January 2013 - Test - lists.nanog.org

Update - RIPE Database Proxy Service Issues
by Axel Pawlik 04 Jan '13

04 Jan '13

[Apologies for duplicate emails] Dear colleagues, Thank you for your comments on this issue. I would like to point out that the *DRAFT* Activity Plan and Budget is published around September of each year, allowing members ample time to read it before it is discussed at the Autumn General Meeting. The RIPE NCC Executive Board then takes the outcome of the discussions and any new developments into consideration before finalising and approving the definitive Activity Plan and Budget, which is then published before the end of the year. On 13 December 2012, we informed the membership of the definitive Activity Plan and Budget and listed the changes from the draft plan. Please note that the membership does not vote on either the draft or the final Activity Plan and Budget - this is one of the member-elected Executive Board's functions. One of the modifications that took place from the draft to the final Activity Plan was the addition of the RIPE Database Proxy Service as a member-only service. This was a follow-up on an action point that stemmed from the Data Protection Task Force and a need to strengthen our contractual relationship between the current users of the RIPE Database Proxy Service and the RIPE NCC ensuring compliance with Dutch and EU legislation. Partially based on the membership's vote of approval regarding the new Charging Scheme of "one LIR, one fee" and partially based on the fact that the RIPE Database Proxy Service is only actively used by less than a handful of entities (both members and non-members), the Executive Board made the decision, which they felt was in the members' interest, to ask the users of this service to sign both a specific RIPE Database Proxy Service Agreement and the Standard Service Agreement (Membership Agreement) that adheres to both EU and Dutch legislation, which would entail the users of this service paying the annual membership fee. Based on the recent mailing list discussions it seems apparent that this is a contentious issue that requires further membership and community discussion. Therefore, we will keep the RIPE Database Proxy Service running as it was in 2012 (i.e., no fee and no Membership Agreement) until we have completed these discussions. We will prepare a legal analysis of the options at hand for the contractual documentation required to use this service and gauge whether or not the membership feels that we should charge a fee for this service. Regards, Axel Pawlik Managing Director RIPE NCC

1 0

Gmail and SSL
by Gary E. Miller 03 Jan '13

03 Jan '13

Yo All! Apropos the recent discussions: "Google says that someone was caught trying to use an unauthorized digital certificate issued in its name in an attempt to impersonate Google.com for a man-in-the-middle attack." http://www.wired.com/threatlevel/2013/01/google-fraudulent-certificate/ RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97701 gem(a)rellim.com Tel:+1(541)382-8588

1 0

Akamai Network Contact
by Carlos M. Martinez 03 Jan '13

03 Jan '13

Hello! I'm looking for a contact in Akamai, preferably someone dwelling in the dark realm of layer 3. I've been contacted by a LACNIC member from Suriname who is having reachability issues specifically with sites hosted in Akamai. Thank you! ~Carlos

3 2

Re: Advisory — D-root is changing its IPv4 address on the 3rd of January.
by Keith Medcalf 03 Jan '13

03 Jan '13

Concomittant wirh reduced risk assessment capability? Sent from Samsung Mobile -------- Original message -------- From: Randy Bush <randy(a)psg.com> Date: To: Lynda <shrdlu(a)deaddrop.org> Cc: North American Network Operators' Group <nanog(a)nanog.org> Subject: Re: Advisory — D-root is changing its IPv4 address on the 3rd of January.

