<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Feb 20, 2024, at 16:55, John Curran <jcurran@arin.net> wrote:</div><br class="Apple-interchange-newline"><div>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<br>
<div>
<blockquote type="cite">
<div>On Feb 20, 2024, at 6:17 PM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:</div>
...<br class="Apple-interchange-newline">
<div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">I
understand that legacy holders do not get access to the ARIN trust anchors,</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">and
so can't verify. That's one direction of trust, and I think it's unfortunate.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">I
think that if they started to see benefit from RPKI, they might wonder why</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">they
aren't involved, and consider joining.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
</div>
</blockquote>
<br>
</div>
<div>Michael – </div>
<div><br>
</div>
<div>Alas, the challenge is that there are legacy resource holders who have made a conscious decision </div>
<div>over the years that they are better off not entering into a registration services agreement with ARIN – </div>
<div>the same agreement that every other resource holder has & with the same terms and conditions – </div>
<div>and thus they decline to receive the full set of services as every other registry customer. While it is</div>
<div>possible that the benefits of RPKI will impact their consideration of the matter, it’s not at all assured.</div></div></div></blockquote><div><br></div>In its current state, RPKI is at best a cryptographically signed hint at how to best spoof an advertisement.</div><div><br></div><div>At worst, it is fast becoming a cudgel that can be used to drive certain behaviors.</div><div><br></div><div>For now (and this is largely a good thing) there aren’t many providers rejecting RPKI UNKNOWN announcements.</div><div>However, there are some that are rejecting RPKI unknown for IRR (not RIR) records more recent than a certain date.</div><div><br></div><div>There are many legitimate reasons that a legacy registration that is decades old might end up with a more recent</div><div>date on their IRR entry (changing from RADB to ALTDB or vice versa as an example).</div><div><br></div><div>This can result in significant connectivity problems for legitimate legacy holders, to which the general response</div><div>from these (large) providers is to attempt to bully the legacy holder into joining an RIR.</div><div><br><blockquote type="cite"><div><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div>As for the reason why, we’ve heard it asserted by some legacy resource holders that they hold </div>
<div>unspecified and/or unproven rights to their number resource entries in the ARIN registry, and </div>
<div>furthermore that entry into an ARIN registration services agreement would impact those rights. </div>
<div>While ARIN has changed the registration agreement several times to reduce the probability of </div>
<div>any conflict, it is a realistic concern given the otherwise indeterminate nature of the assertions. </div></div></div></blockquote><div><br></div>In my case, I entered into the ARIN Legacy RSA based on a set of conditions that were not expected to change. The</div><div>ARIN board chose to change those conditions over my objections, but would not give me the option of retaining my</div><div>resources and going back to an uncontracted state. Fortunately, I found a loophole by transferring my resources to</div><div>the RIPE NCC as uncontracted legacy resources, so my only relationship with ARIN regards my IPv6 /48.</div><div><br></div><div><blockquote type="cite"><div><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div>ARIN was formed to take on full responsibility for the Internet number registry that was previously </div>
<div>administered under USG direction, and to provide a clear voice to this community on how these </div>
<div>number resources are managed. We have provided this community with the ability to elect its own </div>
<div>governing body for ARIN (the ARIN Board of Trustees) and that body has consistently held for over </div>
<div>25 years that that ARIN should provide legacy holders with the same basic registry services that they </div>
<div>were receiving at ARIN’s formation without cost or contract. However, we have also heard consistent </div>
<div>community demand for equitable treatment of _all_ ARIN customers in terms of agreements and fees; </div>
<div>this should not be surprising given that the ARIN registry exists in service to the entire community. </div></div></div></blockquote><div><br></div>No, you have provided the membership, not the community, with the ability to elect the BOT and the AC.</div><div><br></div><div>Please note that the membership consists solely of those who have both opted in to some form of RSA and expressed a desire to participate in ARIN governance.</div><div><br></div><div>Further, the holding of the BoT that ARIN should provide those services to legacy holders without contract or cost is widely understood to be a promise ARIN made to the resource holding community at or near the time that it was awarded with that responsibility.</div><div><br></div><div><br><blockquote type="cite"><div><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div>The present situation is the result of balancing those two principled positions: ARIN legacy resource</div>
<div>holders continue to receive basic registry services (and many member-funded enhancements such as </div>
<div>online registry management, DNSSEC support for reverse DNS zones, etc.) without contract or fee. </div>
<div>They also enjoy full participation in the policy development process, the ARIN consultation process, etc. </div></div></div></blockquote><div><br></div>The present situation is the current place in the evolution of how ARIN has balanced those two positions.</div><div><br></div><div>Full participation in the PDP is open to anyone with an email address, not just the resource holders. (well, except the part where the AC is elected, that’s members only).</div><div><br></div><div><blockquote type="cite"><div><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div>However, if they want to receive all of services that have been funded by the ARIN members – such as </div>
<div>authenticated IRR and RPKI – then they have to agree to the same registry terms as everyone else. </div>
<div>Doing so is quite simple, but does require being comfortable with being treated the same as every other </div>
<div>ARIN member – a problematic requirement for some given that they hold inherently inequitable beliefs</div>
<div>regarding their number resources in the ARIN registry. </div></div></div></blockquote><div><br></div>IMHO, this is a derogatory and unfair characterization of the legacy holders who have, for various reasons, chosen not to adopt the ARIN RSA.</div><div><br></div><div>Owen</div><div><br></div></body></html>