<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Thinking out loud on this some more:<div><br></div><div>If we want to avoid the complexity of having a reallocation being in some sort of provisional state waiting for an approval, and also want to avoid the complexity of asking users to maintain lists of allowed upstream org IDs... could we simply allow an org to prohibit incoming reallocations completely, similar to a consumer credit freeze? If the org needs to receive one, they can unset the checkbox, wait for the reallocation, then add it back afterwards. Is there a requirement for the feature that wouldn’t be covered by this approach?<br id="lineBreakAtBeginningOfMessage"><div><br></div><div>-C</div><div><br><blockquote type="cite"><div>On Oct 15, 2024, at 16:02, Chris Woodfield <chris@semihuman.com> wrote:</div><br class="Apple-interchange-newline"><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">If that’s the case, great, and I’ll withdraw my comment. I'll haven’t been on the receiving side of a reallocation in some time, so it’s entirely possible I’ve missed that development.<div><br></div><div>-C<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Oct 15, 2024, at 15:45, Pellak, Kaitlyn <kaitjean@amazon.com> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Hey folks,<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I believe a notification of the reallocation via email is the default already. This issue might be more prevalent for larger network operators who reallocate resources regularly enough that verifying a legitimate vs malicious reallocation that way gets lost in the shuffle. However I recognize the impacted groups might be in the minority here. Having to manually approve the reallocation when that email comes in could be a good way to resolve this.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Kaitlyn<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="">Kaitlyn Pellak<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="">Amazon – Technical Business Developer II<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><a href="mailto:kaitjean@amazon.com" title="mailto:martesmm@amazon.com" style="color: blue; text-decoration: underline;"><span style="color: rgb(149, 79, 114);">kaitjean@amazon.com</span></a><span style=""><o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="">301.921.5566<o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style=""> <o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style=""><span id="cid:image001.png@01DB1F32.72568420"><image001.png></span><o:p></o:p></span></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 12pt;">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;">ARIN-consult <<a href="mailto:arin-consult-bounces@arin.net" style="color: blue; text-decoration: underline;">arin-consult-bounces@arin.net</a>> on behalf of Chris Woodfield <<a href="mailto:chris@semihuman.com" style="color: blue; text-decoration: underline;">chris@semihuman.com</a>><br><b>Date:<span class="Apple-converted-space"> </span></b>Tuesday, October 15, 2024 at 6:07 PM<br><b>To:<span class="Apple-converted-space"> </span></b>Rich Greenwood <<a href="mailto:rgreenwood@shastacoe.org" style="color: blue; text-decoration: underline;">rgreenwood@shastacoe.org</a>>, "<a href="mailto:arin-consult@arin.net" style="color: blue; text-decoration: underline;">arin-consult@arin.net</a>" <<a href="mailto:arin-consult@arin.net" style="color: blue; text-decoration: underline;">arin-consult@arin.net</a>><br><b>Subject:<span class="Apple-converted-space"> </span></b>RE: [EXTERNAL] [ARIN-consult] Consultation on Reallocation Control Features<o:p></o:p></span></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse: collapse;"><tbody><tr style="height: 15.25pt;"><td width="1123" valign="top" style="width: 842.35pt; border: 1.5pt solid rgb(237, 125, 49); padding: 0in 5.4pt; height: 15.25pt;"><p><strong><span style="font-family: Calibri, sans-serif; background: rgb(255, 255, 153);">CAUTION</span></strong><span style="background: rgb(255, 255, 153);">: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.</span><o:p></o:p></p></td></tr></tbody></table></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I’m now wondering how many of these incidents might have been mitigated with just a notification mechanism that fires on a reallocation event?<o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">If we chose this route, I’d argue that an email notification of a new reallocation being assigned to an org should be a default. Orgs can then flip a switch if they choose to decide whether they want to be able to block them until they can confirm acceptance of the reallocation. <o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">-C<o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On Oct 15, 2024, at 14:37, Rich Greenwood <rgreenwood@shastacoe.org> wrote:<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I tend to agree with a confirmation mechanism. It doesn't require the receiver to pre-configure anything, provides notification of the attempt, allows the receiver to allow or deny, and notifies the sender of success or failure. It might be worth adding an option to turn off the notifications in the event someone figures out how to turn them into spam.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">--Rich<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On Tue, Oct 15, 2024 at 2:10 PM Ross Tajvar <<a href="mailto:ross@tajvar.io" style="color: blue; text-decoration: underline;">ross@tajvar.io</a>> wrote:<o:p></o:p></div></div><blockquote style="border-width: medium medium medium 1pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor rgb(204, 204, 204); border-image: none; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;"><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I'd like to reiterate Chris's earlier point that manually confirming each reallocation sounds like a better mechanism all around. Easier for users to understand, easier to explain, etc. I'm imagining that most orgs which are reallocating are probably used to the process, but for orgs receiving reallocations, it may be their first time. My experience with IRR has taught me that explaining to a customer who is trying to buy a service from you that they have to perform a process with which they are unfamiliar is difficult and painful.