' pruning mechanism. Then
based on the RPKI pruning experience, deploy the other pruning
mechanisms.

Trying one method before trying all methods has as advantage that ARIN
learns about how to inform stakeholders, what questions come back,
how/where to provide documentation, how to 'notify' -> 'wait' ->
'delete' and roll back when needed, etc. The suggestion to break it up
into discrete steps really is to pave the way to make the subsequent
pruning operations (in parallel) more efficient.
 
Pruning method #1: RPKI based

    The hope is that as more and more INR holders create RPKI ROAs, less and
    less data exists in ARIN-NONAUTH, as more and more gets removed
    (following the RIPE-731 process).

    If the RIPE-731 process is applied today, it would prune ~ 2,000
    objects, but with each and every community outreach campaign (under
    any Trust Anchor) to get RPKI ROAs created, chances are a few more
    objects in ARIN-NONAUTH become invalid and can be automatically
    deleted.

Pruning method #2: 'not seen in BGP MRT routeviews data in X years'

    An argument can be made that any IRR object referencing IP address
    destinations (as route/route6 object), which have never or X number
    of years not been observed in the BGP DFZ / routeviews, they were
    created in error and should be deleted.

    I didn't calculate how many objects would be effected by this
    method.

Pruning method #3: 'an exact matching copy exists in another IRRdb'

    An argument can be made that if a functionally equivalent copy
    exists in another IRR database, the copy in ARIN-NONAUTH does not
    need to exist.

    Any objects that has an equivalent exact matching object in another
    IRRdb (exact matching primary keys, I don't care about
    remarks/descr) can be deleted.

Pruning method #4: '.....????'

I'm happy to participate in meetings where we come up with more
'pruning' mechanisms to reduce the size of ARIN-NONAUTH.

> > That is not what is being suggested. Waiting a full year still is an
> > incredibly aggressive timeline which to me doesn't seem warranted.
> > 
> > I would appreciate if ARIN takes their feet off the gaspedal on this
> > project. ARIN would do well to perform an 'impact analysis' and share
> > their conclusions with the community before proceeding. Use Routeviews,
> > use IRR data from other registries, intersect those with each other...
> > this is the same work I've been doing.
> 
> An excellent suggestion - well worth considering, particularly given
> the relatively modest amount on ARIN-NONAUTH entries germane to the
> DFZ. 

Doing this type of legwork 'this is what we took as inputs, our
cross-referencing procedures were like so and so, and this therefor we
think we can safely delete all objects matching XYZ in ARIN-NONAUTH'
will go a long way to demonstrate to the community a deep understanding
on how to responsibily prune IRR data at scale.

Since method #1 is applied in RIPE-NONAUTH already today (with success),
I imagine that ARIN can quite easily get to that level as well. From
there ARIN could be first to explore method #2 and method #3, which in
turn might inspire the RIPE community to also apply those pruning
mechanisms to RIPE-NONAUTH.

Kind regards,

Job


From jsweeting at arin.net  Mon Mar  1 19:56:44 2021
From: jsweeting at arin.net (John Sweeting)
Date: Tue, 2 Mar 2021 00:56:44 +0000
Subject: [ARIN-consult] 
 =?utf-8?q?Reminder_-_Consultation_on_the_Future_o?=
 =?utf-8?q?f_ARIN=E2=80=99s__Unauthenticated_IRR_Closes_8_March?=
In-Reply-To: <7F29EBF5-0C18-4416-818A-3B1259AB2CEE@arin.net>
References: <7F29EBF5-0C18-4416-818A-3B1259AB2CEE@arin.net>
Message-ID: <5E7773FE-0F93-421C-8613-E634054D19AE@arin.net>

ARIN Community,
 
Here are some interesting statistics reference the ARIN NONAUTH IRR and courses of action ARIN is taking:
 
Total NONAUTH Objects: 64,632 (63,424 route, 956 Aut-num, 139 As-set, 113 Route-set)
 
Of that total 20,488 objects (31.7%) are from organizations with no agreement with ARIN (legacy resources). The simplistic way to fix these are for those organizations to sign an agreement with ARIN (LSRA/RSA). This would immediately move these to ARIN AUTH on the next migration. The other simple solution is to move them to an alternate IRR other than ARIN.
 
