Send ARIN-consult mailing list submissions to
arin-consult@arin.net
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.arin.net/mailman/listinfo/arin-consult
or, via email, send a message with subject or body 'help' to
arin-consult-requ...@arin.net
You can reach the person managing the list at
arin-consult-ow...@arin.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ARIN-consult digest..."
Today's Topics:
1. Re: Consultation on ACSP 2018.3 (Jimmy Hess)
2. Consultation on Expanding the Size of the ARIN Board of
Trustees (ARIN)
3. Re: Consultation on Expanding the Size of the ARIN Board of
Trustees (Bill Woodcock)
4. Re: Consultation on Expanding the Size of the ARIN Board of
Trustees (William Herrin)
5. Re: Consultation on Expanding the Size of the ARIN Board of
Trustees (Bill Woodcock)
----------------------------------------------------------------------
Message: 1
Date: Tue, 3 Apr 2018 04:31:01 -0500
From: Jimmy Hess <mysi...@gmail.com>
To: ARIN <i...@arin.net>
Cc: arin-consult@arin.net
Subject: Re: [ARIN-consult] Consultation on ACSP 2018.3
Message-ID:
<caaawwbwlvvbntbumre0udqcn6267su5zqbnpd68o5n1xmzh...@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
On Wed, Mar 28, 2018 at 4:16 PM, ARIN <i...@arin.net> wrote:
> Question: If ARIN redirects http to https requests, should ARIN then
> use HSTS for web-based Whois queries?
-ARIN should send HSTS headers If and Only If: ALL web-based traffic to
that hostname used with HTTP are mandated to be over HTTPS.
-HSTS headers should not be sent for whois.arin.net if Non-HTTPS whois
queries are allowed.
-Non-HTTPs Whois queries should be allowed,
and Non-HTTPs should be the default for simple queries of WHOIS information.
Rationale:
The WHOIS database is public information, and the use of HTTPS creates
potential access issues or impairments for some browsers, and requires
additional resources related to the CPU cost of encryption and
Certificate Revokation checks.
> Question: Should ARIN automatically redirect user Whois queries made
> via "http" to "https"?
Should not redirect. The WHOIS protocol itself does not provide secrecy.
The web WHOIS query interface is an alternative interface to the WHOIS data...;
Furthermore, there is not a reasonable expectation of privacy regarding what
users lookup in WHOIS --- heavy WHOIS users ought to be monitored
carefully and be subject to the possibility of public reporting and transprency
on their individual usage querying the public service by their IP and/or lookup
history or patterns, as there is a high potential for abusive
activities such as
automated data mining or harvesting e-mail address contacts to spam.
So long as the WHOIS protocol itself continues to be supported -- it
seems pretty unreasonable to force HTTP users to access the data over TLS
while not allowing visitors the option to access WHOIS over plain HTTP
when the WHOIS over WHOIS continues to be allowed and is equal to plain HTTP.
The forced redirect would surely cause some WHOIS queries to fail, as
some users will eventually be running browsers that cannot reach agreement
with ARIN's https servers over a secure protocol version and/or ciphers.
The WHOIS database is supplying information listed as publicly available,
and there is no expectation of privacy within the contents of the public
information --
It could be very useful for ARIN to provide digitally signed WHOIS listings
to confirm their authenticity, and ensure WHOIS data is not tampered with
on storage medium or before/during transit;
However, the HTTPS protocol is not capable of fully providing this
level of assurance.
For operating on public WHOIS data it is more suitable to provide
digitally signed query
responses, and a verifiable digital signature for each record.
API requests capable of modifying records ought to be required to be
digitally signed
requests by an authorized user (HTTPS / TLS does not provide this)
----
> Question: If ARIN redirects http to https requests, should ARIN then
> use HSTS for web-based Whois queries?
>
> The feedback you provide during this consultation will help inform how
> ARIN will proceed in response to ACSP 2018.3. All messages that have
> been sent to the arin-consult mailing lists in response to this
> suggestion prior to the opening of this consultation will be included in
> our feedback collection resulting from this consultation. Thank you for
> your participation in the ARIN Consultation and Suggestion Process.
>
> Please provide comments to arin-consult@arin.net.
>
> Discussion on arin-consult@arin.net will close on 30 April 2018. If you
> have any questions, please contact us at i...@arin.net.