<o:p></o:p></div></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On Tue, Oct 15, 2024 at 5:02 PM Chris Woodfield <<a href="mailto:chris@semihuman.com" target="_blank" style="color: blue; text-decoration: underline;">chris@semihuman.com</a>> wrote:<o:p></o:p></div></div><blockquote style="border-width: medium medium medium 1pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor rgb(204, 204, 204); border-image: none; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Indeed, a larger number than I would have suspected as well. Given that, I’d argue this is worth prioritizing to prevent future abuse.<br><br>I think another relevant question for the consultation would be: If/when this feature ships, will *you* enable it?<br><br>Thanks,<br><br>-Chris<br><br>> On Oct 15, 2024, at 13:57, William Herrin <<a href="mailto:bill@herrin.us" target="_blank" style="color: blue; text-decoration: underline;">bill@herrin.us</a>> wrote:<br>><span class="Apple-converted-space"> </span><br>> On Tue, Oct 15, 2024 at 1:42 PM John Sweeting <<a href="mailto:jsweeting@arin.net" target="_blank" style="color: blue; text-decoration: underline;">jsweeting@arin.net</a>> wrote:<br>>> Bill, these would be only those complaints that RSD received and confirmed were suspicious. That is the only way ARIN would have visibility.<br>><span class="Apple-converted-space"> </span><br>> Got it. That's a surprisingly large number. I'm not sure letting folks<br>> lock the barn door afterwards will help much.<br>><span class="Apple-converted-space"> </span><br>> I'm curious: can you share what sort of things the registrants had to<br>> say for themselves when confronted by ARIN? The ones with the<br>> allocation direct from ARIN, not the ones filing a complaint about a<br>> false reallocation?<br>><span class="Apple-converted-space"> </span><br>> Thanks,<br>> Bill Herrin<br>><span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> --<span class="Apple-converted-space"> </span><br>> William Herrin<br>><span class="Apple-converted-space"> </span><a href="mailto:bill@herrin.us" target="_blank" style="color: blue; text-decoration: underline;">bill@herrin.us</a><br>><span class="Apple-converted-space"> </span><a href="https://bill.herrin.us/" target="_blank" style="color: blue; text-decoration: underline;">https://bill.herrin.us/</a><br>> _______________________________________________<br>> ARIN-Consult<br>> You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>> List (<a href="mailto:ARIN-consult@arin.net" target="_blank" style="color: blue; text-decoration: underline;">ARIN-consult@arin.net</a>).<br>> Unsubscribe or manage your mailing list subscription at:<br>><span class="Apple-converted-space"> </span><a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank" style="color: blue; text-decoration: underline;">https://lists.arin.net/mailman/listinfo/arin-consult</a><span class="Apple-converted-space"> </span>Please contact the ARIN Member Services<br>> Help Desk at<span class="Apple-converted-space"> </span><a href="mailto:info@arin.net" target="_blank" style="color: blue; text-decoration: underline;">info@arin.net</a><span class="Apple-converted-space"> </span>if you experience any issues.<br><br>_______________________________________________<br>ARIN-Consult<br>You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>List (<a href="mailto:ARIN-consult@arin.net" target="_blank" style="color: blue; text-decoration: underline;">ARIN-consult@arin.net</a>).<br>Unsubscribe or manage your mailing list subscription at:<br><a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank" style="color: blue; text-decoration: underline;">https://lists.arin.net/mailman/listinfo/arin-consult</a><span class="Apple-converted-space"> </span>Please contact the ARIN Member Services<br>Help Desk at<span class="Apple-converted-space"> </span><a href="mailto:info@arin.net" target="_blank" style="color: blue; text-decoration: underline;">info@arin.net</a><span class="Apple-converted-space"> </span>if you experience any issues.<o:p></o:p></div></blockquote></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">_______________________________________________<br>ARIN-Consult<br>You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>List (<a href="mailto:ARIN-consult@arin.net" target="_blank" style="color: blue; text-decoration: underline;">ARIN-consult@arin.net</a>).<br>Unsubscribe or manage your mailing list subscription at:<br><a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank" style="color: blue; text-decoration: underline;">https://lists.arin.net/mailman/listinfo/arin-consult</a><span class="Apple-converted-space"> </span>Please contact the ARIN Member Services<br>Help Desk at<span class="Apple-converted-space"> </span><a href="mailto:info@arin.net" target="_blank" style="color: blue; text-decoration: underline;">info@arin.net</a><span class="Apple-converted-space"> </span>if you experience any issues.<o:p></o:p></div></blockquote></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br clear="all"><o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="gmailsignatureprefix">--<span class="Apple-converted-space"> </span></span><o:p></o:p></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";">Rich Greenwood<br>Senior Engineer</span><o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";">Shasta County Office of Education</span><o:p></o:p></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";">Information Technology</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";">1644 Magnolia Ave.</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";">Redding, CA 96001</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";">Office: 530-225-0161</span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";"><a href="mailto:rgreenwood@shastacoe.org" target="_blank" style="color: blue; text-decoration: underline;">rgreenwood@shastacoe.org</a></span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New"; color: rgb(32, 33, 36);">Hotline: 530-225-0279</span><span style="color: rgb(32, 33, 36);"><o:p></o:p></span></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";"><a href="mailto:hotline@shastacoe.org" target="_blank" style="color: blue; text-decoration: underline;">hotline@shastacoe.org</a></span><o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-family: "Courier New";"><a href="https://hotline.shastacoe.org/" target="_blank" style="color: blue; text-decoration: underline;">https://hotline.shastacoe.org</a></span></div></div></div></div></div></div></div></blockquote></div></div></div></div></div></blockquote></div><br></div></div></div></blockquote></div><br></div></body></html>