sig-policy September 2020

sig-policy@lists.apnic.net

4 participants
5 discussions

Monthly List Reminder
by noreply＠apnic.net 30 Sep '20

30 Sep '20

Dear Subscriber, This is the monthly reminder of subscription information for the sig-policy list, hosted at APNIC. For subscription information including how to un-subscribe go to http://mailman.apnic.net/mailman/listinfo/sig-policy Thank you for participating in this discussion. Kind Regards, List administrator

1 0

SAFNOG + ZANOG Virtual Conference
by Portia Rabonda 25 Sep '20

25 Sep '20

Dear All, SAFNOG and ZANOG are excited to bring you the SAFNOG + ZANOG Virtual Conference. While we had deferred the 2020 conferences to 2021 due to the COVID-19 global pandemic, we realise that there is a strong need to not only keep the conversations on the issues and development of the Internet ongoing but now more than ever, to provide a platform to keep the community engaged and discuss new challenges. For this reason, SAFNOG and ZANOG will be teaming up to host the SAFNOG and ZANOG Virtual Conference on 29 October 2020. The SAFNOG + ZANOG Virtual Conference will bring together industry experts from the region to discuss the trends and challenges relating to the internet, including the effects of the global pandemic. The conference will consist of presentations and a panel discussion from a panel of experts. Further details including registration will be shared soon. Regards, Portia Rabonda On behalf of SAFNOG MC

1 0

about prop-125 Implementation update
by JORDI PALET MARTINEZ 10 Sep '20

10 Sep '20

Hi George, all, I just looked at the presentation that you have done earlier today and have some inputs about possible ways to improve it. 1. Slides 9-10 1.1. About receiving spam The abuse mailbox should receive *all* the emails to be able to receive abuse reports about spam. If you filter emails that contain headers from spam, then you are ruining the purpose of the abuse-c. Clearly this could be improved, as an operational decision, by making some kind of automation, but in such way that ensures that only real spam is dropped. Note that the other RIRs are also using (at some point), validation links via the abuse-c email. 1.2. About clicking links I provided an example procedure in the policy proposal to avoid this. I've copied this below my signature. See points 1-5. If that procedure is followed, I think it is obvious that you will avoid this problem. I missed to ensure during the previous implementation presentations, that you are following a procedure that avoids this problem. Of course, you can even avoid needing to send the validation link if you just say in the email with the code "you need to go to your MyAPNIC account to use this code" ... Maybe also an alternative is to use email certificates from APNIC. 2. Slide 11 2.1. About the validation cycle. In more recent versions of this policy, in other RIRs, I have included specific text so APNIC can accommodate both, the validation periods and the cycle validation. The idea is that you can do a slow start (which seems not to be needed in the case of APNIC due to the 87% validation success - congratulations!), but you can also adjust the timing depending on the staff available to escalating the validation, or to move from 6 months to 1 year once the "99%" of the contacts are valid, and if needed, for example, the contacts get bad, move again to 6 months or even 3 months to get them again on track. 2.2. Deprecating IRT. The policy proposal included in the ADDITIONAL INFORMATION section: "a. Since this proposal is implemented, APNIC will publish the IRT also as abuse-c, in order to facilitate the search in whois, for the same information, regardless if looking for abuse-c or IRT. This is done in order to assimilate the IRT to the majority of the RIRs where it is abuse-c." So clearly, the idea was that we move from the IRT to abuse-c, so to align as much as possible all the 5 RIRs (in ARIN is POC, and AFRINIC is also IRT, but there is a policy proposal like this one, an in fact there are only a ridiculous fraction of IRT objects because is not mandatory right now). I've one question I've. What is the status of implementation at each NIR? Now, regarding the points that I've commented above, I will be happy to get additional inputs and send a policy proposal in a few days. I don't think we should do anything about 1.1. 1.2 and 2.2 should be addressed as part of the operational procedure by the staff. We can address 2.1. Something else? Now, a possible idea to improve this will be move the policy to make mandatory the use of XARF "eXtended Abuse Reporting Format" (RFC5965/RFC6692). There is already open source (and commercial tools) that allow it. This will resolve the problem 1.1 above and provide much better tools to the resource-holders to avoid manual monitoring as much as possible, automate the abuse processing, etc. Can we get some inputs about if this is perceived as interesting by the community? Maybe we can draft the policy proposal in such way that XARF can be optional at this stage, and later on, if there is a good adoption %, in 1-2 years, move to mandatory? I will send a policy proposal to update this upon getting some inputs. I guess Aftab will be happy to join as well, and happy to get other people on-board! Regards, Jordi @jordipalet c. Example of the validation procedure. 1) APNIC initiates the validation automatically, sending TWO consecutive emails to each of the mailboxes. 2) These emails will be sent containing plain text only. 3) The first email will contain the URL where the validation is to be performed ("validation.apnic.net") and may contain information about the procedure, a brief summary of this policy, etc. 4) The second email will contain a unique alphanumeric validation code. 5) The person in charge of the each of the mailboxes must go to the URL and paste the code received in the second email in the form. 6) This URL must be designed in such a way that it prevents the use of an automated process (for example, "captcha"). In addition, it must contain a text that confirms that the person performing the validation understands the procedure and the policy, that they regularly monitor the mailboxes, that measures are taken to solve reported cases of abuse, and that the abuse report receives a response, with a "checkbox" that must be accepted in order to proceed. 7) The alphanumeric code will only be valid for a maximum of fifteen days. 8) If the code is not entered within that time, the system will mark the IRT as "temporarily invalid” and will send a reminder with another unique code and alert APNIC staff, so they can initiate a personalized follow-up with the LIR. 9) If no reply is received confirming that the situation has been corrected, after an additional period of three business days, the IRT will be permanently marked as "invalid". 10) Once the issue has been resolved, the validation process will be repeated automatically (items 1 to 7 above). If satisfactory, the IRT will be marked as "valid"; otherwise it will be considered in breach of the policy. ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

