[arin-ppml] Revised -- Policy Proposal 2009-4: IPv4 Recovery Fund

[Jeff Aitken]

On Sun, Apr 12, 2009 at 09:39:21AM -0400, Leo Bicknell wrote:
> If ARIN is the only entity that can recover blocks I think it is
> unlikely someone will be able to sell them the same block more than
> once.

Sure, that particular type of fraud becomes harder.  The tricky part is
predicting what kind of fraud will become possible/easier.  If we've
learned anything from email, the DNS, or various malware issues over the
years its that the Bad Guys will find holes in pretty much any scheme if
there's sufficient profit in it.  One good way to minimize the impact is
to keep the system as simple as possible.  The longer and more complex the
policy, the more potential loopholes and grey areas that it contains.

This is why I supported 2008-6.  It is simple and unambiguous.   Most of
the arguments that you've made in support of 2009-4 also apply to 2008-6
and the latter has the advantage that it's exactly two sentences long.  
Unless you're a constitutional scholar, it's pretty hard to read too much
into those two sentences.

You asked:

> Is it better to have ARIN take on some additional risk to (in my opinion)
> greatly reduce the risk to those who are going to trade IPv4 number
> resources (ISP's and their customers); or is it better to get the absolute
> lowest risk to ARIN by leaving the ISP and their customers to fend for
> themselves?

Ignoring the obvious bias in the way the question was phrased, my vote is
to keep ARIN out of the middle of transfers.  In my opinion, ARIN's goal
should be to make the database as accurate as possible, and very little
else; take the time and money that would be spent playing matchmaker and
use it to validate POC data or promote v6 instead.


--Jeff