That would leave 44,144 NONAUTH objects.
 
Of that total 5,611 are from a registry other than ARIN. These objects need to be registered in the IRR of the RIR that manages them or to an alternate IRR other than ARIN.
 
That leaves us at 38,533.
 
Of that total ~32,000 are proxy registration by the real holder?s upstream ISP. This is a bit trickier but ARIN plans to work with each of these ISPs to help them educate their customers on how to build their own objects in the ARIN AUTH IRR. Since these are already ARIN resources assigned to holders under an agreement ARIN will work with them to help them generate the correct objects.
 
That leaves us with around 6,500 objects that we need to research further in order to identify the solutions. It could be that most of these just no longer have any network existing in the ARIN database and can simply be deleted.
 
ARIN is currently working these solutions with our customers and plan to continue this work.

Please continue to provide your thoughts and concerns so that ARIN can put together a plan to get us where we need to be on this. 

Thanks,

John Sweeting
Chief Customer Officer, ARIN

?On 3/1/21, 1:21 PM, "ARIN-consult on behalf of ARIN" <arin-consult-bounces at arin.net on behalf of info at arin.net> wrote:

    The community feedback provided during this consultation will help inform how we move forward. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at:

    http://lists.arin.net/mailman/listinfo/arin-consult

    This consultation will remain open through 5:00 PM ET on Monday, 8 March.

    ***

    ARIN has been engaged in a multi-year project to create and deploy a new and improved Internet Routing Registry (IRR). On 10 June 2020 (https://www.arin.net/announcements/20200610-irr/), we launched IRR-online, an authenticated and web-based service designed to make it simple for users to publish routing information via ARIN?s website. At that time, the existing IRR-email system was temporarily left in place to allow organizations to continue using email-based updates to publish routing information (in the ARIN-NONAUTH data stream).

    On 1 February 2021 (https://www.arin.net/announcements/20210201-rn/), we deployed a RESTful API to provide a way to securely automate updates to objects in ARIN?s authenticated IRR service.

    With the availability of automation for ARIN?s new IRR system, we intend to retire ARIN?s previous non-authenticated, email-based IRR service at the end of September 2021. We are providing advance notice of this plan so that organizations using the non-authenticated and email-based IRR will have time to switch publication of their routing registry information to a more current solution. Similarly, by establishing a firm end date for the non-authenticated and email-based IRR, organizations making use of the outdated and non-authenticated IRR data stream can be ready for when ARIN ceases publishing the ARIN-NONAUTH data stream.

    The authenticated IRR is available to all ARIN resource holders that have resources covered by a signed Registration Services Agreement (RSA) or Legacy Registration Services Agreement (LRSA). Organizations with resources not currently under an RSA/LRSA that wish to use the authenticated IRR may contact ARIN?s Registration Services Department for assistance with bringing those registrations under an RSA/LRSA.

    We recognize that this change will have significant impacts on our customers and, as always, we?re interested in your feedback regarding this proposed transition. In particular, we would appreciate hearing from the ARIN community regarding these aspects of the proposed transition:

    1. For those using ARIN?s email-based and non-authenticated IRR system, does the proposed shutdown date of 30 September 2021 provide sufficient time for migration to another IRR system?
    2. For those making use of the ARIN-NONAUTH data stream, is there any reason to provide this information beyond the system shutdown date?

    Regards,

    John Curran
    President and CEO
    American Registry for Internet Numbers (ARIN)


    _______________________________________________
    ARIN-Consult
    You are receiving this message because you are subscribed to the ARIN Consult Mailing
    List (ARIN-consult at arin.net).
    Unsubscribe or manage your mailing list subscription at:
    https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services
    Help Desk at info at arin.net if you experience any issues.


From info at arin.net  Tue Mar  9 15:00:37 2021
From: info at arin.net (ARIN)
Date: Tue, 09 Mar 2021 15:00:37 -0500
Subject: [ARIN-consult] =?utf-8?q?Reminder_=E2=80=93_Consultation_on_Pass?=
 =?utf-8?q?word_Security_for_ARIN_Online_Accounts_Closes_16_March?=
Message-ID: <AE6CBFAE-EF9A-4727-B8DE-FEED4702FEFA@arin.net>

The community feedback provided during this consultation will help inform how we move forward. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at:

http://lists.arin.net/mailman/listinfo/arin-consult

This consultation will remain open through 5:00 PM ET on Tuesday, 16 March.