>
> Regards,
>
> John Curran
> President and CEO
> American Registry for Internet Numbers (ARIN)
>
>
>
> _______________________________________________
> ARIN-Consult
> You are receiving this message because you are subscribed to the ARIN
> Consult Mailing
> List (ARIN-consult@arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN
> Member Services
> Help Desk at i...@arin.net if you experience any issues.
--
-JH
------------------------------
Message: 2
Date: Fri, 6 Apr 2018 14:14:31 -0400
From: ARIN <i...@arin.net>
To: arin-consult@arin.net
Subject: [ARIN-consult] Consultation on Expanding the Size of the ARIN
Board of Trustees
Message-ID: <3b14c137-01cf-dca5-5da6-3adb752ee...@arin.net>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
In May 2017, the ARIN Board of Trustees proposed expansion of the size
of the Board of Trustees in order to increase opportunities for
diversity in the background of Board members, including geographical and
gender representation. This proposal was the topic of an energetic
community consultation with mixed outcome indicating both support and
concerns with such a change. The ARIN Board considered the outcome of
the consultation, but ultimately the measure did not achieve the
four-fifths approval threshold necessary for changing ARIN's Bylaws.
In February of this year, the ARIN Board discussed an additional issue
related to the present size of the Board: specifically, the challenge
that a smaller Board poses when engaging in strategic discussions, for
example in regard to long-term direction or relationships with other
Internet organizations. While many of these topics are discussed with
the community prior to decision (e.g. formation of the NRO, support for
the IANA Stewardship Transition), it is often up to the ARIN Board of
Trustees to decide whether to explore these initiatives when they are at
an early stage. There is a very wide diversity of the Internet ecosystem
that can be affected by ARIN's strategic direction and this includes
Internet service providers of all sizes and types (transit, access,
etc.), Internet online and content industries, data center and cloud
operators, educational and government networks, commercial firms, and
civil society. While the Trustees elected by the community often have a
broad knowledge of the Internet ecosystem, seven Trustees is a
relatively small group to evaluate impacts across the entire Internet
ecosystem.
As a result of this discussion, the ARIN Board agreed to initiate a new
community consultation to expand the number of elected Board members
from six to nine, in order to allow for wider representation of the
Internet community during Board discussions.
*Board proposal:*
ARIN should add three more elected voting seats to the Board of
Trustees, raising the current six (two elected per year) to nine (three
elected per year). New Board seats are to be added to the Board in a
phased manner ? one per year in the 2018 thru 2020 elections as noted below
* October 2018: 3 Board members will be elected for 2019; 8 Trustee
board (9 if the appointed seat is used)
* October 2019: 3 Board members will be elected for 2020; 9 Trustee
board (10 if the appointed seat is used)
* October 2020: 3 Board members will be elected for 2021; 10
Trustee board (11 if the appointed seat is used)
We are seeking community feedback on this proposed change to the size of
the ARIN Board of Trustees. This consultation will remain open for at
least 30 days.
Please provide comments to arin-consult@arin.net.
Discussion on arin-consult@arin.net will close on 14 May 2018.
If you have any questions, please contact us at i...@arin.net.
Regards,
John Curran
President and CEO
American Registry for Internet Numbers (ARIN)
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.arin.net/pipermail/arin-consult/attachments/20180406/ede5f909/attachment-0001.html>
------------------------------
Message: 3
Date: Fri, 6 Apr 2018 11:40:14 -0700
From: Bill Woodcock <wo...@pch.net>
To: arin-consult@arin.net
Subject: Re: [ARIN-consult] Consultation on Expanding the Size of the
ARIN Board of Trustees
Message-ID: <fbd48906-359b-44ed-9e99-b2468407b...@pch.net>
Content-Type: text/plain; charset="utf-8"
There have, for a long time, been a minority of ARIN board members who believe
that increasing board size will somehow magically fix problems of diversity,
representation, or mediocrity. And so they keep bringing it up for discussion.
Again, and again, and again, without a respite between.
I?ve served on many boards, including ones much smaller than ARIN?s (several
boards of three people) and ones much larger (once as many as 22). I?ve found
that, without exception, the larger the board, the less functional it is. At
seven, ARIN?s board has always (at least in the fifteen years I sat on it)
struggled with keeping all members engaged and contributing productively. It?s
been rare that more than four or five members were really paying attention to
the issues we needed to work on, showing up for meetings, and speaking their
minds.
Likewise, the ARIN board has a diversity problem, the one that led me to
conclude that, as yet-another-white-guy, I could not in good faith continue to
participate in the board until it represented our membership in gender and
national origin. Increasing the board size does not increase diversity. In
the last election, every seat which could possibly have been given to a white
guy was given to a white guy. More seats doesn?t change that, it just means a
bigger, even less functional, echo chamber.
