[arin-ppml] Draft Policy 2010-10 (Global Proposal):GlobalPolicy for IPv4 Allocations by the IANA Post Exhaustion- Last Call (textrevised)

[Stephen Sprunk]

On 05 Nov 2010 07:20, Ronald F. Guilmette wrote:
> In message <E44E6428-C3AA-48A6-82A2-9FA24E98E018 at delong.com>, 
> Owen DeLong <owen at delong.com> wrote:
>> On Nov 5, 2010, at 12:53 AM, Ronald F. Guilmette wrote:
>>> In message <DDE139AF-24A9-4F9A-B524-2CB78272E735 at delong.com>,
>>> Owen DeLong <owen at delong.com> wrote:
>>>> Why? There are very good reasons for ARIN not to publicly disclose the techniques and methods they use for conducting these audits.
>>> I'm listening.  What are those?  Do they outweigh the many obvious good reasons to have a clear and transparent statement of the process that all members know they may be held to, without
>>> prejudice or favor?
>> The process is documented in NRPM12 and is pretty clear.
> I think not.  NRPM Section 12 describes in great detail _who_ may be audited and _when_ they may be audited.  It doesn't say a damn thing about the ``how'' of auditing.

That's partly because doing so would make the system easier to game, but
mainly because different organizations have different types of records
available and we want to make the process as painless as possible for
legitimate applicants.  The review process imports the same goal and
documentation requirements.

> In this country, at least, we tend to favor the transparent, and the
> public, over the secret and hidden. In the words of late Supreme Court
> Justice Louis Brandeis, ``Sunlight is the best disinfectant''.

I agree, but we're dealing with information that may be considered trade
secrets and, in the case of some registrants, matters of national security.

> Secrecy breeds suspicion.  And when I and others see some of the stuff that's been going on... like the stuff attached to the end of this message...  we _do_ start to wonder what _really_ goes on inside of ARIN.

IMHO, your problem is not secrecy but rather ARIN's bias toward making
things as easy as possible for registrants and the presumption that any
reasonable-looking documentation is legitimate unless proven otherwise. 
Notice the direct parallel to "innocent until proven guilty".

The "how" is not really secret anyway:

1. Give ARIN your documentation.
2. If it is sufficient to support the conclusion the space is justified,
go to step 5.
3. ARIN asks for more documentation.
4. Go to step 1.
5. Get/keep space.

If this isn't written down anywhere, I suspect that's because those
involved in writing policy find it too obvious to bother.

> I could go on and on.  The problem isn't finding this stuff.  The problem is finding anybody in the ARIN community or in ARIN management who gives a damn.

They do care, but they cannot _act_ on your accusations without
following the process, nor can they tell you what they discover during
the process due to NDAs.

Note that it's entirely possible that the folks you've accused _have_
presented ARIN with sufficient documentation to demonstrate policy
compliance, which precludes revocation.

>> As I see it, even if you consider "rampant and profligate waste", you 
>> might expect
>> ARIN to reclaim, what, maybe 10 /8s worth of space over the next 5 
>> years? The
>> internet is consuming 2 /8s per month. 2 per year isn't even a drop in 
>> the bucket.
> And who exactly is giving out those two /8s per month?

The RIRs.

> And what, if anything, are those folks doing to encourage the wider use of NAT and/or to educate the space-consuming community about its proper use and potential?

NAT is evil, and therefore current policy does not require its use.  If
you'd like to see that changed, please submit a policy proposal.  I'm
sure someone from the AC would be happy to help if needed.  I'm not
optimistic about the community accepting such a proposal, though.

>> Like it or not, reclamation is a slow, deliberate, careful process that takes significant time.
> Someone else here was just suggested a few ideas to speed that all up.
> And those sounded pretty reasonable to me.

It's still a deliberate, careful process.  With the alleged amount of
fraud out there and ARIN's current staffing, it will take a long, long
time to sift through it all.

>> ... please present evidence.
> See below.  As I have said, there's plenty more where this came from.
> And I really would like to know how non-existant entities managed to get
> so much space allocated to them from ARIN.  It is truly stunning.
>
> Yea yea yea.  I know what you are going to say... ``We can't tell you because it is all confidential and all under NDA.''  Yea.  Right.  Bullcrap.  Please explain gto me how ARIN has _any_ binding contractual commitments to totally fradulent/fabricated entities which themselves have no legal existance?
>
> This I gotta hear.
>
> Take your time.

ARIN is bound by the contracts it signs until proven otherwise.  Proving
a contract is invalid takes time and money for lawyers to sort things
out.  If you're an ARIN member, you can speak up at the next members'
meeting and ask that ARIN increase your fees to pay for more lawyers. 
Again, I'm not optimistic about the community accepting that.

S

-- 
Stephen Sprunk         "God does not play dice."  --Albert Einstein
CCIE #3723         "God is an inveterate gambler, and He throws the
K5SSS        dice at every possible opportunity." --Stephen Hawking


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3646 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20101105/4904ab91/attachment.p7s>