[arin-ppml] Post-exhaustion IPv4 policy

[William Herrin]

On Thu, Oct 29, 2009 at 6:49 PM, Scott Leibrand <scottleibrand at gmail.com> wrote:
> William Herrin wrote:
>>
>> On Thu, Oct 22, 2009 at 6:13 PM, Scott Leibrand <scottleibrand at gmail.com>
>> wrote:
>>> "Repeated requests, in a manner that would
>>> circumvent 4.1.6, are not allowed."  The idea, of course, is to give ARIN
>>> staff leeway to use their excellent fraud detection skills, combined with
>>> operational procedures that can be adjusted as needed.
>>>
>>
>> Staff will be making such decisions under intense scrutiny. Any
>> judgment they're forced to exercise will tend to be the most lenient
>> the policy allows. Which is to say: no restriction on repeat requests
>> at all.
>>
>> Giving staff discretion can be a good thing if done with appropriate
>> checks, but you also have to give them a policy vehicle that validates
>> and reinforces that discretion. In other words, it's better to say,
>> "You can have 1 a day but staff can waive the requirement" than "you
>> can have as many as you want but staff can limit you to 1 a day."
>>
>
> Understood.  Do you have any specific suggestions as to how we could modify
> proposal 97 to codify a restriction, while still giving staff leeway to make
> exception for anyone who is clearly not trying to bend any rules?

Hi Scott,

Tough question. How about something like a 1-year waiting period
between requests but the BoT is empowered to waive the waiting period
by majority vote for any individual requests they deem meritorious by
whatever criteria. Of course waiving the waiting period doesn't grant
the request; it just means that staff can consider it before the
waiting period expires.


> I don't believe that finding a bunch of /24s on the transfer market will be
> allowed.  We'll find out more details soon when ARIN staff releases their
> implementation plan, but the policy says that the recipient of transferred
> space must "demonstrate the need for such resources, as a single aggregate,
> in the exact amount which they can justify under current ARIN policies."
>
> Does that address your concern?

If I have 1000 computers, I can justify a /24 today, another /24
tomorrow and a /23 the day after that. It depends only on how many
hosts my multiply revised plans each put behind a NAT or define as
"not connected full-time."

I'm not all that strongly concerned about this one. If we start to see
abuse, the character of the abuse should also provide the solution
before terribly much disaggregation occurs. May want to think about
publishing information about transfers in a way that helps identify
the bad actors, kind of like the CIDR report does overall for BGP.

Regards,
Bill Herrin


-- 
William D. Herrin ................ herrin at dirtside.com  bill at herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004