[arin-ppml] ARIN discontinuing DNSSEC capability to legacy holders

[Bill Woodcock]

> On Oct 4, 2018, at 9:29 AM, Michael Sinatra <michael+***@burnttofu.net> wrote:
> I have received word of an apparent change in ARIN operational policy...
> ...no longer accepting DNSSEC DS records for reverse DNS for those resources that are not covered by RSA or LRSA. This is a change from current operational practice, and it effectively disables the *community's* ability to validate reverse DNS for these holders.

This is an unconscionable roll-back of a critical security feature of the Internet. This cannot be allowed to move forward.

-Bill

[John Curran]

On 4 Oct 2018, at 9:29 AM, Michael Sinatra <michael+***@burnttofu.net<mailto:michael+***@burnttofu.net>> wrote:
The change is that ARIN is (or will soon be) no longer accepting DNSSEC DS records for reverse DNS for those resources that are not covered by RSA or LRSA. This is a change from current operational practice, and it effectively disables the *community's* ability to validate reverse DNS for these holders.
...
1. That ARIN staff reverse this decision, at least for a period of time for the larger community to assess the negative value to the Internet community as a whole. And, if there was community consultation and I missed it, please let me know and please register my objection to the change in policy at this time.

Michael -

It’s an excellent issue, and ppml is a reasonable place to raise it (even if not strictly a matter of number resource policy.)

Back in 2016, we rolled out a single converged registration services agreement (i.e. the "RSA: Version 12.0 / LRSA: Version 4.0”). This RSA/LRSA contained many important changes that were requested from the community, including clarifying that the agreement is only applicable to "Included Number Resources" (i.e. the Internet number resources pursuant to the agreement, not any other number resources that parties may hold), providing uniform service terms and conditions for all customers receiving services from ARIN, elaborating on the definition of ARIN's services that are covered by the agreement, providing a more balanced agreement with respect to the terms previously seen as favorable to ARIN, and requiring that RSA changes (other than necessary to conform to law) be subject to membership approval.

As part of that rollout, we also made clear our stance regarding what services legacy resource holders get from ARIN absent any agreement – specifically, legacy resource holders get the same services that they received upon ARIN’s formation. This mirrors the decision that was made at ARIN’s formation 20 years ago to not require existing resource holders to “join ARIN", but instead to continue to provide the same services they were receiving without need for any fee or agreement. With the 2016 RSA/LRSA rollout, we made clear that legacy resource holders who wish to utilize new services would require entry into a registration services agreement with ARIN, just as with all other customers.

Now, regarding the “recent change” you reported – As it turns out, ARIN had been inconsistent in our approach to legacy holders seeking DNSSEC services over the years, and as a result there are about two dozen organizations that are legacy resource holders who are receiving DNSSEC services today from ARIN absent any registration services agreement. Earlier this year, I directed the ARIN staff to reach out to these organizations to bring them under service agreement so as to be equitable with all parties receiving ARIN services. I promptly received feedback from some of those affected organizations that they did not see that as an appropriate change, and so we are now only asking that each of them to review the revised RSA to see if it is acceptable for their use, and we are not going be turning off their existing DNSSEC services regardless of that outcome.

Thanks!
/John

John Curran
President and CEO
ARIN

[Bill Woodcock]

> On Oct 4, 2018, at 11:10 AM, John Curran <***@arin.net> wrote:
> ARIN had been inconsistent in our approach to ... DNSSEC services over the years.

There is no room for inconsistency in the application of security.

You’re entirely missing Michael’s point. DNSSEC is not a _treat_ that you dangle in front of universities, it’s an operational requirement for _the whole Internet_, of which your paying members are constituents. You’re denying _me_ the ability to use DNSSEC to validate addresses any time you prevent anyone from registering a DS record.

-Bill

[Jo Rhett]

> You’re entirely missing Michael’s point. DNSSEC is not a _treat_ that you dangle in front of universities, it’s an operational requirement for _the whole Internet_, of which your paying members are constituents. You’re denying _me_ the ability to use DNSSEC to validate addresses any time you prevent anyone from registering a DS record.

I completely and totally disagree with this assessment. What’s happening here is that you desire to not only continue to freeload when ARIN has spent decades trying to get you to play nice with others, but you want ARIN to create brand new services and then give those to you for free. You cannot claim operational impact when you have refused for 25 years to play by the rules.

Bill, I know you knew John and thus you know for a fact John would happily just cut you off for this kind of idiocy. Stop playing the aggrieved party. You aren’t aggrieved, ARIN has done nothing but bend over backwards to you for years, and you’ve done nothing but take advantage of it.

John: I’d like to address a significant elephant in this room. I don’t see how ARIN could possibly claim to provide DNSSEC authority for domains where they are unable to validate the entity currently managing the domain. Absent any such agreement, I think that continuing to provide service to these domains is a willful violation of trust on ARIN’s part, and presents a legal problem should one of these domains be abused to compromise another entity.

At no time should ARIN provide ANY service, even discussion of new services, to entities that 25 years later are still refusing to play as equals with others.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net i

[Bill Woodcock]

> On Oct 4, 2018, at 9:13 PM, Jo Rhett <***@netconsonance.com> wrote:
>
>> You’re entirely missing Michael’s point. DNSSEC is not a _treat_ that you dangle in front of universities, it’s an operational requirement for _the whole Internet_, of which your paying members are constituents. You’re denying _me_ the ability to use DNSSEC to validate addresses any time you prevent anyone from registering a DS record.
>
> What’s happening here is that you desire to not only continue to freeload when ARIN has spent decades trying to get you to play nice with others, but you want ARIN to create brand new services and then give those to you for free. You cannot claim operational impact when you have refused for 25 years to play by the rules.

I’m sorry, could you elaborate on each of those points?

How exactly am I freeloading, how am I not playing “nicely with others” or “by the rules,” and how am I not operationally impacted if there’s someone out there who’s not allowed to insert a DS record into a parent zone?

I eagerly await your answer.

-Bill

[Jo Rhett]

> How exactly am I freeloading, how am I not playing “nicely with others” or “by the rules,”

Google yourself. I’ve been watching you fight to ride free because you got addresses (like most of us on this back) back from Jon directly when this was easy. The difference is that 25 years ago a new entity was created to manage this service. A number of legitimate concerns about the new contracts were raised and dealt with. But 25 years later you have nothing left to say about the contract limiting you, but you don’t want to sign it.

Any other service would have discontinued service to you years ago, and sure as hell even easy, casual Jon would have done it decades ago.

John Curran: I personally resent that 25 years later you’re still wasting significant time and money on what, ~100 assignees who refuse to come to the table. I don’t feel that our fees should go towards supporting these efforts.

I absolutely stand against providing them any further services. This horse was dead two decades ago. Bury it and them.

> how am I not operationally impacted if there’s someone out there who’s not allowed to insert a DS record into a parent zone?

I hope you are significantly operationally impacted. Nobody is required to give you anything, Bill. It wasn’t true in Jon’s day, and it’s not true now. If you won’t play the rules, there is no requirement that service is provided to you.
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please

[Bill Woodcock]

> On Oct 4, 2018, at 9:27 PM, Jo Rhett <***@netconsonance.com> wrote:
>
>> How exactly am I freeloading, how am I not playing “nicely with others” or “by the rules,”
>
> I’ve been watching you fight to ride free

Cite an example, please.

> If you won’t play the rules, there is no requirement that service is provided to you.

Earlier you claimed that I _was not_ “playing by the rules.” Are you trying to retract that, rather than substantiating it, by re-phrasing it as a conditional?

> you got addresses back from Jon directly

You are factually incorrect. I have received addresses from DoDNIC, through M&A, from ARIN, APNIC, LACNIC, and AfriNIC.

> 25 years ago a new entity was created to manage this service.

Are you referring to APNIC? Please be more specific.

> You have nothing left to say about the contract limiting you, but you don’t want to sign it.

What contract, specifically, is it that you think I “don’t want to sign?”

> I hope you are significantly operationally impacted.

Perhaps you’ll recognize that ARIN, as a membership organization, does not exist for the purpose of creating down-time for people you’ve decided that you don’t like.

-Bill

[Jo Rhett]

Bill, stop playing this nonsense. I referred to and respect your history, your attempt to play innocent is contemptible.

I’ve never once advocated for anyone to be cut off. I have advocated that those who refuse to follow the rules agreed upon decades ago without a justifiable reason should be cut off. I’m not going to give you any more podium for this. ARIN has work to do for its real customers.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

> On Oct 4, 2018, at 9:39 PM, Bill Woodcock <***@pch.net> wrote:
>> On Oct 4, 2018, at 9:27 PM, Jo Rhett <***@netconsonance.com> wrote:
>>
>>> How exactly am I freeloading, how am I not playing “nicely with others” or “by the rules,”
>>
>> I’ve been watching you fight to ride free
>
> Cite an example, please.
>
>> If you won’t play the rules, there is no requirement that service is provided to you.
>
> Earlier you claimed that I _was not_ “playing by the rules.” Are you trying to retract that, rather than substantiating it, by re-phrasing it as a conditional?
>
>> you got addresses back from Jon directly
>
> You are factually incorrect. I have received addresses from DoDNIC, through M&A, from ARIN, APNIC, LACNIC, and AfriNIC.
>
>> 25 years ago a new entity was created to manage this service.
>
> Are you referring to APNIC? Please be more specific.
>
>> You have nothing left to say about the contract limiting you, but you don’t want to sign it.
>
> What contract, specifically, is it that you think I “don’t want to sign?”
>
>> I hope you are significantly operationally impacted.
>
> Perhaps you’ll recognize that ARIN, as a membership organization, does not exist for the purpose of creating down-time for people you’ve decided that you don’t like.
>
> -Bill
>

[Job Snijders]

I’d like to ask the participants in this conversation to be excellent to
each other. Ad-hominem arguments don’t fundamentally contribute, or further
the discussion.

[Bill Woodcock]

On Oct 4, 2018, at 21:44, Jo Rhett <***@netconsonance.com> wrote:
> Bill, stop playing this nonsense. I referred to and respect your history, your attempt to play innocent is contemptible.

Mr. Rhett:

This exchange was, at first, mildly amusing. I thought that you were, perhaps, just in a foul mood, and that a Socratic dialog might lead you out of it. But your replies are non-responsive, and this is becoming tedious. Time to wrap it up.

