[arin-ppml] Draft Policy 2008-7: Identify Invalid WHOIS POC's

Thu Apr 2 15:57:59 EDT 2009

> -----Original Message-----
> From: arin-ppml-bounces at arin.net 
> [mailto:arin-ppml-bounces at arin.net] On Behalf Of William Herrin
> Sent: Thursday, April 02, 2009 10:54 AM
> To: Owen DeLong
> Cc: arin-ppml at arin.net
> Subject: Re: [arin-ppml]Draft Policy 2008-7: Identify Invalid 
> WHOIS POC's
> 
> On Thu, Apr 2, 2009 at 12:28 PM, Owen DeLong <owen at delong.com> wrote:
> > In any case, given the data now at hand, do you support or 
> oppose the 
> > policy?
> 
> Hi Owen,
> 
> Support the general idea. Oppose as written.
> 
> The systemic costs have not been adequately quantified or considered.

When IPv4 runout has happened, the value of unused IPv4 is going to
climb quite rapidly to those who cannot get it.  Are you willing to
tell a brand new org that only needs a /23 that it's not worth the
time for the rest of the Internet community to search out and locate
an abandoned /23 that they can use, even though we know perfectly
well that there's many abandoned /23's buried in WHOIS?

That seems very shabby to me, and it's also just begging to get
the politicians and governments involved.

Just look for example during the last election how all the Republicans
were howling about the government could take care of the US dependent
on oil by just letting the petroleum companies drill in offshore areas.
It made no difference that careful studies by the very oil companies
this was supposed to help were saying the opposite - this was at it's
heart, a decision by the ignorant masses (the American people) that
the scientists working for the oil companies and for the government were
simply incompetent boobs, and needed to be overridden.

If McCain had been elected I guarantee they would be in the middle of
issuing more offshore leases right now.  Even though the oil companies
have said they mostly don't believe there's much chance of getting more
oil out there - but hey, if the government is going to give them the
leases for a dollar, then give them billions in tax credits to drill
there, well then they will drill.

And you really think you can get away will using some unfair cost
argument when we KNOW, not just guess like the oil scientists, that
there's abandoned IPv4 resources out there?  I think this is very
unrealistic.

Even if a "IPv4 buy-and-sell" market goes into effect this will
not remove the need for WHOIS validation - by contrast, it will
greatly increase the need for it, since you will have many
IPv4 brokers operating on the Internet and it's likely that as
prices rise, an increasing number of these transactions will
be under the table.

> Relatively trivial edits could and should be used to reduce 
> the cost with little or no damage to the proposal's effectiveness.
> 
> Edits I would make if it were my proposal include:
> 
> 1. Don't ping POCs for which at least one attached resource 
> has been updated in the past 3 to 5 years. If some other 
> behavior demonstrates a high probability that the POC is 
> valid, there's no need to burn more of the POC's time.
> 

This is an operational objection and it's been made clear many
times not to put operations into the policy manual.

You may suggest to the ARIN staff
that is tasked with implementing this to merely NOT designate
a non-responsive POC as non-responsive until they have NOT
responded by e-mail 3 - 5 years in a row.  Or, the staff can
NOT designate a POC non-responsive even if it doesn't respond
to the annual POC-ping, as long as it's responding in some
other manner.

Next?

> 2. Don't ping POCs which have been updated or have responded 
> to this or another query within the past 3 years.
>

see above.  The POC can choose to not respond to the ping without
fear of being marked bad in the database if ARIN staff simply says
that they won't designate a POC as unresponsive if the POC
responds in a different fashion (such as a recent WHOIS update)

> 3. Close the gap before "If ARIN staff deems a POC to be abandoned."
> The proposal specifies no criteria for making such a 
> determination. 

This is correct.  All prior trial balloons of this proposal drew
many and varied objections when they SPECIFICALLY TOLD ARIN
staff what criteria to use to deem a POC to be abandoned.  The
objections were to bringing operational details into the policy
manual.

> Is staff intended to infer that a POC with a 
> bad email address is abandoned even if the phone number or 
> postal address are still valid?

If the phone number and postal address are valid then the POC is
in violation of the contract they signed with ARIN that requires
that they supply complete POC data.  So, ARIN staff should remind
the POC of this.  If the POC refuses to update the e-mail address
to a correct e-mail address they are violating their contract
and can risk loss of their addresses on those grounds.

> Or does this proposal direct staff to call and send postal 
> mail when the email bounces?

NO.  Since the charter of ARIN is to manage IP address resources,
technically the charter dictates that when ARIN essentially becomes aware
of an unused address resource that they assign it.  This isn't
happening right now, because we still have virgin IPv4.  But
after IPv4 runout, pressure will be on ARIN to assign out the
bits and pieces of IPv4 and then it will be very important to
know what's in use and what's not.

Thus, ARIN's charter, not this policy proposal, directs ARIN staff
to verify a POC that it is brought to their attention is invalid. 

> The latter would be a huge 
> direct cost to ARIN, especially on the first sweep that hits 
> the legacy registrations.
>

The policy proposal gives ARIN staff flexibility.  LOGICALLY anyone 
at ARIN implementing this would cherry pick the LARGE blocks FIRST.

I highly doubt ARIN staff would spend time attempting to verify a POC
on a /24 that was not responding during the first round of e-mails.
This is another thing you can suggest as an operational detail.  I
would assume by the time they got the larger blocks validated that
it would be so far in the future that nobody would care about
POC handles on IPv4 resources.

Ted

> 
> 
> On Thu, Apr 2, 2009 at 1:19 PM, Aaron <dudepron at gmail.com> wrote:
> > That assumes that each POC is unique. There are several 
> organizations 
> > that have multiple listings so that number is probably much less.
> 
> I make no representations regarding the 223k number. I copied 
> it from the only post I saw which attempted to quantify the 
> number of POCs in the system.
> 
> Regards,
> Bill Herrin
> 
> 
> --
> William D. Herrin ................ herrin at dirtside.com  bill at herrin.us
> 3005 Crane Dr. ...................... Web: 
> <http://bill.herrin.us/> Falls Church, VA 22042-3004 
> _______________________________________________
> PPML
> You are receiving this message because you are subscribed to 
> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info at arin.net if you experience any issues.
> 