[ppml] Directory Services - section 3.4.3

[william(at)elan.net]

On Fri, 10 Jun 2005, Bill Woodcock wrote:

>    >        If ARIN is unable to verify contact information via the normal
>    >        verification procedure ARIN shall attempt to notify the parent
>    >        of the resource to have the information updated.
>
> The "parents" of resources are themselves resources, and not subject to
> notification.  The _recipients_ of resources, or the _recipients_ of
> _parent resources_, however, are organizations, and thus subject to
> notification.

Parents of resources are organizations, but you really are not going
to contact organization directly, you're going to contact POC for
that organization (which ones?).

>    >        Resource holders who fail to respond to third parties
>    >        more than 4 times per month for three months may have their
>    >        resources reclaimed at the discretion of ARIN staff.

Again its not resource holder who fails to respond, its POC that fails
to respond. My view is that organization can be considered to have bad
resource info and uncontactable if none of its POCs can be contacted.

Also where did "4 times per month for three month" detail came from?

> While I appreciate the intention here, I'm sure someone can generate
> enough contact attempts to overwhelm the ability of a reasonable
> resource-holder to respond.

There are also cases when one organization is not contactable by somebody
else because of its local mail or other settings (spam filters that
prevent contact from everyone from specific country are known to exist).

ARIN staff should have reasonable discretion to decide on if there are
enough reports being made to conclude that POC is not responding not to
just one or two people but majority of those who want to contact it.

> So I'm not sure that this is actually useful.
> I do agree that if they fail to respond to _ARIN contacts_, their space
> should eventually be pulled.

That's a given for sure.

>    >        The ARIN staff shall publish the time thresholds and procedural
>    >        details to implement this policy on the ARIN web site.
>
> Vast overspecification.

I disagree. ARIN is not required to adapt specific procedures on how its
determining if contact is bad, etc. All it says is that the procedures it
decides on should be public (and ARIN staff can change it any time they
like I'd expect).

>    >        ARIN shall publish the APID in the following methods using
>    >        industry standard practices:
>    >            - Via the WHOIS protocol.
>    >            - Via a query form accessible via the HTTP protocol.
>    >            - Via FTP to users who complete the bulk data form.
>    >            - Via CDROM to users who complete the bulk data form.
>    >            - Via the RWHOIS protocol.
>
> Again, this is vast overspecification.

Again disagree. I think minimum required support mechanisms for data 
access should be made available and listed. ARIN staff is free to decide
to support something else like LDAP but not at the expense of protocols
widely used like whois.

>    >        ARIN may refer a query to a outside source (for instance via
>    >        RWHOIS or HTTP redirect).  Outside sources must:
>    >        1 Have an AUP deemed compatible with the ARIN AUP by ARIN staff.
>    >        2 Support the applications in section 3.3.1.
>    >        3 Prohibit the applications in section 3.3.2.
>    >        4 Meet the requirements in section 3.3.3.
>
> Points 2-4 are redundant with point 1, and can thus be deleted.

Points 2-4 are redundant only if AUP is large enough to include 3.3.x 
which is not clear right now.

>    > 	 * The distributed information service must be operational
>    > 	   24 hours a day, 7 days a week to both the general public
>    > 	   and ARIN staff.  The service is allowed reasonable
>    > 	   downtime for server maintenance according to generally
>    > 	   accepted community standards.
>
> These two sentences are mutually exclusive.  Pick one, preferably the
> latter, and delete the other.

I think instead of saying the service "MUST" be operational, it should
say:

    * The distributed information service is expected to be operational
      24 hours a day, 7 days a week to both the general public and ARIN
      staff. The service is allowed reasonable downtime for server
      maintenance according to generally accepted community standards.

Then the two sentences in the paragraph are no longer inconsistent
with each other.

>    >          * The distributed information service must return current
>    >            information.
>
> Overspecification.  Of course that'll be done to the best of staff's
> ability.

Again changing from "must return " to "is expected to return" may help.

-- 
William Leibzon
Elan Networks
william at elan.net