You’ve made nonspecific and unsubstantiated allegations of wrongdoing.

You have two alternatives which will not lead to my asking the mailing list committee to sanction you for ToS violation:

Either state your allegation clearly and substantiate it, or withdraw it and apologize.

-Bill



_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@ar

[Jo Rhett]

On Oct 5, 2018, at 5:17 AM, Bill Woodcock <***@pch.net> wrote:
> On Oct 4, 2018, at 21:44, Jo Rhett <***@netconsonance.com> wrote:
>> Bill, stop playing this nonsense. I referred to and respect your history, your attempt to play innocent is contemptible.
>
> This exchange was, at first, mildly amusing. I thought that you were, perhaps, just in a foul mood, and that a Socratic dialog might lead you out of it. But your replies are non-responsive, and this is becoming tedious. Time to wrap it up.
>
> You’ve made nonspecific and unsubstantiated allegations of wrongdoing.

I was very explicit. You attempted to distract my very explicit, clearly phrased statement with a wide array of unrelated, never-mentioned topics. I referred to that debate tactic as contemptible, which is a characterization of a practice well known and proscribed in all professional venues.

> You have two alternatives which will not lead to my asking the mailing list committee to sanction you for ToS violation:
> Either state your allegation clearly and substantiate it, or withdraw it and apologize.


I can find no evidence of a ToS for this mailing list. There is an AUP at https://www.arin.net/participate/mailing_lists/aup.html.

I take this threat very seriously and plan to submit a full, detailed response. I will supply a complete outline of my statements and Bill's responses and how I understand their compliance (and not) within the AUP, as soon as I have the time to create this documentation (not likely today).

I can demonstrate that I have not wilfully violated or attempted to violate the AUP, but that Bill has done so repeatedly and tactically, and has even committed several violations in this fabricated complaint.

I'll submit my response to ***@arin.net within 5 business days.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[William Herrin]

On Fri, Oct 5, 2018 at 12:13 AM Jo Rhett <***@netconsonance.com> wrote:
> What’s happening here is that you desire to not only continue to freeload when
> ARIN has spent decades trying to get you to play nice with others, but you
> want ARIN to create brand new services and then give those to you for free.

Every time the toxic arguments about legacy holders rear their head on
PPML I become more convinced that the legacy holdings should be forked
off to a distinct registry. Let legacy registrants sign a contract (or
not) which establishes no obligations on the registrant's part and buy
services (or not) as they choose. And let ARIN be ARIN without the
baggage.

As long as the legacy registrants are within ARIN, the fairness
question will remain unresolvable. It's not fair that modern
registrants face compulsions under an adhesion contract while older
registrants do not. Nor is it fair to expect older registrants to
accept an adhesion contract whose compulsive nature was not so much as
a gleam in anyone's eye when they joined the ranks of TCP/IP users.

Regards,
Bill Herrin


--
William Herrin ................ ***@dirtside.com ***@herrin.us
Dirtside Systems ......... Web: <http://www.dirtside.com/>
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.ne

[h***@uneedus.com]

He did not mention an AS number. Being a small player, he might like
myself get away with using one of the AS's in the private network range,
or might just be single homed, in which case he does not need it.

As to spinning off the Legacy holders to another registry, I do not think
this is fair either. ARIN knew from its beginning that there would be
legacy holders to be served, and that they could not "force" them to pay.

As to the amount of "work" that is required to maintain reverse dns, it is
certainly true there is very little without signing. In most cases, as
long as the reverse name servers do not change names, it would be many
years between any updates. With signing, there would be a bit more, but
is not that done with the same automation that was written to support the
RSA holders? Annual verification is ARIN policy. Since it was not
required when legacy holders received their numbers, that cost is solely
an ARIN cost. If ARIN does not want to pay it, simply stop verifying the
legacy holders.

In order to calculate fair costs to "use" the ARIN systems to update the
signing keys I need to know some facts. What is the number of these
"legacy" holders, and what is the total number of holders in total? Also,
what is the cost to operate this system per year?

I suspect we are talking a small number when the numbers are calculated.

I ask these things in respect to ALL legacy holders. While inspired by
the recent discussion, putting this person aside does not change the
overall issue in addressing signing in regard to legacy holders.

The complete answer lies in retirement of IPv4, but I doubt we will get
there in my lifetime.

Albert Erdmann
Network Administrator
Paradise On Line Inc.


On Fri, 5 Oct 2018, William Herrin wrote:

> On Fri, Oct 5, 2018 at 12:13 AM Jo Rhett <***@netconsonance.com> wrote:
>> What’s happening here is that you desire to not only continue to freeload when
>> ARIN has spent decades trying to get you to play nice with others, but you
>> want ARIN to create brand new services and then give those to you for free.
>
> Every time the toxic arguments about legacy holders rear their head on
> PPML I become more convinced that the legacy holdings should be forked
> off to a distinct registry. Let legacy registrants sign a contract (or
> not) which establishes no obligations on the registrant's part and buy
> services (or not) as they choose. And let ARIN be ARIN without the
> baggage.
>
> As long as the legacy registrants are within ARIN, the fairness
> question will remain unresolvable. It's not fair that modern
> registrants face compulsions under an adhesion contract while older
> registrants do not. Nor is it fair to expect older registrants to
> accept an adhesion contract whose compulsive nature was not so much as
> a gleam in anyone's eye when they joined the ranks of TCP/IP users.
>
> Regards,
> Bill Herrin
>
>
> --
> William Herrin ................ ***@dirtside.com ***@herrin.us
> Dirtside Systems ......... Web: <http://www.dirtside.com/>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.
>

[Steven Ryerse]

It would be interesting to know how many of each size legacy holders that haven't signed are still out there. What about the big holders like AT&T and others that have /8's and other large sized blocks? Have they all signed an LSRA/RSA? I think legacy holders want to be treated the same way (equally) - so if even one of the /8 holders hasn't signed then the /24 holders should not be forced to sign. The /8 holders have legions of attorneys but the /24 holders don't.


Steven Ryerse
President
100 Ashford Center North, Suite 110, Atlanta, GA  30338
770.656.1460 - Cell
770.399.9099 - Office
770.392.0076 - Fax

℠ Eclipse Networks, Inc.
        Conquering Complex Networks℠

-----Original Message-----
From: ARIN-PPML <arin-ppml-***@arin.net> On Behalf Of ***@uneedus.com
Sent: Friday, October 5, 2018 8:30 AM
To: arin-***@arin.net
Subject: Re: [arin-ppml] ARIN discontinuing DNSSEC capability to legacy holders

He did not mention an AS number. Being a small player, he might like myself get away with using one of the AS's in the private network range, or might just be single homed, in which case he does not need it.

As to spinning off the Legacy holders to another registry, I do not think this is fair either. ARIN knew from its beginning that there would be legacy holders to be served, and that they could not "force" them to pay.

As to the amount of "work" that is required to maintain reverse dns, it is certainly true there is very little without signing. In most cases, as long as the reverse name servers do not change names, it would be many years between any updates. With signing, there would be a bit more, but is not that done with the same automation that was written to support the RSA holders? Annual verification is ARIN policy. Since it was not required when legacy holders received their numbers, that cost is solely an ARIN cost. If ARIN does not want to pay it, simply stop verifying the legacy holders.

In order to calculate fair costs to "use" the ARIN systems to update the signing keys I need to know some facts. What is the number of these "legacy" holders, and what is the total number of holders in total? Also, what is the cost to operate this system per year?

I suspect we are talking a small number when the numbers are calculated.

I ask these things in respect to ALL legacy holders. While inspired by the recent discussion, putting this person aside does not change the overall issue in addressing signing in regard to legacy holders.

The complete answer lies in retirement of IPv4, but I doubt we will get there in my lifetime.

Albert Erdmann
Network Administrator
Paradise On Line Inc.


On Fri, 5 Oct 2018, William Herrin wrote:

> On Fri, Oct 5, 2018 at 12:13 AM Jo Rhett <***@netconsonance.com> wrote:
>> What’s happening here is that you desire to not only continue to
>> freeload when ARIN has spent decades trying to get you to play nice
>> with others, but you want ARIN to create brand new services and then give those to you for free.
>
> Every time the toxic arguments about legacy holders rear their head on
> PPML I become more convinced that the legacy holdings should be forked
> off to a distinct registry. Let legacy registrants sign a contract (or
> not) which establishes no obligations on the registrant's part and buy
> services (or not) as they choose. And let ARIN be ARIN without the
> baggage.
>
> As long as the legacy registrants are within ARIN, the fairness
> question will remain unresolvable. It's not fair that modern
> registrants face compulsions under an adhesion contract while older
> registrants do not. Nor is it fair to expect older registrants to
> accept an adhesion contract whose compulsive nature was not so much as
> a gleam in anyone's eye when they joined the ranks of TCP/IP users.
>
> Regards,
> Bill Herrin
>
>
> --
> William Herrin ................ ***@dirtside.com ***@herrin.us
> Dirtside Systems ......... Web: <http://www.dirtside.com/>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to the ARIN
> Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.
>
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience a

[John Curran]

On 5 Oct 2018, at 7:00 AM, Steven Ryerse <***@eclipse-networks.com> wrote:
>
> It would be interesting to know how many of each size legacy holders that haven't signed are still out there. What about the big holders like AT&T and others that have /8's and other large sized blocks? Have they all signed an LSRA/RSA? I think legacy holders want to be treated the same way (equally) - so if even one of the /8 holders hasn't signed then the /24 holders should not be forced to sign. The /8 holders have legions of attorneys but the /24 holders don't.

Steven -

We don’t publicly provide contracting or invoicing information specific to individual organizations, but the total number of ARIN resources not-under-agreement (as opposed to RSA/LRSA) continues to drop and the number under agreement continue to rise; we’ll present that trend later today at the ARIN meeting.

Note that this is indicative both of legacy resource holders coming under agreement with ARIN, but more so large legacy resources being transferred to other parties (and thus no longer being legacy number resources as they’re not held by the original registrant or their legal successor.)

Thanks!
/John

John Curran
President and CEO
ARIN


_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Plea

[Steven Ryerse]

So then without telling us who, are there any /8 holders that have not signed an LSRA/RSA? What about the government /8 block holders?


