[ppml] Last Call for Comment: Policy Proposal 2003-5

[william at elan.net]

I planned to send this comments to Mark Kosters and cc to ppml but never 
got around to it. I have problems with some wording of this policy (but 
not with main issue being addresses). I did expect that some of this would be 
addressed in the final revision and did not expect policy to go to last 
call AS-IS. Here are my particular suggestions:

1. I think policy should be more generic appliying to any whois service 
that is approved by ARIN and is being used to show reassignment data by ISP.
Currently this is primarily rwhois, but there are 4 isps doing just plain 
whois and in the future some policy needs to be developed on what services 
is accepted (such as when crisp is ready). But as far as this policy, the 
changes I proposed are that word "Rwhois" be replaced with "isp maintained 
reassigment whois service". Possibly it can be done in the name of the 
policy and first time its mentioned and then it can say rwhois for 
additional cases explaining that would be a acronym for "reassignment 
whois server" but does not necessarily means its rwhois protocol.

2. I have recomendations with some wording on requirements:
 a. Move first sentence of paragraph 2 into paragraph 1 - it belongs more 
    clearly there and maybe add the very last paragraph here as well (most 
   important points must be first). So possibly change paragraph 1 to something
   like "Reassignment server must allow public access to reassigment
   information 24 hours a day, 7 days a week and must return results that 
   are up-to-date"
   This is shorter and better in my view but whatever...

 b. Separate first sentence of paragraph 3 on by itself - i.e.
   "The RWhois server must return reassignment information for the IP 
   address queried", possibly add it to paragraph 1 above, i.e.
   "... up-to-date and must return reassignment information for the ip 
   address queried"
 
 c. For same paragraph 3, I do not think specifically mentioning "multi-homed"
    policy is good, it may change in the future and different privacy
    considerations in other policies may be created. Better to possibly say
    "The reassignment server may follow privacy considerations for public 
    access as described in ARIN policies but most provide exact detail on
    assignments and allocations to ARIN staff"

 d. Possibly combine paragraphs on attributes that are returned, i.e.
   "The RWhois server must respond to a query with the minimal set of 
    attributes per object as defined by ARIN staff. The RWhois server may 
    include optional attributes per object that are defined by the operator."

On Wed, 16 Apr 2003, Member Services wrote:

> The ARIN Advisory Council voted to forward the 
> following policy proposal to the ARIN Board of 
> Trustees for consideration. 
> 
> This is a last call for comments on this policy 
> proposal prior to the ARIN Board of Trustees review. 
> Comments received during this period will be included 
> with the proposal when it is presented to the Board 
> of Trustees for their consideration. 
> 
> Please send your comments to ppml at arin.net. This last 
> call will expire at 23:59 EDT on April 30, 2003. 
> 
> Member Services 
> American Registry for Internet Numbers (ARIN)
> 
> 
> *** Last Call: Policy Proposal 2003-5 *** 
> 
> 2003-5: RWhois Server Use Requirements 
> 
> Background: 
> 
> RWhois was created in part to allow ISP's locally operate and control 
> their own reassignment information. The purpose of placing this data 
> in a RWhois server was two-fold: 
> 
>   1) Allow RIR staff to examine reassignment utilization 
>   2) Allow access to the general public on reassignment information. 
> 
> Many ISPs have opted to use RWhois servers for their reassignment 
> information over sending SWIPs to ARIN. But some of the ISP's who 
> have selected to use RWhois servers for their reassignment information 
> have not kept the servers operational 24x7, contents of the database up 
> to-date, or are restricting access only to ARIN staff. This lack of a 
> uniform set of operations of RWhois servers has resulted in confusion 
> for end-users and ARIN staff. 
> 
> Policy Proposal: 
> 
> Therefore, it is proposed a set of minimal requirements of operating 
> a RWhois server for those ISPs who decide to use RWhois to 
> manage their IP reassignment information be established and enforced. 
> 
>   The proposed minimal RWhois requirements are: 
> 
>   The RWhois server must be operational 24 hours a day, 7 days a week 
>   to both the general public and ARIN staff. 
> 
>   The RWhois server must allow public access to reassignment information. 
>   The ISP may restrict the number of queries allowed per time interval 
>   from a host or subnet to defend against DDOS attacks, remote mirroring 
>   attempts, and other nefarious acts. 
> 
>   The RWhois server must return reassignment information for the IP 
>   address queried. The RWhois server may follow the privacy protections 
>   for customers as described in the multi-homed policy. The RWhois server 
>   must give customer information as described in the multi-homed policy 
>   to ARIN staff. 
> 
>   The RWhois server may return results for non-IP queries. 
> 
>   The RWhois server must respond to a query with the minimal set of 
>   attributes per object as defined by ARIN staff. 
> 
>   The RWhois server may include optional attributes per object that are 
>   defined by the operator. 
> 
>   The RWhois server must return results that are up-to-date on 
>   reassignment information. 
> 
> Note that this policy only applies to those organizations
> who choose RWhois as their reassignment option.
> 
> ## END ##