On 4/6/22 10:55 AM, John Curran wrote:
Interesting philosophy - historically ARIN customers have asked for simplicity in the relationship; i.e. a single fee that encompasses all of the services - in this way, an organization can utilize something without having to “get new approval” and there’s no financial or service disincentive for deployment of IPv6, IRR, RPKI, etc.
Feel free to propose an alternative structure if you think it makes sense - the suggestion process would be a good step (but feel free to run for the ARIN Board of Trustees if you want to really advocate for a different approach.)
John, I think you raise an interesting point here. From an outside perspective it seems to me that ARIN is using RPKI participation as leverage to get legacy space holders to sign an LRSA. You have mentioned in past messages that this is at least in part based on the desire to recover costs related to providing that service. So let's look creatively at the cost issue. Taking that claim at face value, I wonder if it's possible for ARIN to compromise slightly here, in the interest of encouraging the adoption of RPKI to the benefit of the Internet community. My suggestion is to open participation in RPKI to anyone with legacy space who is paying ARIN a fee for service, regardless of LRSA status. Someone else mentioned creating a lightweight agreement for legacy space holders who want RPKI, which I think is a good idea. I'm not up on the current contents of the LRSA, but I imagine that there is an indemnification clause. I would be surprised if your lawyers didn't want that for the situation I'm proposing as well. Being lawyers, I imagine that they can come up with other things too. :) But given that you're already contracting with these parties for other services, a "rider" for RPKI should be easily accomplished. I think that there is broad agreement (although I note not universal agreement) that RPKI is a good thing, and that its use should be encouraged. I would like to see ARIN do everything in its power to support that goal. I think it's also worth noting that there are options with at least one other RIR for legacy space holders to get into RPKI with a lighter weight mechanism than what ARIN is offering. While on the one hand I think that there is some value in the RIR model in that services can be tailored to meet the needs of those in their regions, I don't think users in the ARIN region should need to "jump the fence" in order to help make the Internet more secure. What do you think? Doug