Steven Ryerse
President
100 Ashford Center North, Suite 110, Atlanta, GA  30338
770.656.1460 - Cell
770.399.9099 - Office
770.392.0076 - Fax

℠ Eclipse Networks, Inc.
        Conquering Complex Networks℠

-----Original Message-----
From: John Curran <***@arin.net>
Sent: Friday, October 5, 2018 10:21 AM
To: Steven Ryerse <***@eclipse-networks.com>
Cc: ***@uneedus.com; arin-***@arin.net
Subject: Re: [arin-ppml] ARIN discontinuing DNSSEC capability to legacy holders

On 5 Oct 2018, at 7:00 AM, Steven Ryerse <***@eclipse-networks.com> wrote:
>
> It would be interesting to know how many of each size legacy holders that haven't signed are still out there. What about the big holders like AT&T and others that have /8's and other large sized blocks? Have they all signed an LSRA/RSA? I think legacy holders want to be treated the same way (equally) - so if even one of the /8 holders hasn't signed then the /24 holders should not be forced to sign. The /8 holders have legions of attorneys but the /24 holders don't.

Steven -

We don’t publicly provide contracting or invoicing information specific to individual organizations, but the total number of ARIN resources not-under-agreement (as opposed to RSA/LRSA) continues to drop and the number under agreement continue to rise; we’ll present that trend later today at the ARIN meeting.

Note that this is indicative both of legacy resource holders coming under agreement with ARIN, but more so large legacy resources being transferred to other parties (and thus no longer being legacy number resources as they’re not held by the original registrant or their legal successor.)

Thanks!
/John

John Curran
President and CEO
ARIN


_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact info

[John Curran]

On 5 Oct 2018, at 7:24 AM, Steven Ryerse <***@eclipse-networks.com<mailto:***@eclipse-networks.com>> wrote:

So then without telling us who, are there any /8 holders that have not signed an LSRA/RSA? What about the government /8 block holders?

Steven -

Government agencies are often ARIN members, and thus show up on ARIN’s membership list - https://www.arin.net/public/memberList.xhtml

FYI,
/John

John Curran
President and CEO
ARIN

[h***@uneedus.com]

The member list does not help, as I understand that many legacy holders
have other resources that are not legacy such as IPv6 holdings and thus
are members as well. Of course if they are a member, it it hard to
complain about them having legacy resources, when they are otherwise a
member.

Since you have admitted that the number is trending downward, this also
means the costs associated also are trending downward as well. We also
know in a IPv6 only world, there are no legacy resources, but it will be a
long time (if ever) before we get there.

At the current trend, how many years before the legacy costs are not even
noticable on the radar? I think we spend more energy on this than it is
worth, and if we reach the IPv6 goal, it is self resolving.

Albert Erdmann
Network Administrator
Paradise On Line Inc.



On Fri, 5 Oct 2018, John Curran wrote:

> On 5 Oct 2018, at 7:24 AM, Steven Ryerse <***@eclipse-networks.com<mailto:***@eclipse-networks.com>> wrote:
>
> So then without telling us who, are there any /8 holders that have not signed an LSRA/RSA? What about the government /8 block holders?
>
> Steven -
>
> Government agencies are often ARIN members, and thus show up on ARIN’s membership list - https://www.arin.net/public/memberList.xhtml
>
> FYI,
> /John
>
> John Curran
> President and CEO
> ARIN
>
>
>

[Steven Ryerse]

It does give us a better view and understanding of the Legacy issue which comes up here from time to time.

John the link to the Members is helpful but it doesn't answer my question if there are any /8 who have not signed LLRSA/RSA's??


Steven Ryerse
President
100 Ashford Center North, Suite 110, Atlanta, GA  30338
770.656.1460 - Cell
770.399.9099 - Office
770.392.0076 - Fax

℠ Eclipse Networks, Inc.
        Conquering Complex Networks℠

-----Original Message-----
From: ARIN-PPML <arin-ppml-***@arin.net> On Behalf Of ***@uneedus.com
Sent: Friday, October 5, 2018 11:15 AM
To: arin-***@arin.net
Subject: Re: [arin-ppml] ARIN discontinuing DNSSEC capability to legacy holders

The member list does not help, as I understand that many legacy holders have other resources that are not legacy such as IPv6 holdings and thus are members as well. Of course if they are a member, it it hard to complain about them having legacy resources, when they are otherwise a member.

Since you have admitted that the number is trending downward, this also means the costs associated also are trending downward as well. We also know in a IPv6 only world, there are no legacy resources, but it will be a long time (if ever) before we get there.

At the current trend, how many years before the legacy costs are not even noticable on the radar? I think we spend more energy on this than it is worth, and if we reach the IPv6 goal, it is self resolving.

Albert Erdmann
Network Administrator
Paradise On Line Inc.



On Fri, 5 Oct 2018, John Curran wrote:

> On 5 Oct 2018, at 7:24 AM, Steven Ryerse <***@eclipse-networks.com<mailto:***@eclipse-networks.com>> wrote:
>
> So then without telling us who, are there any /8 holders that have not signed an LSRA/RSA? What about the government /8 block holders?
>
> Steven -
>
> Government agencies are often ARIN members, and thus show up on
> ARIN’s membership list -
> https://www.arin.net/public/memberList.xhtml
>
> FYI,
> /John
>
> John Curran
> President and CEO
> ARIN
>
>
>
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you expe

[John Curran]

On 5 Oct 2018, at 8:22 AM, Steven Ryerse <***@eclipse-networks.com<mailto:***@eclipse-networks.com>> wrote:

It does give us a better view and understanding of the Legacy issue which comes up here from time to time.

John the link to the Members is helpful but it doesn't answer my question if there are any /8 who have not signed LLRSA/RSA's??

Steve -

It’s mixed - we have legacy resource holders who have signed a registration services agreement, and there are legacy resource holders who still have not signed a registration services agreement. Activity in the transfer market makes the number not under agreement an ever-decreasing number.

Regarding coverage over time, the relevant graphic is attached.

/John

John Curran
President and CEO
ARIN


[cid:D89709BB-249C-4CF6-A696-***@meetings.nanog.org]

[Matthew Kaufman]

Thanks for the stats... from all the handwaving about how most people have
signed I would've guessed a whole lot lower than 40%!

Matthew Kaufman

On Fri, Oct 5, 2018 at 9:30 AM John Curran <***@arin.net> wrote:

> On 5 Oct 2018, at 8:22 AM, Steven Ryerse <***@eclipse-networks.com>
> wrote:
>
>
> It does give us a better view and understanding of the Legacy issue which
> comes up here from time to time.
>
> John the link to the Members is helpful but it doesn't answer my question
> if there are any /8 who have not signed LLRSA/RSA's??
>
>
> Steve -
>
> It’s mixed - we have legacy resource holders who have signed a
> registration services agreement, and there are legacy resource holders who
> still have not signed a registration services agreement. Activity in the
> transfer market makes the number not under agreement an ever-decreasing
> number.
>
> Regarding coverage over time, the relevant graphic is attached.
>
> /John
>
> John Curran
> President and CEO
> ARIN
>
>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.
>

[h***@uneedus.com]

Forty-one percent is NOT a low number, which is likely why ARIN is trying
hard to get more entities to sign an LRSA/RSAA. So much for thinking this
issue will go away sometime in my lifetime.

However, I suspect most of the /24's reflected in the chart are actually
part of those /8's that we have been discussing and that a small holder of
just 2 /24's such as the one that started this thread are in fact VERY
rare. I also suspect that a majority of that 41.3% are in fact members
because of receiving other resources.

Knowing the balance between members and non members is important in
understanding how important this issue is to the community.

Is there any statistics on:

Total number of entities who hold legacy resources?

Average number of /24's of legacy space that these entities hold?

Total number of these entities that hold a /22 or less of legacy space?

Total number of these entities that hold an /8 or more of legacy space?

Percent of /24's that do not pay dues at all?

Albert Erdmann
Network Administrator
Paradise On Line Inc.

On Fri, 5 Oct 2018, Matthew Kaufman wrote:

> Thanks for the stats... from all the handwaving about how most people have
> signed I would've guessed a whole lot lower than 40%!
>
> Matthew Kaufman
>
> On Fri, Oct 5, 2018 at 9:30 AM John Curran <***@arin.net> wrote:
>
>> On 5 Oct 2018, at 8:22 AM, Steven Ryerse <***@eclipse-networks.com>
>> wrote:
>>
>>
>> It does give us a better view and understanding of the Legacy issue which
>> comes up here from time to time.
>>
>> John the link to the Members is helpful but it doesn't answer my question
>> if there are any /8 who have not signed LLRSA/RSA's??
>>
>>
>> Steve -
>>
>> It’s mixed - we have legacy resource holders who have signed a
>> registration services agreement, and there are legacy resource holders who
>> still have not signed a registration services agreement. Activity in the
>> transfer market makes the number not under agreement an ever-decreasing
>> number.
>>
>> Regarding coverage over time, the relevant graphic is attached.
>>
>> /John
>>
>> John Curran
>> President and CEO
>> ARIN
>>
>>
>> _______________________________________________
>> ARIN-PPML
>> You are receiving this message because you are subscribed to
>> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
>> Unsubscribe or manage your mailing list subscription at:
>> https://lists.arin.net/mailman/listinfo/arin-ppml
>> Please contact ***@arin.net if you experience any issues.
>>
>

[John Curran]

On 5 Oct 2018, at 10:58 AM, ***@uneedus.com wrote:
>
> Forty-one percent is NOT a low number, which is likely why ARIN is trying hard to get more entities to sign an LRSA/RSAA. So much for thinking this issue will go away sometime in my lifetime.

Albert -

ARIN isn’t particularly “trying hard” to get entities to sign a registration services agreement – we inform legacy resources holders of its availability and the fact that under it that they'll receive our registration services with the maintenance fees per end-users, only with a cap on their total invoice due to legacy status <https://www.arin.net/fees/fee_schedule.html#legacy_fee>

We also inform them of the registry services that they receive if they are not under a registration services agreement <https://www.arin.net/resources/legacy/services.html>

> However, I suspect most of the /24's reflected in the chart are actually part of those /8's that we have been discussing and that a small holder of just 2 /24's such as the one that started this thread are in fact VERY rare. I also suspect that a majority of that 41.3% are in fact members because of receiving other resources.

Quite likely, and particularly as more organizations come and get IPv6 number resources.

