On 4/6/22 10:55 AM, John Curran wrote:
Interesting philosophy - historically ARIN customers have asked for simplicity
in the relationship; i.e. a single fee that encompasses all of the services -
in this way, an organization can utilize something without having to “get new
approval” and there’s no financial or service disincentive for deployment of
IPv6, IRR, RPKI, etc.
Feel free to propose an alternative structure if you think it makes sense - the
suggestion process would be a good step (but feel free to run for the ARIN
Board of Trustees if you want to really advocate for a different approach.)
John,
I think you raise an interesting point here. From an outside perspective
it seems to me that ARIN is using RPKI participation as leverage to get
legacy space holders to sign an LRSA. You have mentioned in past
messages that this is at least in part based on the desire to recover
costs related to providing that service. So let's look creatively at the
cost issue.
Taking that claim at face value, I wonder if it's possible for ARIN to
compromise slightly here, in the interest of encouraging the adoption of
RPKI to the benefit of the Internet community. My suggestion is to open
participation in RPKI to anyone with legacy space who is paying ARIN a
fee for service, regardless of LRSA status.
Someone else mentioned creating a lightweight agreement for legacy space
holders who want RPKI, which I think is a good idea. I'm not up on the
current contents of the LRSA, but I imagine that there is an
indemnification clause. I would be surprised if your lawyers didn't want
that for the situation I'm proposing as well. Being lawyers, I imagine
that they can come up with other things too. :) But given that you're
already contracting with these parties for other services, a "rider" for
RPKI should be easily accomplished.
I think that there is broad agreement (although I note not universal
agreement) that RPKI is a good thing, and that its use should be
encouraged. I would like to see ARIN do everything in its power to
support that goal. I think it's also worth noting that there are options
with at least one other RIR for legacy space holders to get into RPKI
with a lighter weight mechanism than what ARIN is offering. While on the
one hand I think that there is some value in the RIR model in that
services can be tailored to meet the needs of those in their regions, I
don't think users in the ARIN region should need to "jump the fence" in
order to help make the Internet more secure.
What do you think?
Doug
