[ARIN-consult] Consultation on the Future of ARIN’s Directory Services (Updated)

[Adam Thompson]

TL;DR - Port 43 is the most-used service yet ARIN wants to kill it off: that's either dumb or bad.


Finally getting back to this, I stand by my previous comments:

Port 43 WHOIS usage is baked into many thousands of tools, systems and workflows worldwide, many (most?) of which can never feasibly be updated, requiring complete replacement instead.  (Is this a terrible way to get data programmatically?  Probably, but it's still being done.)

While a 2+ year sunset period sounds like a lengthy period at first glance, ARIN - and, I suspect, any human agency - lacks the communication channels to reach out and retroactively update textbooks, HOWTO guides, nearly all the cybersecurity training material ever produced, scripts we all wrote three employers ago, etc., etc.  (Sadly, you can't retroactively prevent people from using the wrong tool...)

Having "been there, done that" in the legacy software support world, I understand the desire to reduce the support burden, the attack surface, the complexity, etc., but I still believe that ARIN is grossly underestimating, or choosing to not care about, the amount of collateral damage shutting down the legacy port 43 service will cause.  This is the service that people *who don't even know what ARIN is*, who don't even know that alternatives exist, use - how are you going to retrain them all?

The human timeframe for changing workflows and habits is measured in years, not months - two decades would be a much less harmful timeline than two years.

Re: "...ARIN will engage in active outreach to users" - how?  Are you putting a text banner at the top and bottom of every WHOIS result?  Appending "(this service will be retired soon, see https://www.arin.net/whois-retirement for details)" to every line of the result?  Take out full-page ads in every newspaper?  In today's hyper-connected world, we ironically have no good global news distribution mechanism, and since the overwhelming majority of WHOIS users don't participate in any ARIN discussions (we know this simply by looking at the # of subscribers vs. the # of queries), I'm not confident ARIN can or will reach port-43 WHOIS users with the news it's going away.

Discontinuing port 43 WHOIS service without a direct replacement feels like an abrogation of ARIN's stewardship duty towards access to registry data.

Per my previous comment, I think it would be very useful to see the query type breakdown - my suspicion is that 99+% of all queries are "simple" bare-word queries, and that could potentially be re-implemented with a fairly simple wrapper without a massive effort.

***
John et al. - please elaborate further on how, exactly, you plan to communicate the upcoming shutdown to port 43 users.
***

-Adam

Adam Thompson
Consultant, Infrastructure Services
MERLIN
100 - 135 Innovation Drive
Winnipeg, MB R3T 6A8
(204) 977-6824 or 1-800-430-6404 (MB only)
💻https://www.merlin.mb.ca
🤳Follow MERLIN on Social Media

> -----Original Message-----
[...]
> ARIN understands that Whois (Port 43) carries a high volume of queries and
> will require the longest timeline to retire. We propose a two-year
> sunsetting window, during which ARIN will engage in active outreach to
> users. This will include updates to Whois (Port 43) results during the
> sunsetting period that will contain information about the retirement
> deadline.
> 
> Because Whois (Port 43) has been the historically preferred method of
> querying Internet number resource registration data, it remains heavily
> used by cybersecurity professionals, researchers, law enforcement, and
> many other types of organizations. ARIN will seek to engage beyond our
> community to raise awareness of the planned retirement date for Whois
> (Port 43).
[...]
> - Whois (Port 43): on or after 1 January 2029