I’ll note that you use the term “members”, whereas you probably mean contracted customers – end-user organizations and legacy holders with agreements are “customers”, as opposed to legacy resource holders receiving basic services (who are effectively “customers w/o contract”)

The term “ARIN Member” applies generally to ISPs (who via their Registration Services Plan often are paying significantly more for registry services) and those end-users/legacy holders who opt to become ARIN Members or become ARIN Members by opting for a Registration Services Plan.

> Knowing the balance between members and non members is important in understanding how important this issue is to the community.
>
> Is there any statistics on:
>
> Total number of entities who hold legacy resources?
>
> Average number of /24's of legacy space that these entities hold?
>
> Total number of these entities that hold a /22 or less of legacy space?
>
> Total number of these entities that hold an /8 or more of legacy space?
>
> Percent of /24's that do not pay dues at all?

We will research and prepare some statistics regarding block distribution among legacy resource holders.

Thanks!
/John

John Curran
President and CEO
ARIN



_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@ar

[David Farmer]

On Thu, Oct 4, 2018 based on the
at 1:15 PM Bill Woodcock <***@pch.net> wrote:

> > On Oct 4, 2018, at 11:10 AM, John Curran <***@arin.net> wrote:
> > ARIN had been inconsistent in our approach to ... DNSSEC services over
> the years.
>
> There is no room for inconsistency in the application of security.
>
> You’re entirely missing Michael’s point. DNSSEC is not a _treat_ that you
> dangle in front of universities, it’s an operational requirement for _the
> whole Internet_, of which your paying members are constituents. You’re
> denying _me_ the ability to use DNSSEC to validate addresses any time you
> prevent anyone from registering a DS record.
>
> -Bill


This is a complicated problem. DNSsec is about identity and is not merely
a technical protocol. It requires that trust is built and maintained
between the entities in the DNS tree, this trust is structured heretically
so that everyone doesn't have to maintain trust with everyone else. Through
this heretical structure, trust is built through validating and certifying
the parties involved and this trust is then legally enshrined in contracts
between the entities involved. The fact that the other parties in the tree
have contracted with the entity higher in the tree, in this case, ARIN, is
why you can trust them. Without those contracts, there is no way to enforce
consequences for misbehavior and the trust will eventually be broken. The
contracts are the basis for the trust needed by the system and without this
trust, there is no need for the DNSsec protocol.

ARIN has to have contracts with all entities participating in DNSSec and
RPKI through it for the schemes to work, even that may not be enough to for
these schemes to work, but without that there is no way for these schemes
to work.

The financial issues are completely separate from why contracts are
necessary. However, life sure is easier when everyone is paying their fair
share, but in this case, I don't think fair needs to be an equal share.

Thanks.

--
===============================================
David Farmer Email:***@umn.edu
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota
2218 University Ave SE Phone: [phone]
Minneapolis, MN 55414-3029 Cell: 612-812-9952
===============================================

[Mark Andrews]

> On 5 Oct 2018, at 3:52 pm, David Farmer <***@umn.edu> wrote:
>
>
> On Thu, Oct 4, 2018 based on the
> at 1:15 PM Bill Woodcock <***@pch.net> wrote:
> > On Oct 4, 2018, at 11:10 AM, John Curran <***@arin.net> wrote:
> > ARIN had been inconsistent in our approach to ... DNSSEC services over the years.
>
> There is no room for inconsistency in the application of security.
>
> You’re entirely missing Michael’s point. DNSSEC is not a _treat_ that you dangle in front of universities, it’s an operational requirement for _the whole Internet_, of which your paying members are constituents. You’re denying _me_ the ability to use DNSSEC to validate addresses any time you prevent anyone from registering a DS record.
>
> -Bill
>
> This is a complicated problem. DNSsec is about identity and is not merely a technical protocol. It requires that trust is built and maintained between the entities in the DNS tree, this trust is structured heretically so that everyone doesn't have to maintain trust with everyone else. Through this heretical structure, trust is built through validating and certifying the parties involved and this trust is then legally enshrined in contracts between the entities involved. The fact that the other parties in the tree have contracted with the entity higher in the tree, in this case, ARIN, is why you can trust them. Without those contracts, there is no way to enforce consequences for misbehavior and the trust will eventually be broken. The contracts are the basis for the trust needed by the system and without this trust, there is no need for the DNSsec protocol.

If ARIN will update/add NS records then they should update/ns DS records. THERE IS ZERO DIFFERENCE IN THE TRUST REQUIRED. DNSSEC does not magically require that you need
to do more diligence before making a change. If ARIN is willing to change NS records then
whatever requirements they have to permit that change is ALL they should need to permit DS
records to be changed.

> ARIN has to have contracts with all entities participating in DNSSec and RPKI through it for the schemes to work, even that may not be enough to for these schemes to work, but without that there is no way for these schemes to work.
>
> The financial issues are completely separate from why contracts are necessary. However, life sure is easier when everyone is paying their fair share, but in this case, I don't think fair needs to be an equal share.
>
> Thanks.
> --
> ===============================================
> David Farmer Email:***@umn.edu
> Networking & Telecommunication Services
> Office of Information Technology
> University of Minnesota
> 2218 University Ave SE Phone: [phone]
> Minneapolis, MN 55414-3029 Cell: 612-812-9952
> ===============================================
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone] INTERNET: ***@isc.org

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[John Curran]

On 5 Oct 2018, at 11:03 AM, Michael Sinatra <michael+***@burnttofu.net> wrote:
> ...
> That said, I am interested in hearing from David F. or John C. as to what kinds of background research is initiated when a (L)RSA is initiated. (Sorry, I arrived at $current_employer only as the execution of the contracts was being completed.) I know that there's a process for when a specified transfer occurs, and that process *includes* a (L)RSA, but does the (L)RSA trigger the background/history check or is it the other way around?


Michael -

Entry into a registration services agreement can only occur once the organization’s rights to the number resources have been vetted. ARIN follows the rights from their original issuance to an organization, thru various changes (e.g. mergers/acquisitions) to the party that presently claims those rights, and this process involved verifying records regarding the legal entity (e.g. incorporation/state filing) and that the contact is authorized to represent the organization. It is fairly rigorous, since we’d like to avoid bad actors coming in and transferring rights to address blocks that they don’t have…

Thanks!
/John

John Curran
President and CEO
ARIN





_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact info@

[David Farmer]

On Fri, Oct 5, 2018 at 7:49 PM John Curran <***@arin.net> wrote:

> On 5 Oct 2018, at 11:03 AM, Michael Sinatra <michael+***@burnttofu.net>
> wrote:
> > ...
> > That said, I am interested in hearing from David F. or John C. as to
> what kinds of background research is initiated when a (L)RSA is initiated.
> (Sorry, I arrived at $current_employer only as the execution of the
> contracts was being completed.) I know that there's a process for when a
> specified transfer occurs, and that process *includes* a (L)RSA, but does
> the (L)RSA trigger the background/history check or is it the other way
> around?
>
>
> Michael -
>
> Entry into a registration services agreement can only occur once the
> organization’s rights to the number resources have been vetted. ARIN
> follows the rights from their original issuance to an organization, thru
> various changes (e.g. mergers/acquisitions) to the party that presently
> claims those rights, and this process involved verifying records regarding
> the legal entity (e.g. incorporation/state filing) and that the contact is
> authorized to represent the organization. It is fairly rigorous, since
> we’d like to avoid bad actors coming in and transferring rights to address
> blocks that they don’t have

>

The only thing I'd add to this is when large well-known entities, like
universities or goverment agencies, are involved this vetting is usually
fairly simple. It could be more complicated if the resource were in the
name of a project and not the entity itself. But, other than that, the
hardest part is ensuring ARIN is dealing with someone who is properly
authorized to speak for the large well-known entity.

Thanks.

--
===============================================
David Farmer Email:***@umn.edu
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota
2218 University Ave SE Phone: [phone]
Minneapolis, MN 55414-3029 Cell: 612-812-9952
===============================================

[Paul Andersen]

Bill,

I am personally fully committed to universal DNSSEC, and I believe that this practice deleteriously affects all ARIN members, not just legacy ones. I hope that discussion on this list will indicate a clear community consensus, so that the board can ensure that staff act upon that input.

Cheers,

Paul


> On Oct 4, 2018, at 2:00 PM, Bill Woodcock <***@pch.net> wrote:
>
>
>
>> On Oct 4, 2018, at 9:29 AM, Michael Sinatra <michael+***@burnttofu.net> wrote:
>> I have received word of an apparent change in ARIN operational policy...
>> ...no longer accepting DNSSEC DS records for reverse DNS for those resources that are not covered by RSA or LRSA. This is a change from current operational practice, and it effectively disables the *community's* ability to validate reverse DNS for these holders.
>
> This is an unconscionable roll-back of a critical security feature of the Internet. This cannot be allowed to move forward.
>
> -Bill
>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[h***@uneedus.com]

I agree that we clearly need universal DNSSEC, and ARIN should not take
actions that inhibit universal DNSSEC.

I understand that ARIN has taken actions to try to get the remaining
legacy holders to move to an RSA. While this might be seen as a "carrot"
to try to move these holders to an RSA, it is actually more like a "stick"
to the rest of the community.

Please do not do anything to stop universal DNSSEC in any form.

Albert Erdmann
Network Administrator
Paradise On Line Inc.

On Thu, 4 Oct 2018, Paul Andersen wrote:

> Bill,
>
> I am personally fully committed to universal DNSSEC, and I believe that this practice deleteriously affects all ARIN members, not just legacy ones. I hope that discussion on this list will indicate a clear community consensus, so that the board can ensure that staff act upon that input.
>
> Cheers,
>
> Paul
>
>
>> On Oct 4, 2018, at 2:00 PM, Bill Woodcock <***@pch.net> wrote:
>>
>>
>>
>>> On Oct 4, 2018, at 9:29 AM, Michael Sinatra <michael+***@burnttofu.net> wrote:
>>> I have received word of an apparent change in ARIN operational policy...
>>> ...no longer accepting DNSSEC DS records for reverse DNS for those resources that are not covered by RSA or LRSA. This is a change from current operational practice, and it effectively disables the *community's* ability to validate reverse DNS for these holders.
>>
>> This is an unconscionable roll-back of a critical security feature of the Internet. This cannot be allowed to move forward.
>>
>> -Bill
>>
>> _______________________________________________
>> ARIN-PPML
>> You are receiving this message because you are subscribed to
>> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
>> Unsubscribe or manage your mailing list subscription at:
>> https://lists.arin.net/mailman/listinfo/arin-ppml
>> Please contact ***@arin.net if you experience any issues.
>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.
>
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[Brian Reid]

I am a legacy holder of two /24s. I use them.
I have not signed the agreement.
The issue for me is 100% financial. The price is too high.
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[Jo Rhett]

> I agree that we clearly need universal DNSSEC, and ARIN should not take actions that inhibit universal DNSSEC.

