Send ARIN-consult mailing list submissions to arin-consult@arin.net
To subscribe or unsubscribe via the World Wide Web, visit http://lists.arin.net/mailman/listinfo/arin-consult or, via email, send a message with subject or body 'help' to arin-consult-requ...@arin.net You can reach the person managing the list at arin-consult-ow...@arin.net When replying, please edit your Subject line so it is more specific than "Re: Contents of ARIN-consult digest..." Today's Topics: 1. Re: Consultation on ACSP 2018.3 (Jimmy Hess) 2. Consultation on Expanding the Size of the ARIN Board of Trustees (ARIN) 3. Re: Consultation on Expanding the Size of the ARIN Board of Trustees (Bill Woodcock) 4. Re: Consultation on Expanding the Size of the ARIN Board of Trustees (William Herrin) 5. Re: Consultation on Expanding the Size of the ARIN Board of Trustees (Bill Woodcock) ---------------------------------------------------------------------- Message: 1 Date: Tue, 3 Apr 2018 04:31:01 -0500 From: Jimmy Hess <mysi...@gmail.com> To: ARIN <i...@arin.net> Cc: arin-consult@arin.net Subject: Re: [ARIN-consult] Consultation on ACSP 2018.3 Message-ID: <caaawwbwlvvbntbumre0udqcn6267su5zqbnpd68o5n1xmzh...@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" On Wed, Mar 28, 2018 at 4:16 PM, ARIN <i...@arin.net> wrote: > Question: If ARIN redirects http to https requests, should ARIN then > use HSTS for web-based Whois queries? -ARIN should send HSTS headers If and Only If: ALL web-based traffic to that hostname used with HTTP are mandated to be over HTTPS. -HSTS headers should not be sent for whois.arin.net if Non-HTTPS whois queries are allowed. -Non-HTTPs Whois queries should be allowed, and Non-HTTPs should be the default for simple queries of WHOIS information. Rationale: The WHOIS database is public information, and the use of HTTPS creates potential access issues or impairments for some browsers, and requires additional resources related to the CPU cost of encryption and Certificate Revokation checks. > Question: Should ARIN automatically redirect user Whois queries made > via "http" to "https"? Should not redirect. The WHOIS protocol itself does not provide secrecy. The web WHOIS query interface is an alternative interface to the WHOIS data...; Furthermore, there is not a reasonable expectation of privacy regarding what users lookup in WHOIS --- heavy WHOIS users ought to be monitored carefully and be subject to the possibility of public reporting and transprency on their individual usage querying the public service by their IP and/or lookup history or patterns, as there is a high potential for abusive activities such as automated data mining or harvesting e-mail address contacts to spam. So long as the WHOIS protocol itself continues to be supported -- it seems pretty unreasonable to force HTTP users to access the data over TLS while not allowing visitors the option to access WHOIS over plain HTTP when the WHOIS over WHOIS continues to be allowed and is equal to plain HTTP. The forced redirect would surely cause some WHOIS queries to fail, as some users will eventually be running browsers that cannot reach agreement with ARIN's https servers over a secure protocol version and/or ciphers. The WHOIS database is supplying information listed as publicly available, and there is no expectation of privacy within the contents of the public information -- It could be very useful for ARIN to provide digitally signed WHOIS listings to confirm their authenticity, and ensure WHOIS data is not tampered with on storage medium or before/during transit; However, the HTTPS protocol is not capable of fully providing this level of assurance. For operating on public WHOIS data it is more suitable to provide digitally signed query responses, and a verifiable digital signature for each record. API requests capable of modifying records ought to be required to be digitally signed requests by an authorized user (HTTPS / TLS does not provide this) ---- > Question: If ARIN redirects http to https requests, should ARIN then > use HSTS for web-based Whois queries? > > The feedback you provide during this consultation will help inform how > ARIN will proceed in response to ACSP 2018.3. All messages that have > been sent to the arin-consult mailing lists in response to this > suggestion prior to the opening of this consultation will be included in > our feedback collection resulting from this consultation. Thank you for > your participation in the ARIN Consultation and Suggestion Process. > > Please provide comments to arin-consult@arin.net. > > Discussion on arin-consult@arin.net will close on 30 April 2018. If you > have any questions, please contact us at i...@arin.net. > > Regards, > > John Curran > President and CEO > American Registry for Internet Numbers (ARIN) > > > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN > Consult Mailing > List (ARIN-consult@arin.net). > Unsubscribe or manage your mailing list subscription at: > http://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN > Member Services > Help Desk at i...