[db-wg] ORG record vetting ?

Hi Denis,

The RIPE NCC considers an object "co-maintained" if it has both a user maintainer and a RIPE NCC maintainer.

This is how we determine whether an object has "managed" attributes, which are highlighted in blue in the web application query response.

If an ORGANISATION object is co-maintained with the RIPE NCC, the user is not able to change the highlighted values (e.g. “name:”) or remove the object from any RIPE NCC-allocated resources it is associated with. The user is also not able to add/remove the RIPE NCC maintainer from objects.

More information on the highlighted values is available here:
https://www.ripe.net/manage-ips-and-asns/db/support/highlighted-values-in-the-ripe-database <https://www.ripe.net/manage-ips-and-asns/db/support/highlighted-values-in-the-ripe-database>

Kind regards, 
Thiago da Cruz



> On 1 Aug 2019, at 04:34, ripedenis--- via db-wg <db-wg at ripe.net> wrote:
> 
> Hi Jacob
> 
> Yes you are right. The RIPE NCC can correct me if I am not entirely correct here :) I believe, if an ORGANISATION object is referenced by a resource object (even if it is "org-type: OTHER") then some attributes in the ORGANISATION object will be locked. These, including the "org-name:", cannot be changed by the resource holder. This can be seen if you query the object in Webupdates, but I am not sure if there is a programatic way of checking this.
> 
> Or you could do an inverse query on an ORGANISATION object and if any resource objects are returned (allocations, ASSIGNED PI or ASNs) then you know this ORGANISATION object was subject to due diligence. Again not easy but programatically doable.
> 
> cheers
> denis
> 
> co-chair DB-WG
> 
> On Thursday, 1 August 2019, 03:37:23 CEST, Jacob Slater <jacob at rezero.org> wrote:
> 
> 
> it is type 'OTHER' it was not created by the RIPE NCC and will not have been subjected to any due diligence checks by the RIPE NCC.
> 'OTHER' objects which receive direct assignments from the NCC (PI IP space or ASNs) are still subjected to due diligence checks (though only at the time of assignment).  
> I'd still argue the flag exists - search for 'ASSIGNED PI' (on IP space) or 'ASSIGNED (on ASNs) with the associated ORG object to see if any exist. Not exactly (currently) straight forward but it is still definitely doable.
> 
> Jacob Slater
> 
> On Wed, Jul 31, 2019 at 6:31 PM ripedenis--- via db-wg <db-wg at ripe.net <mailto:db-wg at ripe.net>> wrote:
> HI Nick
> 
> The ORGANISATION object has an "org-type:"  attribute. Most ORGANISATION objects have a value of either 'LIR' or 'OTHER'. If it is 'LIR' that ORGANISATION object was created by the RIPE NCC for a resource holder and has been through the due diligence process. If it is type 'OTHER' it was not created by the RIPE NCC and will not have been subjected to any due diligence checks by the RIPE NCC. So I think the 'binary flag' you suggested already exists.
> 
> cheers
> denis
> 
> co-chair DB-WG
> 
> 
> On Monday, 29 July 2019, 19:40:47 CEST, Nick Hilliard via db-wg <db-wg at ripe.net <mailto:db-wg at ripe.net>> wrote:
> 
> 
> >> There are ways of flagging whether this process was carried out. One
> >> option would be to use a binary flag. Another would be to implement a
> >> datestamp for the last due diligence process carried out if it's not
> >> been set by the NCC.  Lack of data could be flagged by either the
> >> absence of the parameter or else use 0000-00-00T00:00:00Z.
> >
> > less sure here.  i can see wanting to differentiate between the two
> > classes of objects.  not sure i care when they were last separated.
> > unless you expect things to change in time.
> 
> 
> if you have a better suggestion, go for it. My concern is mainly about 
> having a deterministic way of figuring out which org objects have been 
> subjected to due diligence and which haven't.
> 
> Nick
> 
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/db-wg/attachments/20190805/a8fa1672/attachment.html>