“Universal” DNSSEC where some parties are unauthenticated is worse than useless.

Validation and certification of the resource holder is critical. These two dozen entities are refusing to validate or certify themselves. They should not be authoritatively signed by ARIN.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.


_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net

[Matthew Kaufman]

Ever since the "legacy resource holders get the same services that they
received upon ARIN’s formation" we knew it was only a matter of time before
some new-but-now-critical service (RPKI, DNSSEC, addition of some required
new Whois field, etc.) was denied to them. The "stick" part of the "carrot
and stick" approach to getting people to sign a service agreement.

The addresses I use are not under a service agreement, and I will continue
to use them, (and fight for them to be fully usable no matter what new
features become mandatory for a registrar to support against an address
block for the operator community to route or otherwise accept that block)
without such agreement, to communicate on the Internet.

Matthew Kaufman


On Thu, Oct 4, 2018 at 11:28 AM Paul Andersen <***@arin.net> wrote:

> Bill,
>
> I am personally fully committed to universal DNSSEC, and I believe that
> this practice deleteriously affects all ARIN members, not just legacy ones.
> I hope that discussion on this list will indicate a clear community
> consensus, so that the board can ensure that staff act upon that input.
>
> Cheers,
>
> Paul
>
>
> > On Oct 4, 2018, at 2:00 PM, Bill Woodcock <***@pch.net> wrote:
> >
> >
> >
> >> On Oct 4, 2018, at 9:29 AM, Michael Sinatra <michael+***@burnttofu.net>
> wrote:
> >> I have received word of an apparent change in ARIN operational policy...
> >> ...no longer accepting DNSSEC DS records for reverse DNS for those
> resources that are not covered by RSA or LRSA. This is a change from
> current operational practice, and it effectively disables the *community's*
> ability to validate reverse DNS for these holders.
> >
> > This is an unconscionable roll-back of a critical security feature of
> the Internet. This cannot be allowed to move forward.
> >
> > -Bill
> >
> > _______________________________________________
> > ARIN-PPML
> > You are receiving this message because you are subscribed to
> > the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> > Unsubscribe or manage your mailing list subscription at:
> > https://lists.arin.net/mailman/listinfo/arin-ppml
> > Please contact ***@arin.net if you experience any issues.
>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.
>

[Matthew Kaufman]

For me the financial price is too high *and* I didn't want to be on the
wrong side when someone decided they might be a real asset.

Now that I've whittled my holdings down to what I need for my own purposes,
it is just financial, like Brian.

ps. That's also why I haven't moved these networks to PI IPv6 space.


On Thu, Oct 4, 2018 at 12:09 PM Matthew Kaufman <***@matthew.at> wrote:

> Ever since the "legacy resource holders get the same services that they
> received upon ARIN’s formation" we knew it was only a matter of time before
> some new-but-now-critical service (RPKI, DNSSEC, addition of some required
> new Whois field, etc.) was denied to them. The "stick" part of the "carrot
> and stick" approach to getting people to sign a service agreement.
>
> The addresses I use are not under a service agreement, and I will continue
> to use them, (and fight for them to be fully usable no matter what new
> features become mandatory for a registrar to support against an address
> block for the operator community to route or otherwise accept that block)
> without such agreement, to communicate on the Internet.
>
> Matthew Kaufman
>
>
> On Thu, Oct 4, 2018 at 11:28 AM Paul Andersen <***@arin.net> wrote:
>
>> Bill,
>>
>> I am personally fully committed to universal DNSSEC, and I believe that
>> this practice deleteriously affects all ARIN members, not just legacy ones.
>> I hope that discussion on this list will indicate a clear community
>> consensus, so that the board can ensure that staff act upon that input.
>>
>> Cheers,
>>
>> Paul
>>
>>
>> > On Oct 4, 2018, at 2:00 PM, Bill Woodcock <***@pch.net> wrote:
>> >
>> >
>> >
>> >> On Oct 4, 2018, at 9:29 AM, Michael Sinatra <
>> michael+***@burnttofu.net> wrote:
>> >> I have received word of an apparent change in ARIN operational
>> policy...
>> >> ...no longer accepting DNSSEC DS records for reverse DNS for those
>> resources that are not covered by RSA or LRSA. This is a change from
>> current operational practice, and it effectively disables the *community's*
>> ability to validate reverse DNS for these holders.
>> >
>> > This is an unconscionable roll-back of a critical security feature of
>> the Internet. This cannot be allowed to move forward.
>> >
>> > -Bill
>> >
>> > _______________________________________________
>> > ARIN-PPML
>> > You are receiving this message because you are subscribed to
>> > the ARIN Public Policy Mailing List (ARIN-***@arin.net).
>> > Unsubscribe or manage your mailing list subscription at:
>> > https://lists.arin.net/mailman/listinfo/arin-ppml
>> > Please contact ***@arin.net if you experience any issues.
>>
>> _______________________________________________
>> ARIN-PPML
>> You are receiving this message because you are subscribed to
>> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
>> Unsubscribe or manage your mailing list subscription at:
>> https://lists.arin.net/mailman/listinfo/arin-ppml
>> Please contact ***@arin.net if you experience any issues.
>>
>

[Jo Rhett]

> The change is that ARIN is (or will soon be) no longer accepting DNSSEC DS records for reverse DNS for those resources that are not covered by RSA or LRSA. This is a change from current operational practice, and it effectively disables the *community's* ability to validate reverse DNS for these holders.

Refusing to authenticate resources used by holders who cannot be validated is a feature, not a bug.

My fees (and everyone elses) pay ARIN to validate and certify the resource holders. They absolutely should not publish resources they cannot validate or certify. They absolutely should not under any circumstances extended resources to perform validation and certification to people who’ve been playing this game for closing on three decades.

ARIN has real issues to deal with, and the hundred or so resource holders who want to keep stealing the time and effort of everyone involved in ARIN for their little pity party should go away. It doesn’t below on the PPML list, which should be concerned exclusively with the legitimate needs of cooperative and legally contracted entities.

This was an active topic when I was a freakin child. As I near retirement and death, it’s time for this to stop. It’s time for these resources to be

1. Marked as unknown/unvalidated
2. Added to all abuse tracking DBs as unknown/unmanaged

And it’s time for all the unvalidated resource holders stop whining about their rights. You’ve had decades to join the party. We owe you nothing.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[John Santos]

With all due respect, you don't know what you are talking about. You
are attributing motives to me and other legacy holders, that are
completely false and possibly libelous. And I think there are way more
of us than you imagine.

Received my class C from the InterNIC in 1993. Don't need any more,
just need RDNS and am happy to provide POC validation annually, and
update my POC records every decade or two when things change, but
otherwise require almost nothing from ARIN, so I don't see how I am a
"freeloader".

On 10/5/2018 12:40 AM, Jo Rhett wrote:
>> The change is that ARIN is (or will soon be) no longer accepting
>> DNSSEC DS records for reverse DNS for those resources that are not
>> covered by RSA or LRSA.  This is a change from current operational
>> practice, and it effectively disables the *community's* ability to
>> validate reverse DNS for these holders.
>
> Refusing to authenticate resources used by holders who cannot be
> validated is a feature, not a bug.
>
> My fees (and everyone elses) pay ARIN to validate and certify the
> resource holders. They absolutely should not publish resources they
> cannot validate or certify.  They absolutely should not under any
> circumstances extended resources to perform validation and certification
> to people who’ve been playing this game for closing on three decades.
>
> ARIN has real issues to deal with, and the hundred or so resource
> holders who want to keep stealing the time and effort of everyone
> involved in ARIN for their little pity party should go away. It doesn’t
> below on the PPML list, which should be concerned exclusively with the
> legitimate needs of cooperative and legally contracted entities.
>
> This was an active topic when I was a freakin child. As I near
> retirement and death, it’s time for this to stop. It’s time for these
> resources to be
>
> 1. Marked as unknown/unvalidated
> 2. Added to all abuse tracking DBs as unknown/unmanaged
>
> And it’s time for all the unvalidated resource holders stop whining
> about their rights. You’ve had decades to join the party. We owe you
> nothing.
>
> --
> Jo Rhett
> Net Consonance : net philanthropy to improve open source and
> internet projects.
>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.
>

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please co

[h***@uneedus.com]

Just so I can get a prospective of how much money was lost for ARIN during
this discussion, can someone please tell me what the current minimum cost
under the current RSA for someone to hold 2 /24's? Five hundred a year
seems to be the stated price, but I am unable to calculate it based on
resources alone, which might be less.

I also note that at the time this holder received his resources, ARIN did
not exist, nor was there any charge to receive resources and no discussion
of any future charges for receiving numbers at the time when he received
his numbers. The charges by ARIN were done after the fact, and is it
really fair to impose a charge under these conditions? There seems to be
2 sides to this issue.

Albert Erdmann
Network Administrator
Paradise On Line Inc.


