[db-wg] DB WG draft minutes RIPE 51

["Titley, Nigel" <]

Gentlefolk,

In an effort to make up for the lateness of last time, here are the draft
minutes for the meeting that finished 30 minutes ago.

Please could I have comments on *both* sets of minutes please. After 2 weeks
I will move the RIPE 50 minutes to non-draft status and update the web site.
The RIPE 51 minutes will remain at draft status until next meeting, as
usual.

Best regards

Nigel
-- 
Nigel Titley
Peering Coordinator, FLAG Telecom
+44 20 8564 5812



**********************************************************************
This e-mail message is confidential and is intended only for the use of the
individual or entity named above and contains information which is or may be
confidential, non-public or legally privileged. Any dissemination or
distribution of this message other than to its intended recipient is
strictly prohibited. You should not copy it or use it for any purpose nor disclose 
the contents to any other person. If you have received this message in error, please
notify us by email to postmaster@localhost immediately and delete the
original message and all copies from all locations in your computer systems.


This e-mail has been swept by Mailsweeper TM for viruses. However, FLAG
Telecom cannot accept liability for any damage which you may sustain as a
result of software viruses.
**********************************************************************

  



This message has been scanned for viruses by MailControl - www.mailcontrol.com
RIPE51 Database WG draft Minutes
14th October 2005

A. Administrative Matters

	* scribe					(Nigel Titley, FLAG Telecom)
    * list of participants
    * agenda
    * minutes (please all review and return comments (2 weeks))
    [AP51.1 NT13] To watch list, fold in updates to RIPE-50 minutes and release
    			  after 2 weeks.
    * "remote participation" coordination (if needed)

    
46.5	WW			Coordinate with RIPE NCC to prepare a document 
					summarizing basic assumptions about the use of the database. 
                	[Various documents have been produces, and others need updating, but overtaken
                	by events, Closed]

47.3	RIPE NCC	Write a document properly documenting the use of the
					IRT object for reporting abuse.
					[Part of general documentation issue, ongoing]

48.6	RIPE NCC	To change DB behaviour to return IRT object
					[Misunderstanding of requirement, superceded by AP51.8, complete]
					
49.2	RIPE NCC	Give updates about the number of abuse records
					in the database to the Working Group.
					[Sent to list, Complete]

50.1	WW			Take proposal to make the country attribute optional and multiple for 
					inetnum and inet6num objects to the mailing list
					[Take to policy development process, Ongoing]

B. 	DB Update (N.N., RIPE NCC)
	See presentation
	
	Things are really stable, query rates, update rates, query mix etc. 
	Statistics are all online.
	Database documentation is being gradually reworked, and is being broken up into
	various reference manuals. Document formats will be PDF and HTML.
	New whois software is much easier to install (autoconf friendly)
	Signed updates will now expire a week after signature, to prevent replay attacks.
	WW noted problems with gnupg and dates of signature. This will be checked.
	[AP51.2 RIPE NCC] Check gnupgp compatibility before release of functionality.

C	Review of security mechanisms in the DB (Peter K., denic.de)
	. quality of CRYPT-PW, CRYPT-MD5, X.509
		This is a proposal to deprecate CRYPT-PW. See presentation.
		CRYPT-PW is relatively easy to break. 25% of all maintainer objects
		still contain CRYPT-PW and hence are easy to crack (weakest scheme wins).
		Why bother? RIPE community responsible for the strength of its tools.
		MD5-PW is much stronger and may be kept, at least for the moment.
		
		It was noted ??-PW cannot prevent replay attacks as there is not embedded
		timestamp, although if you have the update message you actually have the
		password.
		
		It was noted that John the Ripper now supports MD5-PW, although at about
		100 times slower than CRYPT-PW.
		
		It was agreed that the DB-WG should go with the proposal and should 
		have a practice with the Policy Development Process.
		[AP51.3 Peter Koch] Start by formulating the proposal on the mailing list.

D. 	State of whois services, developments? (WW144, N.N., RIPE NCC)
	There are concerns with the privacy of registry data.
	WW has tried to get different parts of the EU to talk to each other and
	formulate a unified view of requirements, ie is privacy important?
	AT the moment this is more of a problem in the domain name area, but it is
	possible that it may become an issue for IP addresses too. See the next presentation.

E. 	IRIS pilot frontend to whois (Shane Kerr, RIPE NCC)
	See presentation
	Please have a look and see if it satisfies user requirements.
	
	It was confirmed that IPv6 is also supported.
	There is no support for routing policy at the moment in the protocol, although
	this is being looked at, and a set of requirements being formulated.
	There are some doubts as to the exact benefits that IRIS gives to
	routing registries.
	[AP51.4 RIPE NCC] Check that the mapping of contacts is indeed not properly
	supported in IRIS (admin-c and tech-c).
	[AP51.5 RIPE NCC] Check and see if there are any other missing attributes
	that are needed for RIPE community.

F. 	Fact finding: RoutingReg facilities at RIRs (Gert D, SpaceNet)
	No presentation
	Do any of the other RiRs have facilities to store RPSL-ng objects?
	There appear to be no objects in any of the other RiRs.
	[AP51.6 Matt ?? (ARIN)] To find out if any of the other routing registries have the
	ability to store RPSL-ng.

X. 	Impact of "PDP" on how the DB-WG operates (WW144) [~15 min]
	. ref: https://www.ripe.net/ripe/docs/ripe-350.html
	From this WG meeting onwards, any sizeable changes should go through the PDP.
	Note that this WG is not intended to invent things, but to fill in the gaps left
	by other WGs and make sure that they get the appropriate attention.

Y. 	Input from other WGs

    * DNS: secureDNS requirements for the DB
    This has already been covered by the DB Update presentation.
    [AP51.7 RIPE NCC] Make sure that the proposed DNS Security changes are implemented

Z. 	AOB
	Show irt: objects by default on address queries
	There has been some misunderstanding of this requirement. It is still necessary
	to use the -c flag to get the irt: object, whereas the requirement was that
	if the irt: object existed then it should be returned.
	It was noted that this would result in a object being returned which was not
	actually referred to in any of the queried objects. This is a change in behaviour,
	but there was no objection to this.
	[AP51.8 RIPE NCC] To properly implement behaviour as requested.
	[AP51.9 RIPE NCC] To contact a subset of the spam tool writers and make sure
	that they are aware of the change in behaviour.