[address-policy-wg] 2007-01 Last Call for Comments(Direct Internet Resource Assignments to End Users from the RIPE NCC)

Sander Steffann wrote:
[..]
>> i will give you 10000 bucks and during 100 years it will not what your
>> problem, what the block became.
> 
> It still remains a problem. This proposal is not about the money. It is 
> about responsible stewardship of internet resources. The way provider 
> independent resources are handled now it is impossible to follow what is 
> happening to those resources. Resources that are not in use anymore are 
> lost because there is no way to check this, while other organisations 
> might need those resources.
> 
> Policy proposal 2007-01 was introduced to solve this problem. With a 
> contract between an LIR (or RIPE NCC) and the end user, we can follow 
> the resource. We could check if it is still in use, if the usage still 
> complies with the policies, etc.

All the resources RIR's provide though have amongst others the following 
two properties:
  a) no guarantee about the resources uniqueness
  b) no guarantee that the resource can be used everywhere

And with this proposal another one comes along:
  c) when one has a resource, there is no way to 'block' one from
     using it even after no payment or voiding/expiry of contract.

Thus even if there is a contract and some cash involved, the moment that 
the contract is not valid any more and/or the cash is not paid anymore, 
the resource can still be used, because of a).

Domain Registries are really delegating, without that link from the TLD 
one doesn't have a domain, it simply doesn't function (unless one 
hijacks a rather large set of DNS servers around the world :)

For the RIR's though, there is currently not a real way to actually 
enforce the contract or the payment, let alone that when the data is 
invalid, that one can enforce that. This is good in one way (the whole 
idea of the Internet) but bad in the way

Then again, one can today already simply take a prefix and simply use 
it. It is at up to the ISP's who carry that prefix to accept it or not.

There are a couple of proposals that might (might as when ISPs want to 
carry something they can and will do so) help enforce this a little bit 
but require full cooperation:
  - (S-)BGP(-S)
  - Route Objects
  - etc

But as the first is nearly unused that doesn't work. The second one is 
used, but unfortunately not by the non-RIPE membership and it won't 
provide full lockdown.

The only 'power' that a RIR has and can mostly enforce (unless an ISP 
hijacks a resource and forces/gets others to accept it) though is 
something they do on a daily basis: provide new resources.

As such, when for a resource under this, or another, policy, the 
contract expired or the fees are not properly paid, but the resource is 
kept in use, the RIR could block any new allocations to requesters who 
do still allow the expired resource to exist and be used.

Detection of which can be done fully automated with RIS and similar 
tools at thus virtually no additional cost. The RIR can then at least 
ask the requester to contact their neighboring ISP to stop using an 
expired resource.

This is playing cop a bit though, which is something that the RIRs 
should avoid, but, in this case might be one of the few ways to resolve 
the issue where someone sets up a contract one year and then simply 
ignores it for the rest of their lives while keeping the use of the 
resource. The contract though is legal, thus it might be possible to 
also let the RIR go to court for these things.

Greets,
  Jeroen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: OpenPGP digital signature
URL: </ripe/mail/archives/address-policy-wg/attachments/20080408/1950f7b1/attachment.sig>