[ARIN-consult] Consultation on ARIN Online Change Notifications

[Dale W. Carder]

Thus spake ARIN (info at arin.net) on Mon, Aug 26, 2024 at 11:19:33AM -0400:
> ARIN is seeking feedback from the community on a potential improvement (https://www.arin.net/participate/community/acsp/consultations/2024/2024-4/), suggested by a community member, that ARIN create a modern mechanism that allows resource holders to be notified of any changes to resources or accounts they manage. 
> 
> The stated benefit of this potential improvement is that it would allow greater control over valuable resources and increase the accuracy of ARIN´s database. 

There would be additional security and change-management benefits
as well, as I see was somewhat outlined as motivating factors in
ACSP 2024.11.
 
> We have identified two options to create these notifications: 
> 
> Email - The least "modern" option, but this would be consistent with other ARIN notifications, and mirrors what is available through the other Regional Internet Registries (RIRs). This would take approximately three months to develop once work is scheduled.  

This also mirrors what is available from some non-authoritative IRR 
offerings as well.

I agree email is hardly modern, but it may be the current state of affairs 
that NOC operations / security / abuse / hostmaster type stuff is already
used to handling and for which processes already exist or could be
easily developed.

Like those roles above which are often separate at some Orgs, this new
email notification type should allow specification of an individual or 
role that might be dedicated for this use.  For example, we might set up
an email role where on our end that would go into a dedicated ticket queue
which would minimally log such actions from a change management
perspective or potentially be reviewed / trigger a security audit.
 
> REST endpoint - ARIN can define a REST endpoint, and customers would have to develop/deploy and then provide us the URL to send notifications to. This would take approximately six months to develop once work is scheduled.  

This does sound modern!  I would not want to discount those who have the
operations scale and capability to make use of it.  For Orgs not of that
scale, unless this was a capability already baked into shrinkwrap
operations offerings I would doubt folks would realistically develop and
support this in-house.
 
> These options vary in complexity to develop, and the level of effort required for customer adoption. We are interested in community feedback on the value of a change notification feature and thoughts on the possible delivery methods described or others you may suggest. 
> 
> Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at https://lists.arin.net/mailman/listinfo/arin-consult 
> 
> This consultation will remain open until 5:00 PM ET on 9 September. ARIN seeks clear direction through community input, so your feedback is important. 
> 
> Thank you for your continued support to improve ARIN's services. 

Thanks for the consultation!

Dale

--
Dale W. Carder
Energy Sciences Network (ESnet)
Lawrence Berkeley National Laboratory
U.S. Department of Energy