On Fri, 5 Oct 2018, John Santos wrote:

> With all due respect, you don't know what you are talking about. You are
> attributing motives to me and other legacy holders, that are completely false
> and possibly libelous. And I think there are way more of us than you
> imagine.
>
> Received my class C from the InterNIC in 1993. Don't need any more, just
> need RDNS and am happy to provide POC validation annually, and update my POC
> records every decade or two when things change, but otherwise require almost
> nothing from ARIN, so I don't see how I am a "freeloader".
>
> On 10/5/2018 12:40 AM, Jo Rhett wrote:
>>> The change is that ARIN is (or will soon be) no longer accepting DNSSEC DS
>>> records for reverse DNS for those resources that are not covered by RSA or
>>> LRSA.  This is a change from current operational practice, and it
>>> effectively disables the *community's* ability to validate reverse DNS for
>>> these holders.
>>
>> Refusing to authenticate resources used by holders who cannot be validated
>> is a feature, not a bug.
>>
>> My fees (and everyone elses) pay ARIN to validate and certify the resource
>> holders. They absolutely should not publish resources they cannot validate
>> or certify.  They absolutely should not under any circumstances extended
>> resources to perform validation and certification to people who’ve been
>> playing this game for closing on three decades.
>>
>> ARIN has real issues to deal with, and the hundred or so resource holders
>> who want to keep stealing the time and effort of everyone involved in ARIN
>> for their little pity party should go away. It doesn’t below on the PPML
>> list, which should be concerned exclusively with the legitimate needs of
>> cooperative and legally contracted entities.
>>
>> This was an active topic when I was a freakin child. As I near retirement
>> and death, it’s time for this to stop. It’s time for these resources to
>> be
>>
>> 1. Marked as unknown/unvalidated
>> 2. Added to all abuse tracking DBs as unknown/unmanaged
>>
>> And it’s time for all the unvalidated resource holders stop whining about
>> their rights. You’ve had decades to join the party. We owe you nothing.
>>
>> --
>> Jo Rhett
>> Net Consonance : net philanthropy to improve open source and
>> internet projects.
>>
>> _______________________________________________
>> ARIN-PPML
>> You are receiving this message because you are subscribed to
>> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
>> Unsubscribe or manage your mailing list subscription at:
>> https://lists.arin.net/mailman/listinfo/arin-ppml
>> Please contact ***@arin.net if you experience any issues.
>>
>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-***@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact ***@arin.net if you experience any issues.
>

[William Herrin]

On Fri, Oct 5, 2018 at 7:35 AM <***@uneedus.com> wrote:
> Just so I can get a prospective of how much money was lost for ARIN during
> this discussion, can someone please tell me what the current minimum cost
> under the current RSA for someone to hold 2 /24's? Five hundred a year
> seems to be the stated price, but I am unable to calculate it based on
> resources alone, which might be less.

$300/year as an "end user." Unless the 2 /24's are actually 1 /23, in
which case it's $150/year. If he also holds an AS number, that's an
additional $150/year.

$500/year is the ISP price which includes voting membership in ARIN.
That rate would cover both /24s and the AS number, so its $500 total
not $500 each.

See https://www.arin.net/fees/fee_schedule.html section "End Users
Paying Per Resource"

Regards,
Bill Herrin


--
William Herrin ................ ***@dirtside.com ***@herrin.us
Dirtside Systems ......... Web: <http://www.dirtside.com/>
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[John Curran]

On 5 Oct 2018, at 4:35 AM, ***@uneedus.com<mailto:***@uneedus.com> wrote:

Just so I can get a prospective of how much money was lost for ARIN during this discussion, can someone please tell me what the current minimum cost under the current RSA for someone to hold 2 /24's?

Albert -

ARIN registry users pay annual maintenance fees. These fees are set at $150/year/object in the database – an IPv4 address block is an object in the database, as is an IPv6 address block, as an AS number.

As of 1 July 2018, those who are legacy resource holders (i.e. a party or their legal successor that was issued resources prior to ARIN’s formation), have their total maintenance fees applicable to legacy resources capped at $125 USD annually, regardless of the number of legacy resources held under their LRSA. This amount is actually a decrease from previous years for many legacy holders, but it was important to get consistent fees for all (and note that the total cap for legacy holders can go up by $25 year if the Board so directs.)

So, presently an organizations with 2 distinct IPv4 /24 blocks would be invoiced at $300/year as an end user organizations, but legacy resource holders with the same resources would be invoiced $125 USD due to the cap.

Note also that end-user and legacy resource holder organizations may instead opt to be ARIN Registration Service Plan customers and just pay a single fee based on total resource holdings (the same annual fee as ISPs do), and this also includes the benefit of ARIN membership. This approach generally makes sense for organizations that have many objects in the database which total only a modest amount of address space.

The ARIN fee schedule is available here - https://www.arin.net/fees/fee_schedule.html – I hope this information helps to inform the discussion.

Thanks!
/John

John Curran
President and CEO
ARIN

[Jo Rhett]

> Just so I can get a prospective of how much money was lost for ARIN during this discussion

It doesn't matter how much money is lost. I never raised this point.

> I also note that at the time this holder received his resources, ARIN did not exist, nor was there any charge to receive resources and no discussion of any future charges for receiving numbers at the time when he received his numbers.

First, I'd like to say that this has been debated to death over the last two decades of ARIN's existence and every answer to your questions can be found in the archives. Oh look, here's a discussion about this exact topic A DECADE AGO where we went through the old forms in detail and nobody was able to document evidence that they were owed services: https://lists.arin.net/pipermail/arin-discuss/2008-October/001071.html

If you want to argue this fresh, start by filling up on two decades of this discussion. People significantly more knowledgeable than you have tackled this.

There have been above and beyond reasonable attempts to resolve all legitimate concerns, and all parties who had real issues with the contracts and services have resolved them and signed the contracts. Further, if he signed in 1993 then his contract says that it's governed by the laws of the US, and trust me there's laws about providing services, changes in services, etc etc and not a single one says you get to continue to receive services if you won't sign an updated contract. In fact you'll find considerably more precedence saying the opposite.

> The charges by ARIN were done after the fact, and is it really fair to impose a charge under these conditions? There seems to be 2 sides to this issue.

If he signed in 1993 as he said then he paid for "to coverf 2 years of charges" which is clear language that he may be expected to pay in the future.

Pro tip: Don't argue this with people who still have the original forms at hand.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Jo Rhett]

>> ARIN has real issues to deal with, and the hundred or so resource holders who want to keep stealing the time and effort of everyone involved in ARIN for their little pity party should go away.


On Oct 5, 2018, at 1:35 AM, John Santos <***@egh.com> wrote:
> With all due respect, you don't know what you are talking about.

I know in great technical depth what I am talking about. However your statement here proves how little you know. I don't challenge your competence. Be respectful.

> You are attributing motives to me and other legacy holders, that are completely false and possibly libelous.

I don't know and haven't spoken to your motives. I am speaking to your request for services delivered without a contract. I encourage you to sue me for libel, since you apparently know so little about the topic you haven't even read the description of it. Don't threaten an intelligent, knowledgeable person with nonsense.

> Received my class C from the InterNIC in 1993. Don't need any more, just need RDNS and am happy to provide POC validation annually, and update my POC records every decade or two when things change, but otherwise require almost nothing from ARIN, so I don't see how I am a "freeloader".

"I want all these services, administrative, technical, and online services... for free, without a contract, without supplying a penny." -- how are you not a freeloader?

Also note that InterNIC had a contract, and it definitely never offered free access to any and all future services not described. You have no basis for getting unending free service without a contract. You've had 25 years to do the right thing, ARIN is old enough to not only vote but have finished a tour in the armed services (far too appropriate a metaphor here) and you can't bring yourself to sign a contract for services? They should stop serving you. Full stop.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[william manning]

I would be happy to see ARIN follow your advice IF I could take my
registrations elsewhere. However the DNS is, like it or not, a
natural monopoly. ARIN has avoided regulation thus far by honoring
the legacy holders assignments. I concur with Michael that enabling
DNSSEC support for legacy holders is something new, but maintains the
cohesion across the DNS, which is a critical component for workable
DNS.

As usual, YMMV. I'm persuaded that ARIN if ARIN offers DNSSEC for any
registrants, it should offer DNSSEC to all registrants. Contracts
are good, but ARIN has never had or expected 100% of its clients to be
contractually bound to ARIN. ARIN knew this when it was established
and nothing, fundamentally, has changed.

/Wm
Ex ARIN board member, One of the first LSRA signers, DNSSEC early
adopter, now mostly retired.



On 10/6/18, Jo Rhett <***@netconsonance.com> wrote:
>>> ARIN has real issues to deal with, and the hundred or so resource holders
>>> who want to keep stealing the time and effort of everyone involved in
>>> ARIN for their little pity party should go away.
>
>
> On Oct 5, 2018, at 1:35 AM, John Santos <***@egh.com> wrote:
>> With all due respect, you don't know what you are talking about.
>
> I know in great technical depth what I am talking about. However your
> statement here proves how little you know. I don't challenge your
> competence. Be respectful.
>
>> You are attributing motives to me and other legacy holders, that are
>> completely false and possibly libelous.
>
> I don't know and haven't spoken to your motives. I am speaking to your
> request for services delivered without a contract. I encourage you to sue me
> for libel, since you apparently know so little about the topic you haven't
> even read the description of it. Don't threaten an intelligent,
> knowledgeable person with nonsense.
>
>> Received my class C from the InterNIC in 1993. Don't need any more, just
>> need RDNS and am happy to provide POC validation annually, and update my
>> POC records every decade or two when things change, but otherwise require
>> almost nothing from ARIN, so I don't see how I am a "freeloader".
>
> "I want all these services, administrative, technical, and online
> services... for free, without a contract, without supplying a penny." -- how
> are you not a freeloader?
>
> Also note that InterNIC had a contract, and it definitely never offered free
> access to any and all future services not described. You have no basis for
> getting unending free service without a contract. You've had 25 years to do
> the right thing, ARIN is old enough to not only vote but have finished a
> tour in the armed services (far too appropriate a metaphor here) and you
> can't bring yourself to sign a contract for services? They should stop
> serving you. Full stop.
>
> --
> Jo Rhett
> Net Consonance : net philanthropy to improve open source and internet
> projects.
>
>
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[Steven Ryerse]

I don't wish to beat a dead horse but the InterNIC didn't have a contract. I still have all of the paperwork I got from them them in the early 90s, and I posted it in this forum for everyone to see several years ago. They basically just asked some questions like what do u want to use the Internet for and then issued me a Class C. As I said the horse is out of the barn on this a long time ago so I don't wish to fight about it. I would add the the National Science Foundation along with others funded the Internet using federal tax money. Even though it was a very small percentage of everyone's federal tax money that was used by the NSF, you can't say that the resources everyone got before ARIN was formed were completely free. My two cents.

Sent from my iPhone

On Oct 6, 2018, at 2:59 PM, Jo Rhett <***@netconsonance.com<mailto:***@netconsonance.com>> wrote:

ARIN has real issues to deal with, and the hundred or so resource holders who want to keep stealing the time and effort of everyone involved in ARIN for their little pity party should go away.

On Oct 5, 2018, at 1:35 AM, John Santos <***@egh.com<mailto:***@egh.com>> wrote:
With all due respect, you don't know what you are talking about.