PDP and SIG Guidelines Review Report (Policy SIG earlier today)
by JORDI PALET MARTINEZ 10 Sep '20

10 Sep '20

Hi all, I just saw the video (not able to attend on-line to all the sessions because a very different time zone all the week), of the Policy SIG session today, and specially the "PDP and SIG Guidelines Review Report". I've seen also the diff of both documents. I feel somehow "guilty" about this topic, as I was the one pushing for several policy proposals to update the PDP. I think that the pandemic showed us that, without having the crystal ball, I was right in many points! Despite that, I'm very happy that finally, there are some action to update this, however I've doubts about the say to proceed and the proposed changes. The first big question is that I'm not sure the actual PDP allows "editorial" changes to be actually made without the community consensus. Also, the associated problem is to agree in what is and what not an editorial change. Sunny actually said that in his presentation, confirming that the community owns those documents. In principle, I could agree that if they are really pure editorial inputs, they can be changed by the staff, but in any case, this needs to have a pass thru the community (as mandated by ICP-2 and consensus/bottom-up approach), and I guess this is the appropriate mailing list for that. So, I will start by commenting in detail the proposed changes. However, for that, I need a word or txt version, as I tried to use the html-diff and if I try to copy one column to paste as text, it actually copies both columns ... Can the secretariat provide such doc or txt version already? (doc has the advantage to allow track of changes and comments, I think it is preferable). I know that it is the plan, but I will like to start now (no reason to delay it), as I've some more availability now, that will not necessarily be the case in a few days/weeks (I'm strong believer of "never leave till tomorrow what you can do today"). Further inputs to the today's session: 1) I agree with some of the inputs from Owen. For example, the voting for elections, I've proposed this actually in other regions. I will prefer 6 months instead of 60 days. The goal is that only people in the mailing list 6 months before the month where the elections happens is allowed to vote in order to avoid possible fraud in elections (100 friends of one of the candidates registering only for voting). 2) On Gaurab comment, and somehow Aftab. I also think that we will need a PDP change to allow having OPM by their own (if it becomes necessary for whatever reason, LACNIC PDP already allows it without changes) and as it was in one of my policy proposals, because the EC already needs to endorse a proposal, this is sufficient and not AGM approval is needed, it is a "repetitive" process. 3) Following another Owen input, SIG guidelines don't necessarily need to be the same for all the SIGs, because there is a substantial difference between the Policy SIG and the others (the Policy SIG makes policies, not the others). So the PDP should be self-contained and not depend on "other" SIG guidelines. Tks! Regards, Jordi @jordipalet ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

2 1

AS0 RPKI system deployed in production (Prop132)
by Srinivas (Sunny) Chendi 02 Sep '20

02 Sep '20

________________________________________________________________________ AS0 RPKI system deployed in production (Prop132) ________________________________________________________________________ The AS0 RPKI system previously in test has now been deployed to production. This completes implementation of APNIC Policy Prop132 "RPKI ROAs for unallocated and unassigned APNIC address space" https://www.apnic.net/community/policy/proposals/prop-132 A new TAL is being used which can be fetched from: https://tal.apnic.net/apnic-as0.tal Alternate forms of this TAL are also available and are documented at: https://www.apnic.net/community/security/resource-certification/tal-archive/ Please replace any prior TAL configuration in your RPKI validation systems. If you are not using this TAL consider adding it to get notification of authenticated denial of unallocated resources in the APNIC region. A report on deployment will be presented at APNIC50. This service will be discussed in the APNIC Routing SIG at the meeting, and subsequently on the mailing list: https://www.apnic.net/community/participate/sigs/routing-sig/ A blog article describing the deployment methodology is available at: https://blog.apnic.net/2020/09/02/policy-prop-132-as0-for-unallocated-space… Caveats and warnings about the use of this AS0 ROA are documented at: https://www.apnic.net/community/security/resource-certification/apnic-limit… ________________________________________________________________________ APNIC Secretariat secretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3100 PO Box 3646 South Brisbane, QLD 4101 Australia Fax: +61 7 3858 3199 6 Cordelia Street, South Brisbane, QLD http://www.apnic.net ________________________________________________________________________

1 0

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

sig-policy September 2020