***

Since October 2020, the ARIN Online system has been subject to a series of dictionary-based password guessing attacks. Because of the protective measures currently in place, some customer accounts were locked during these attacks.  ARIN staff has been heavily engaged in mitigating these attacks, and we are seeking community feedback on potential steps ARIN can take to reduce the risk of future attacks and to help customers ensure they are using strong passwords. Password dictionary guessing attacks continue to be a problem in the industry, and this effort should help reduce the extent of previously exposed passwords for our ARIN Online user base.

Password Check Proposal

To help ARIN customers make sure they aren?t using a password that has been exposed and shared publicly online, when someone updates their password or creates a user account in ARIN Online, it is proposed that ARIN should check the database "haveibeenpwned (https://haveibeenpwned.com)" to see if they are trying to use a password that has been compromised. ARIN will not send the password, but rather we encrypt the password and send part of the encrypted password to the Have I been Pwned (HIBP) Service (https://haveibeenpwned.com/API/v3#PwnedPasswords) to see if it matches a compromised password.  Actual passwords are never sent or used in any query, nor is your user ID or email shared as part of this check.

How would it work?

1.	A user enters a password during Account Setup, Password Change, Password Reset or User Login in ARIN Online. 
2.	ARIN encrypts the password and sends part of the encrypted password to the Have I been Pwned (HIBP) Service (https://haveibeenpwned.com/API/v3#PwnedPasswords) and returns all possible matches in their database. (Your actual password is never sent or used in any query.) 
3.	We compare the full encrypted password to the results sent by HIBP to see if there is a match.
4.	If there is a match we will notify the customer.

Optional Outcomes

We are interested in the community?s thoughts on the possible outcomes when we identify a password that has been exposed in a data breach according to the HIBP service. There are three options:

1.	Issue a caution message but allow the password.
2.	Issue a warning message and notify the customer that they need to change their password within a defined time period, but not at the current point of login.
3.	Issue warning message that requires the customer to select and set a different password immediately.

The feedback you provide during this consultation will help inform how we move forward to increase security of ARIN Online for all customers. Thank you for your participation in the ARIN Consultation and Suggestion Process. 

Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at:

http://lists.arin.net/mailman/listinfo/arin-consult

This consultation will remain open through 5:00 PM ET on 16 March 2021. 

Regards,

John Curran  
President and CEO  
American Registry for Internet Numbers (ARIN)




From info at arin.net  Mon Mar 15 16:27:04 2021
From: info at arin.net (ARIN)
Date: Mon, 15 Mar 2021 16:27:04 -0400
Subject: [ARIN-consult] =?utf-8?q?ACSP_Consultation_2021=2E1=3A_Future_of?=
 =?utf-8?q?_ARIN=E2=80=99s__Unauthenticated_IRR_is_now_Closed?=
Message-ID: <0D6C7827-2351-487B-95D7-5D47E5BEED51@arin.net>

I would like to thank everyone who provided valuable feedback during this consultation on the future of ARIN?s unauthenticated IRR. Input provided by the community is a vital part of our planning processes at ARIN, and after reviewing responses to the consultation, we are making a few significant adjustments in our path forward.

One concern raised during the consultation was that six months was not enough time for organizations that currently depend on data in ARIN?s unauthenticated IRR to make changes to their systems. As a result, we will be extending the availability of ARIN?s non-authenticated IRR for an additional six months with final retirement set for 31 March 2022.

The second major suggestion was that ARIN conduct proactive engagement to notifying customers who currently use our unauthenticated IRR. We have already initiated this outreach, and for the next twelve months, we will continue this direct outreach to customers who have records in ARIN?s non-authenticated IRR to inform them of their options and provide necessary assistance. 

We will also provide regular reminders and updates to our community and organizations making use of the outdated and non-authenticated IRR data stream so they can be ready for when we cease publishing the ARIN-NONAUTH data stream. These reminders leading up to the retirement of ARIN?s non-authenticated IRR will include statistics on the number of records remaining in that system and related routing coverage.  

Thank you again to those who provided valuable feedback on this consultation.

Regards,

John Curran
President and CEO
American Registry for Internet Numbers