5 5

RIPE Database Proxy Service Issues
by Axel Pawlik 03 Jan '13

03 Jan '13

[Apologies for duplicate emails] Dear colleagues, There has been discussion on various mailing lists regarding the status of the RIPE Database Proxy Service. Before I address the issues that arose, I'd like to give you some background information on the service itself that may help with the discussions. Technical Background -------------------- To prevent the automatic harvesting of personal information (real names, email addresses, phone numbers) from the RIPE Database, there are PERSON and ROLE object query limits defined in the RIPE Database Acceptable Use Policy. This is set at 1,000 PERSON or ROLE objects per IP address per day. Queries that result in more than 1,000 objects with personal data being returned result in that IP address being blocked from carrying out queries for that day. Users of the RIPE Database have unlimited access to Network Information Centre (NIC)-related objects. They can use the -r flag in order to filter out personal objects and query NIC objects without any limitations. The RIPE Database Proxy Service allows websites to provide a third party interface to the RIPE Database. Without the proxy service, the third parties would quickly run into the limits set on RIPE Database queries. With the proxy service, we whitelist the third party IP address and ask them to pass their user's IP address to us, so limits are only set on the user's IP address, not the third party's. There is no technical way to ensure that the user IP addresses passed to us by the third party are valid. Potentially, third party users of the proxy service could harvest all personal data in the RIPE Database (approximately 2 million objects) in a matter of hours. To ensure that the RIPE NCC's Terms and Conditions are followed, we require a contract between the third party and the RIPE NCC. Users of the Proxy Service -------------------------- In the past ten years, the RIPE NCC has had 31 requests for the proxy service and over the past year, there have been only four active users of the service. Of these four, one is already a RIPE NCC member. NIC Information --------------- All NIC information is still available without access to the proxy service. In the normal presentation of whois data, there is a redirect system that allows users with a normal whois client to deal directly with the RIPE Database whois service. There is no need for a proxy service in this scenario. The proxy service is only necessary if the data needs to be presented in alternative forms, such as on a third party's website. The limits imposed on RIPE Database queries only apply to personal data. Users can always access NIC data in any form they like if they are happy not to receive personal data. On 6 March 2012, the RIPE NCC proposed to change the default behaviour of the query system to instead return only "ALLOWED" results if a user had reached their daily personal data query limit, but there was disagreement over this on the mailing list so the change was not implemented. The proposal is available at: http://www.ripe.net/ripe/mail/archives/db-wg/2012-March/003885.html Legal Considerations -------------------- The RIPE NCC operates under European Data Protection laws, so to avoid risk in this area we insist on having a contract with third parties who wish to use the proxy service. The RIPE NCC and its Executive Board believes that the proxy service should become a member service because it tightens the contractual relationship between the RIPE NCC and third parties. Currently, no such agreement that meets the EU Data Protection legislation is in place between the RIPE NCC and the proxy service users. In order to tighten the contractual relationship between the RIPE NCC and the Proxy service users, taking into account the recent approval of the Charging Scheme 2013 that caused a simplification of the contractual agreements between the RIPE NCC and its service users, the RIPE NCC offered to conclude the membership agreement for continuation of the service. Next Steps? ------------ The Executive Board approved changes to the draft version of the Activity Plan and Budget 2013, and the RIPE NCC published the final version on 13 December 2012: http://www.ripe.net/internet-coordination/news/announcements/ripe-ncc-activ… We do apologise, however, that the changes regarding the proxy service were not more explicitly communicated to the members and the RIPE community in advance of the final publication of the Activity Plan. The RIPE NCC asks that non-RIPE NCC member proxy service users become members but we propose to waive their membership fee until the discussion of the RIPE NCC Charging Scheme 2014 takes place. This will give the membership and community the opportunity to discuss the best way forward for the proxy service in the coming months while ensuring a strong contractual bond between the RIPE NCC and users of this service. In the meantime, there will be no changes to the proxy service and no loss of functionality for the community. The RIPE NCC and its Executive Board will return to its members with proposals for ways to ensure that their wishes are met with regard to service developments while allowing the RIPE NCC to be operate efficiently and responsively. If you have any comments on this issue, please direct them to the RIPE NCC Services Working Group mailing list <ncc-services-wg(a)ripe.net>. Best regards, Axel Pawlik Managing Director RIPE NCC

4 3

Fw: Gmail and SSL
by Michael Painter 03 Jan '13

03 Jan '13

Michael Painter wrote: > Damian Menscher wrote: > [Full disclosure: I work at Google, though the opinions stated below are >> mine alone.] > snip Good luck finding another provider that >> enables SSL by default [1], offers 2-factor authentication [2], warns you >> when you're being targeted by state-sponsored attackers [3], and actually >> fights overly-broad subpoenas from governments [4]. > > > I like the notification when an unusual IP address accesses your account. > > Thanks, > > --Michael

1 0

Join my network on LinkedIn
by Luis Palma Lopez via LinkedIn 02 Jan '13

02 Jan '13

LinkedIn ------------ Luis Palma Lopez requested to add you as a connection on LinkedIn: ------------------------------------------ I'd like to add you to my professional network on LinkedIn. Accept invitation from Luis Palma Lopez http://www.linkedin.com/e/-voa23o-hbghuaa4-6f/q0XU4EiXDUS2IbxL1NdPb3ZaZI/bl… View profile of Luis Palma Lopez http://www.linkedin.com/e/-voa23o-hbghuaa4-6f/rso/90277286/KLaW/name/500543… ------------------------------------------ You are receiving Invitation emails. This email was intended for Ted Fischer. Learn why this is included: http://www.linkedin.com/e/-voa23o-hbghuaa4-6f/plh/http%3A%2F%2Fhelp%2Elinke… (c) 2012, LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

11 10

Re: Gmail and SSL
by Keith Medcalf 02 Jan '13

02 Jan '13

No more difficult at all. A MITM is a MITM. The atack is the same and intteger-store-bought certificates make the process neither more nor less complicated. Sent from Samsung Mobile -------- Original message -------- From: William Herrin <bill(a)herrin.us> Date: To: George Herbert <george.herbert(a)gmail.com> Cc: John Levine <johnl(a)iecc.com>,nanog(a)nanog.org Subject: Re: Gmail and SSL

1 0

Re: Gmail and SSL
by Keith Medcalf 02 Jan '13

02 Jan '13

Perhaps Googles other "harvesters" and the government agents they sell or give user credentials to, don't work against privately (not under the goverment thumb) encryption keys without the surveillance state expending significantly more resources. Perhaps the cheapest way to solve this is to apply thumbscrews and have google require the use of co-option freindly keying material by their victims errr customers errr users. Sent from Samsung Mobile -------- Original message -------- From: Christopher Morrow <morrowc.lists(a)gmail.com> Date: To: "John R. Levine" <johnl(a)iecc.com> Cc: nanog(a)nanog.org Subject: Re: Gmail and SSL

5 4

ATT/Bellsouth Mail
by Nick Olsen 02 Jan '13

02 Jan '13

Looking for a contact at ATT/Bellsouth regarding email acceptance. (@bellsouth.net) I've been unable to send them mail with a 550 Error (Blocked for abuse) and have requested de-listing no less then 5 times. Not getting anywhere, Normal contact routes have failed. Nick Olsen Network Operations (855) FLSPEED x106

1 0