@arin.net if you experience any issues. -- -JH ------------------------------ Message: 2 Date: Fri, 6 Apr 2018 14:14:31 -0400 From: ARIN <i...@arin.net> To: arin-consult@arin.net Subject: [ARIN-consult] Consultation on Expanding the Size of the ARIN Board of Trustees Message-ID: <3b14c137-01cf-dca5-5da6-3adb752ee...@arin.net> Content-Type: text/plain; charset="utf-8"; Format="flowed" In May 2017, the ARIN Board of Trustees proposed expansion of the size of the Board of Trustees in order to increase opportunities for diversity in the background of Board members, including geographical and gender representation. This proposal was the topic of an energetic community consultation with mixed outcome indicating both support and concerns with such a change. The ARIN Board considered the outcome of the consultation, but ultimately the measure did not achieve the four-fifths approval threshold necessary for changing ARIN's Bylaws. In February of this year, the ARIN Board discussed an additional issue related to the present size of the Board: specifically, the challenge that a smaller Board poses when engaging in strategic discussions, for example in regard to long-term direction or relationships with other Internet organizations. While many of these topics are discussed with the community prior to decision (e.g. formation of the NRO, support for the IANA Stewardship Transition), it is often up to the ARIN Board of Trustees to decide whether to explore these initiatives when they are at an early stage. There is a very wide diversity of the Internet ecosystem that can be affected by ARIN's strategic direction and this includes Internet service providers of all sizes and types (transit, access, etc.), Internet online and content industries, data center and cloud operators, educational and government networks, commercial firms, and civil society. While the Trustees elected by the community often have a broad knowledge of the Internet ecosystem, seven Trustees is a relatively small group to evaluate impacts across the entire Internet ecosystem. As a result of this discussion, the ARIN Board agreed to initiate a new community consultation to expand the number of elected Board members from six to nine, in order to allow for wider representation of the Internet community during Board discussions. *Board proposal:* ARIN should add three more elected voting seats to the Board of Trustees, raising the current six (two elected per year) to nine (three elected per year). New Board seats are to be added to the Board in a phased manner ? one per year in the 2018 thru 2020 elections as noted below * October 2018: 3 Board members will be elected for 2019; 8 Trustee board (9 if the appointed seat is used) * October 2019: 3 Board members will be elected for 2020; 9 Trustee board (10 if the appointed seat is used) * October 2020: 3 Board members will be elected for 2021; 10 Trustee board (11 if the appointed seat is used) We are seeking community feedback on this proposed change to the size of the ARIN Board of Trustees. This consultation will remain open for at least 30 days. Please provide comments to arin-consult@arin.net. Discussion on arin-consult@arin.net will close on 14 May 2018. If you have any questions, please contact us at i...@arin.net. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN) -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.arin.net/pipermail/arin-consult/attachments/20180406/ede5f909/attachment-0001.html> ------------------------------ Message: 3 Date: Fri, 6 Apr 2018 11:40:14 -0700 From: Bill Woodcock <wo...@pch.net> To: arin-consult@arin.net Subject: Re: [ARIN-consult] Consultation on Expanding the Size of the ARIN Board of Trustees Message-ID: <fbd48906-359b-44ed-9e99-b2468407b...@pch.net> Content-Type: text/plain; charset="utf-8" There have, for a long time, been a minority of ARIN board members who believe that increasing board size will somehow magically fix problems of diversity, representation, or mediocrity. And so they keep bringing it up for discussion. Again, and again, and again, without a respite between. I?ve served on many boards, including ones much smaller than ARIN?s (several boards of three people) and ones much larger (once as many as 22). I?ve found that, without exception, the larger the board, the less functional it is. At seven, ARIN?s board has always (at least in the fifteen years I sat on it) struggled with keeping all members engaged and contributing productively. It?s been rare that more than four or five members were really paying attention to the issues we needed to work on, showing up for meetings, and speaking their minds. Likewise, the ARIN board has a diversity problem, the one that led me to conclude that, as yet-another-white-guy, I could not in good faith continue