[arin-ppml] prop266 - re-framing the discussion

[Carlos Friaças]

Hi,

On Thu, 2 May 2019, Michel Py wrote:

>> Carlos Friaças wrote :
>> That's really news to me.
>
> This is quite common in Europe as well, I hear. Probably faster to answer "who does not do it" than "who does".
> http://www.dslreports.com/forum/r25679029-Why-is-my-first-hop-to-a-DoD-assigned-IP-address
> https://security.stackexchange.com/questions/116659/t-mobile-wwan-ip-address-is-dod-network-information-center
> https://www.reddit.com/r/Sprint/comments/agr9tk/why_does_the_ip_address_sprints_network_give_me/
> This is the source of urban legends saying that the NSA is spying on everyone in the entire world.
> I heard that some ISPs got in hot waters with that, because some did not believe that they hijacked DoD prefixes as an extension of RFC1918 and were convinced that said ISP was in bed with US Intelligence to spy on their subscribers.

OK, this really sounds like the twilight zone... :-)


>> As long as you don't announce it to other networks i don't see an issue.
>
> You're not the DoD. Who knows what they have in this announced space.

Yes, i have no doubt i'm not the DoD :-)
However, if someone announces me something within 30.0.0.0/8 either 
through transit or through IXP/NAP, i will probably have an issue to 
solve...


>> ARIN at least has the ability to do something,
>
> And assume the legal liability for it ?

Sure. As long as it doesn't break any contract. Do you think hijackers 
will sue ARIN by breaking their business model???


> If ARIN determines that a member has done something "bad", the hijacked 
> sues the "bad" member on the grounds that ARIN has determined that they 
> were "bad", and member sues ARIN because ARIN dared to label them "bad".

Actually, i think the proposal doesn't propose ARIN will have to determine 
anything. It should just rely on independent, multiple, expert knowledge.



> If ARIN determines that a member has not done anything "bad", then the 
> org that feels that they have been "hijacked" sues ARIN because ARIN 
> failed to recognize the "bad" part of it.

Sure, like they can sue today because ARIN is suplying an ASN which is 
used to announce/source hijacks. It doesn't really make sense for me.



> Look at the DoD example again. I don't want ARIN to be in the middle of 
> a battle between the DoD and large operators,

Are the large operators stopping anyone to communicate with the DoD?
Are they diverting packets that should go towards the DoD?
Are they announcing any slice of DoD's space to another network?


> therefore I say it's better to keep the status quo and have them sort 
> out their differences in court without ARIN being what triggered the 
> battle.

No, what can trigger something is a persistent, intentional hijack.

If anyone starts to use (towards other networks) what they want, without 
respecting _the_ registry data what's the point in maintaining a 
registry...?


Regards,
Carlos



> Michel.
>