I know in great technical depth what I am talking about. However your statement here proves how little you know. I don't challenge your competence. Be respectful.

You are attributing motives to me and other legacy holders, that are completely false and possibly libelous.

I don't know and haven't spoken to your motives. I am speaking to your request for services delivered without a contract. I encourage you to sue me for libel, since you apparently know so little about the topic you haven't even read the description of it. Don't threaten an intelligent, knowledgeable person with nonsense.

Received my class C from the InterNIC in 1993. Don't need any more, just need RDNS and am happy to provide POC validation annually, and update my POC records every decade or two when things change, but otherwise require almost nothing from ARIN, so I don't see how I am a "freeloader".

"I want all these services, administrative, technical, and online services... for free, without a contract, without supplying a penny." -- how are you not a freeloader?

Also note that InterNIC had a contract, and it definitely never offered free access to any and all future services not described. You have no basis for getting unending free service without a contract. You've had 25 years to do the right thing, ARIN is old enough to not only vote but have finished a tour in the armed services (far too appropriate a metaphor here) and you can't bring yourself to sign a contract for services? They should stop serving you. Full stop.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net<mailto:ARIN-***@arin.net>).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net<mailto:***@arin.net> if you experience any issues.

[Lee Dilkie]

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[Jo Rhett]

On Oct 6, 2018, at 12:47 PM, Lee Dilkie <***@dilkie.com> wrote:
> On 2018-10-05 00:40, Jo Rhett wrote:
>> Refusing to authenticate resources used by holders who cannot be validated is a feature, not a bug.
>
> And validation of a resouce holder isn't the same thing as holding an RSA contract. Let's be clear about that, they are different issues.

No entity, even government entities, are required to provide services to people who won't sign the current service agreement.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[h***@uneedus.com]

The reason that this issue is so difficult is the funding model of DNS has
changed over the years, and the formation of ARIN has never completely
addressed that issue.

In the beginning days, DNS was in fact a large shared host file, installed
on every machine. In effect, the cost of adding hosts to the shared file
was indirectly paid by the public entity that was paying the salary of
those that maintained the host file, and the downloading and local costs
were borne by each node.

When port 53 DNS was established, costs were distributed among all
connected nodes because each connected network needed to have at least 2
DNS servers connected to the network. There was some central
administration involved, but that was paid by taxes or grants and not
directly by the holder.

At the time the original poster received his resources, there was no
charge for receiving numbering resources, and grants and other government
funding was paying for the reverse DNS function, and the individual
resource holder was not charged, nor was there any contract for the
reverse dns. The resource holder was responsible for providing 2 or more
dns servers, and the maintainer of the reverse zone would point to those
servers, and the remainder of the cost and responsibility for the dns
servers was borne by the resource holder.

The discussion of NetSol obtaining the contract, and the charge for a 2
year period had to do with domain names, not numbering resources. If the
holder wanted domain names, they could be obtained from NetSol, or from
other registries if eligible such as .edu or .us. These fees did not go
toward numbering resources. In the very beginning, these were also free.

Before ARIN, the reverse zone was provided via Internic, which I believe
was publically funded. Currently the .arpa zone used for reverse DNS in
IPv4 is operated by Verisign GRS under contract to IANA. Each of the
reverse zone /8s of the internet are in turn delegated to the holder of
that /8, which is either one of the RIR's or the legacy holder of that /8.
This is why these legacy holders holding an /8 can get DNSSEC to work
regardless of the wishes of ARIN, since ARIN is not in the chain of trust,
and therefore has no control whatsoever over this issue.

Those legacy holders with less than an /8 have ARIN in the trust path for
DNSSEC and cannot receive DNSSEC (or RPKI) without the involvment of ARIN.
As to the total /24's shown in the chart, I suspect that the greatest
majority in total number of /24's are part of legacy /8's, who quite
frankly have legal teams that tell them not to sign an (L)RSA, since that
might take away commercial rights that they might have in the resources.

The term "freeloader" is a loaded term and as pointed out this discussion
has been going on unresolved since the formation of ARIN. It could be
also be argued that those receiving number resources prior to ARIN when
charges were not being made have a valid point. Along comes ARIN, who
wants to tax/charge/fee the resource holder for services that were never
directly charged for prior to ARIN, and they do not consider this to be
right, since they never had any kind of agreement with ARIN.

The basic problem from the smaller than /8 legacy holder prospective is
that IANA has delegated the reverse /8 containing their legacy resources
to ARIN, injecting ARIN in the middle of this. It is not possible
therefore to get DNSSEC or any other DNS service on the reverse zone
working without ARIN's help. One could say that this was done without the
"permission" of the resource holder at the time. ARIN's website states
"At its formation, the ARIN Board of Trustees decided that ARIN would
provide registration services for these legacy number resources without
requiring the original resource holders to enter into a registration
services agreement or pay service fees." I suspect this was done to avoid
an issue with the legacy holders, who at the time of ARIN formation likely
controled a majority of the assigned numbering space and could have caused
quite a stink for ARIN over any charges.

I personally think the fee schedule needs to charge larger resource
holders much more than the small resource holder. Looking at the fee
chart, if I hold a single /24, the least I will pay is $150/year. If I opt
to become a member, I am 3 X small and pay $250/year. If I am a large
player and hold a /8 (65536 /24's), I am 3 X large and pay $64,000/year
for membership. That is only 98 cents per /24, compared to the small
player that gets to pay either $150 or $300 per year. At the very top of
the chart, that becomes 48 cents per /24 if I hold a /5 (larger than a
/6). While efforts have been made to increase fees to larger players, it
is still not distributed evenly based on a per resource basis.

Based upon the rates per /24 charged to larger players, that "freeloader"
is costing ARIN $2/year or less. On the other hand, DNSSEC does benefit
the security of the ENTIRE community, including those in other RIR
regions. While many at ARIN and elseware do not like providing those
"free" services to those legacy holders, DNSSEC is a benefit to ALL the
community. Since IANA runs the root of the .arpa reverse zone, maybe
costs should be funded by IANA and their 18 cent domain tax.

The amount of true cost for small players is in my opinion higher than the
cost of collection of a fair fee of $1 or less per /24 per year. Remember,
these small players include not only the original poster, but other
organizations including Berea College (BEREAC), a college with a billion
dollar endowment, who clearly would appear from ARIN's prospective to able
to afford a membership, but also choose to be a "freeloader". They hold
but a single legacy /24, and choose instead to use their resources to
provide tuition free education to their entire student body rather than
paying annually for an ARIN membership.

I do not know what will be the answer, or if this will ever be solved
until IPv6 becomes the primary transport on the internet. I think the
price of IPv4 resources will be like a bell curve, and we will start
seeing the price of IPv4 blocks start to sink once IPv6 becomes the
primary transport. How many years before this happens, I do not know.

Albert Erdmann
Network Administrator
Paradise On Line Inc.


On Sat, 6 Oct 2018, Jo Rhett wrote:

> On Oct 6, 2018, at 12:47 PM, Lee Dilkie <***@dilkie.com> wrote:
>> On 2018-10-05 00:40, Jo Rhett wrote:
>>> Refusing to authenticate resources used by holders who cannot be validated is a feature, not a bug.
>>
>> And validation of a resouce holder isn't the same thing as holding an RSA contract. Let's be clear about that, they are different issues.
>
> No entity, even government entities, are required to provide services to people who won't sign the current service agreement.
>
> --
> Jo Rhett
> Net Consonance : net philanthropy to improve open source and internet projects.
>
>
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[Lee Dilkie]

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[Jo Rhett]

On Oct 6, 2018, at 12:49 PM, Lee Dilkie <***@dilkie.com> wrote:
> On 2018-10-05 00:40, Jo Rhett wrote:
>> ARIN has real issues to deal with, and the hundred or so resource holders who want to keep stealing the time and effort of everyone involved in ARIN for their little pity party should go away
>
> stealing?
>
> That's one way of looking at it. The other is to acknoledge that it was all free until big buisiness moved in and decided they wanted to make some money. In which case the "stealing" started occuring the day ARIN was created and adoped a fee structure.

<sigh> That you would try to argue this without even refering to basics of history blows my mind. I doubt real history interests you, so this reply is only for others who might think you've raised a good question:

These arguments started 25 years ago when InterNIC took over IP allocation (see RFC-1400), contracted Network Solutions to do the work, and to charge fees appropriate to cover costs. That's 5 years before ARIN was incorporated, and another 8 months before the service transitioned from InterNIC to ARIN.

Further, it was NEVER free. It was a grant-subsided function, then when NSFnet was created the legal constraints imposed by congress required that the non-military parts pay for themselves. Go read the debate and modifications to Gore's bills. I worked in milnet exclusively (except for some transPacific UUCP gateways I ran out of my home at my own cost) until late 1993 so I didn't have to deal with commercial entities and ISP registrations until then--at which time NetSol had taken over the service and the contracts very clearly indicated both a fee and that the fee covered 2 years of service.

And don't forget, for the 3 years Gore spent finally getting funding approved nobody thought that the Internet as such was going to exist much longer. Even the first 2 years afterwards we were all trying to figure out how to dance the dance correctly, and most of us working on it then didn't believe the Internet would remain a single network.

To find people who still have registrations that don't mention fees, compliance with US law, etc you have to go back to 1989 and before when you'd chase Jon down at coffee/tea shop and scribble down the number he gave you on paper because it was the fastest way to get an assignment. And damn straight, they are guaranteed every service written on the service agreement they received. (Hint: NONE)

PLEASE for the love of god stop making up things that sound good and justify nonsense as if it was factual. These years happened, there was paperwork and legal contracts, and just because it's not available for review in Docusign or published on Instagram doesn't mean that no contract applies. US law is quite specific about implied contracts, and you'll find little precedence to support these notions.

It is not that ARIN hasn't had the right to shut them down or demand a contract before. It's that ARIN and John Curran in particular has not wanted the fight with the community. So they listen, bend over backwards, and make it easy as possible to join. They've done an exceptional job.

I think we the community need to be the bad cop, and stop ARIN wasting time, money, and legal fees on this. No contract, no service. It's been 25 years since the initial changes in fees, let's move along now.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Lee Dilkie]

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[Jo Rhett]

On Oct 6, 2018, at 12:50 PM, Lee Dilkie <***@dilkie.com> wrote:
> On 2018-10-05 00:40, Jo Rhett wrote:
>> And it’s time for all the unvalidated resource holders stop whining about their rights. You’ve had decades to join the party. We owe you nothing.
>
> other than owing us the existance of the internet itself, it's you who jolined our party, then started charging the guests.
> And Legacy holders are NOT "unvalidated", please dispense with that bit of nonsense.