to participate in the board until it represented our membership in gender and national origin. Increasing the board size does not increase diversity. In the last election, every seat which could possibly have been given to a white guy was given to a white guy. More seats doesn?t change that, it just means a bigger, even less functional, echo chamber. Really, at its base, the problem I have is with mediocrity and poor decision-making. A larger board makes those problems worse, just as a board which excludes all but one gender and race makes those problems worse. So. Don?t fall for the red-herring ?bigger board will improve diversity.? There?s no connection, it doesn?t, you can do the math yourself. Ask yourself instead, ?what problem, if any, would this solve?? I?ve asked that question each time it?s been brought up, and I?ve never received an answer. The unstated reason, that it would allow more friends of the current in-group to add another check-box item to their resumes, is never advanced. In the absence of a really good reason for doing it, the huge cost of decreased effectiveness shouldn?t be incurred. -Bill -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: Message signed with OpenPGP URL: <http://lists.arin.net/pipermail/arin-consult/attachments/20180406/2843dc87/attachment-0001.sig> ------------------------------ Message: 4 Date: Fri, 6 Apr 2018 14:40:33 -0400 From: William Herrin <b...@herrin.us> Cc: "<arin-consult@arin.net>" <arin-consult@arin.net> Subject: Re: [ARIN-consult] Consultation on Expanding the Size of the ARIN Board of Trustees Message-ID: <cap-gugxtdtscvayx-m+stbwpbgxaz7byujkip3n2bffhgln...@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" On Fri, Apr 6, 2018 at 2:14 PM, ARIN <i...@arin.net> wrote: > it is often up to the ARIN Board of Trustees to > decide whether to explore these initiatives when they are at an early stage. Mission creep. > ARIN should add three more elected voting seats to the Board of Trustees, > raising the current six (two elected per year) to nine (three elected per > year). New Board seats are to be added to the Board in a phased manner ? one > per year in the 2018 thru 2020 elections as noted below Still "no" for the same reasons expressed last year. The bigger the board, the worse the paralysis at one end and groupthink at the other. Optimal board sizes, in general, have been studied. A lot. The 7 you have is already on the high edge of optimal. If 7 people can't get it done, then either we've elected people who aren't willing to spend the time, ARIN has strayed too far from the core mission or ARIN has added too much paper-pushing overhead (too much "process") to the board's work. Regards, Bill Herrin -- William Herrin ................ her...@dirtside.com b...@herrin.us Dirtside Systems ......... Web: <http://www.dirtside.com/> ------------------------------ Message: 5 Date: Fri, 6 Apr 2018 11:49:36 -0700 From: Bill Woodcock <wo...@pch.net> To: William Herrin <b...@herrin.us> Cc: "<arin-consult@arin.net>" <arin-consult@arin.net> Subject: Re: [ARIN-consult] Consultation on Expanding the Size of the ARIN Board of Trustees Message-ID: <7c4376d8-b96d-4492-ab91-7e77df21c...@pch.net> Content-Type: text/plain; charset="us-ascii" > On Fri, Apr 6, 2018 at 2:14 PM, ARIN <i...@arin.net> wrote: >> it is often up to the ARIN Board of Trustees to >> decide whether to explore these initiatives when they are at an early stage. > > Mission creep. Yeah. And misdirection, in that this is nowhere near an early stage. A few people have been bringing this up, unremittingly, for a decade. The majority have never been in favor of it, for exactly the reasons Bill states below. On Apr 6, 2018, at 11:40 AM, William Herrin <b...@herrin.us> wrote: > Still "no" for the same reasons expressed last year. The bigger the > board, the worse the paralysis at one end and groupthink at the other. > > Optimal board sizes, in general, have been studied. A lot. The 7 you > have is already on the high edge of optimal. If 7 people can't get it > done, then either we've elected people who aren't willing to spend the > time, ARIN has strayed too far from the core mission or ARIN has added > too much paper-pushing overhead (too much "process") to the board's > work. Yep, exactly. A board of four or five would be an improvement, going from seven to ten would be a good long slide further down into mediocrity and non-functionality. -Bill -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: Message signed with OpenPGP URL: <http://lists.arin.net/pipermail/arin-consult/attachments/20180406/998be220/attachment.sig> ------------------------------ Subject: Digest Footer _______________________________________________ ARIN-consult mailing list ARIN-consult@arin.net http://lists.arin.net/mailman/listinfo/arin-consult ------------------------------ End of ARIN-consult Digest, Vol 67, Issue 4 *******************************************