I've already addressed your lack of knowledge on this regard. Given that I was paid to work on the Internet a decade before the creation of ARIN (which you misplaced in history) I find your statement that I "joined your party" amusing. Depending on how you joined the Internet, it's entirely possible that my efforts in the late 80s and early 90s are directly responsible for you have a party at all.

You are welcome to ignore history to your heart's content, but your directed personal attacks violate the AUP https://www.arin.net/participate/mailing_lists/aup.html

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Ronald F. Guilmette]

In message <03730720-29E1-4CDE-8EC6-***@netconsonance.com>,
Jo Rhett <***@netconsonance.com> wrote:

>Refusing to authenticate resources used by holders who cannot be
>validated is a feature, not a bug.
>
>My fees (and everyone elses) pay ARIN to validate and certify the
>resource holders.

I have no dog in this fight. I just have a simple (naive?) question:

Would it be possible for ARIN to establish some kind of de minimis
validation/authentication fee, enough to cover its costs, but not
involving the acceptance of a complete LRSA?

(As I said, I have no dog in this fight. I'm just wondering if there
is any middle ground that would be acceptable to all.)


Regards,
rfg
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[David Farmer]

On Fri, Oct 5, 2018 at 4:05 PM Ronald F. Guilmette <***@tristatelogic.com>
wrote:

>
> In message <03730720-29E1-4CDE-8EC6-***@netconsonance.com>,
> Jo Rhett <***@netconsonance.com> wrote:
>
> >Refusing to authenticate resources used by holders who cannot be
> >validated is a feature, not a bug.
> >
> >My fees (and everyone elses) pay ARIN to validate and certify the
> >resource holders.
>
> I have no dog in this fight. I just have a simple (naive?) question:
>
> Would it be possible for ARIN to establish some kind of de minimis
> validation/authentication fee, enough to cover its costs, but not
> involving the acceptance of a complete LRSA?
>

I'm not sure a de minimis fee would be appropriate, the users without
contracts represent a higher legal risk to ARIN. I believe this risk is
probably as much or more of an issue as the cost of the service themselves.


> (As I said, I have no dog in this fight. I'm just wondering if there
> is any middle ground that would be acceptable to all.)
>

--
===============================================
David Farmer Email:***@umn.edu
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota
2218 University Ave SE Phone: [phone]
Minneapolis, MN 55414-3029 Cell: 612-812-9952
===============================================

[John Curran]

On 5 Oct 2018, at 2:05 PM, Ronald F. Guilmette <***@tristatelogic.com> wrote:
>
> Would it be possible for ARIN to establish some kind of de minimis
> validation/authentication fee, enough to cover its costs, but not
> involving the acceptance of a complete LRSA?
>
> (As I said, I have no dog in this fight. I'm just wondering if there
> is any middle ground that would be acceptable to all.)

Ron -

This is likely to be discussed by the ARIN Board in 2019, as a result of the ongoing review of legal hurdles related to RPKI services.

It’s premature to speculate whether such is a reasonable mechanism without a detailed legal analysis – it wouldn’t be the fee so much as the associated services agreement that would likely be the challenging part (i.e. the clause that’s been cited as a hurdle is the disclaimer of property rights, and a reversal in this area would have significant implications for the community’s ability to have any maintenance fees or community-developed policy applied to these address blocks.)

Thanks,
/John

John Curran
President and CEO
ARIN


_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net i

[Jo Rhett]

On Oct 5, 2018, at 2:05 PM, Ronald F. Guilmette <***@tristatelogic.com> wrote:
> Would it be possible for ARIN to establish some kind of de minimis
> validation/authentication fee, enough to cover its costs, but not
> involving the acceptance of a complete LRSA?

See my reply to Owen: this isn't about the money. It's about the lack of signed agreement.

And if they pay money to ARIN they create an implied contract for services so ARIN's lawyers would never let that occur without a contract in place.

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

[Ronald F. Guilmette]

In message <AD2CA5A0-6938-4067-9BED-***@arin.net>,
John Curran <***@arin.net> wrote:

>On 5 Oct 2018, at 2:05 PM, Ronald F. Guilmette <***@tristatelogic.com>
>wrote:
>>
>> Would it be possible for ARIN to establish some kind of de minimis
>> validation/authentication fee, enough to cover its costs, but not
>> involving the acceptance of a complete LRSA?
>
>This is likely to be discussed by the ARIN Board in 2019, as a result of
>the ongoing review of legal hurdles related to RPKI services.
>
>It's premature to speculate whether such is a reasonable mechanism
>without a detailed legal analysis it wouldn't be the fee so much as
>the associated services agreement that would likely be the challenging part
>(i.e. the clause that's been cited as a hurdle is the disclaimer of
>property rights, and a reversal in this area would have significant
>implications for the community's ability to have any maintenance fees or
>community-developed policy applied to these address blocks.)

Thanks for the reply John.

I probably should clarify that although, as I said, I do not have a dog in
this fight -now-, there exists a finite non-zero chance that that may change
in the forseeable and near-term future.

In light of that possibility, and considering the content of this discussion
thred so far, I am suddenly and accutely aware of my own utter and abject
ignorance with respect to many, most, or all of the issues which this
discussion has touched upon.

Recognizing, as I do, that the PPML is not the best place for me to be
seeking to cure my ignorance, I hope nontheless that no one here will
begrudge me too much if I ask just a couple of additional naive (stupid?)
but arguably pertinent questions:

1) I confess that I know virtually nothing about DNSSEC. I do know one
thing however, which is that there's such a thing, in the world of domain
names, as a "self signed" SSL certificate. Thus, my question: May the
DNSSEC records applicable to rDNS for a given CIDR be self signed?

If so, then might this be a way to deftly split the baby in two, allowing
everyone who signs a contract with ARIN to have a chain of trust (for their
rDNS) which is rooted in ARIN's trustworthyness, while still allowing those
who wish to remain outside the tent to present to the world some less
trustworthy but still DNSSEC-secured rNDS records?

2) John mentioned three separate considerations which, I infer, are the
three things that typically motivate some legacy holders to remain outside
of the tent, as it were, namely:

a) property rights
b) fees
c) applicability of community-developed policies

John and the whole ARIN team already have to deal with levels of complexity
that would likely drive most humans mad in short order, and I am loath to
suggest adding anything on top of that, but I can't help wondering if
it might not be possible to bring more legacy holders into the tent if
the above three things were contractually sliced and diced in ways that
made contracts more palatable to holdouts. (For example, I can imagine
that some folks might be OK with paying ordinary fees, but would be
reluctant to sign away property rights... to the extent that any such
alleged ``rights'' might have any real legal existance. Others might
not want to pay full fees, but might be OK with contractually disavowing
property rights.)

And yes, that's a question. I just want to know if such (contractual)
slicing and dicing has been considered as a way to get more holdouts into
the tent.


Regards,
rfg
_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if you experience any issues.

[John Curran]

On 5 Oct 2018, at 9:14 PM, Ronald F. Guilmette <***@tristatelogic.com> wrote:
>
> Recognizing, as I do, that the PPML is not the best place for me to be
> seeking to cure my ignorance, I hope nontheless that no one here will
> begrudge me too much if I ask just a couple of additional naive (stupid?)
> but arguably pertinent questions:
>
> 1) I confess that I know virtually nothing about DNSSEC. I do know one
> thing however, which is that there's such a thing, in the world of domain
> names, as a "self signed" SSL certificate. Thus, my question: May the
> DNSSEC records applicable to rDNS for a given CIDR be self signed?

Your self-signed SSL certificate doesn’t provide any meaningful authentication (hence why many browsers object to them) but does support TLS transport encryption for your web query.

DNSSEC is solely about authentication of the zone data as being from the legitimate source and that isn’t possible with self-signed keys – i.e. I wouldn’t expect there is a meaningful parallel situation (but will leave it to those with a deeper knowledge of DNSSEC bits to confirm one way or the other…)

> 2) John mentioned three separate considerations which, I infer, are the
> three things that typically motivate some legacy holders to remain outside
> of the tent, as it were, namely:
>
> a) property rights
> b) fees
> c) applicability of community-developed policies
>
> John and the whole ARIN team already have to deal with levels of complexity
> that would likely drive most humans mad in short order, …

(That which does not kill us makes us stronger.)

> and I am loath to
> suggest adding anything on top of that, but I can't help wondering if
> it might not be possible to bring more legacy holders into the tent if
> the above three things were contractually sliced and diced in ways that
> made contracts more palatable to holdouts. (For example, I can imagine
> that some folks might be OK with paying ordinary fees, but would be
> reluctant to sign away property rights... to the extent that any such
> alleged ``rights'' might have any real legal existance. Others might
> not want to pay full fees, but might be OK with contractually disavowing
> property rights.)
>
> And yes, that's a question. I just want to know if such (contractual)
> slicing and dicing has been considered as a way to get more holdouts into
> the tent.

As noted earlier, we’ll likely need to reexamine the legal hurdles posed by agreement terms subsequent to the RPKI study.

We’ve just managed to get all customers on the same terms and conditions (by carrying over the more favorable provisions of the LRSA into the RSA, thus resulting in a single agreement for both purposes), and it is unclear if it it is fair & equitable to provide for a long-term difference in terms and conditions for one group of ARIN customers over another, but it will be considered when looking into the legal hurdles to RPKI and DNSSEC deployment.

Thanks!
/John

John Curran
President and CEO
ARIN

_______________________________________________
ARIN-PPML
You are receiving this message because you are subscribed to
the ARIN Public Policy Mailing List (ARIN-***@arin.net).
Unsubscribe or manage your mailing list subscription at:
https://lists.arin.net/mailman/listinfo/arin-ppml
Please contact ***@arin.net if

[Jo Rhett]

> In light of that possibility, and considering the content of this discussion
> thred so far, I am suddenly and accutely aware of my own utter and abject
> ignorance with respect to many, most, or all of the issues which this
> discussion has touched upon.
>
> Recognizing, as I do, that the PPML is not the best place for me to be
> seeking to cure my ignorance,

Well, the PPML archives are an excellent place to see all previous rounds of this discussion :-)

--
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.