Really, at its base, the problem I have is with mediocrity and poor
decision-making. A larger board makes those problems worse, just as a board
which excludes all but one gender and race makes those problems worse.
So. Don?t fall for the red-herring ?bigger board will improve diversity.?
There?s no connection, it doesn?t, you can do the math yourself.
Ask yourself instead, ?what problem, if any, would this solve?? I?ve asked
that question each time it?s been brought up, and I?ve never received an answer.
The unstated reason, that it would allow more friends of the current in-group
to add another check-box item to their resumes, is never advanced.
In the absence of a really good reason for doing it, the huge cost of decreased
effectiveness shouldn?t be incurred.
-Bill
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL:
<http://lists.arin.net/pipermail/arin-consult/attachments/20180406/2843dc87/attachment-0001.sig>
------------------------------
Message: 4
Date: Fri, 6 Apr 2018 14:40:33 -0400
From: William Herrin <b...@herrin.us>
Cc: "<arin-consult@arin.net>" <arin-consult@arin.net>
Subject: Re: [ARIN-consult] Consultation on Expanding the Size of the
ARIN Board of Trustees
Message-ID:
<cap-gugxtdtscvayx-m+stbwpbgxaz7byujkip3n2bffhgln...@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
On Fri, Apr 6, 2018 at 2:14 PM, ARIN <i...@arin.net> wrote:
> it is often up to the ARIN Board of Trustees to
> decide whether to explore these initiatives when they are at an early stage.
Mission creep.
> ARIN should add three more elected voting seats to the Board of Trustees,
> raising the current six (two elected per year) to nine (three elected per
> year). New Board seats are to be added to the Board in a phased manner ? one
> per year in the 2018 thru 2020 elections as noted below
Still "no" for the same reasons expressed last year. The bigger the
board, the worse the paralysis at one end and groupthink at the other.
Optimal board sizes, in general, have been studied. A lot. The 7 you
have is already on the high edge of optimal. If 7 people can't get it
done, then either we've elected people who aren't willing to spend the
time, ARIN has strayed too far from the core mission or ARIN has added
too much paper-pushing overhead (too much "process") to the board's
work.
Regards,
Bill Herrin
--
William Herrin ................ her...@dirtside.com b...@herrin.us
Dirtside Systems ......... Web: <http://www.dirtside.com/>
------------------------------
Message: 5
Date: Fri, 6 Apr 2018 11:49:36 -0700
From: Bill Woodcock <wo...@pch.net>
To: William Herrin <b...@herrin.us>
Cc: "<arin-consult@arin.net>" <arin-consult@arin.net>
Subject: Re: [ARIN-consult] Consultation on Expanding the Size of the
ARIN Board of Trustees
Message-ID: <7c4376d8-b96d-4492-ab91-7e77df21c...@pch.net>
Content-Type: text/plain; charset="us-ascii"
> On Fri, Apr 6, 2018 at 2:14 PM, ARIN <i...@arin.net> wrote:
>> it is often up to the ARIN Board of Trustees to
>> decide whether to explore these initiatives when they are at an early stage.
>
> Mission creep.
Yeah. And misdirection, in that this is nowhere near an early stage. A few
people have been bringing this up, unremittingly, for a decade. The majority
have never been in favor of it, for exactly the reasons Bill states below.
On Apr 6, 2018, at 11:40 AM, William Herrin <b...@herrin.us> wrote:
> Still "no" for the same reasons expressed last year. The bigger the
> board, the worse the paralysis at one end and groupthink at the other.
>
> Optimal board sizes, in general, have been studied. A lot. The 7 you
> have is already on the high edge of optimal. If 7 people can't get it
> done, then either we've elected people who aren't willing to spend the
> time, ARIN has strayed too far from the core mission or ARIN has added
> too much paper-pushing overhead (too much "process") to the board's
> work.
Yep, exactly. A board of four or five would be an improvement, going from
seven to ten would be a good long slide further down into mediocrity and
non-functionality.
-Bill
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL:
<http://lists.arin.net/pipermail/arin-consult/attachments/20180406/998be220/attachment.sig>
------------------------------
Subject: Digest Footer
_______________________________________________
ARIN-consult mailing list
ARIN-consult@arin.net
http://lists.arin.net/mailman/listinfo/arin-consult
------------------------------
End of ARIN-consult Digest, Vol 67, Issue 4
*******************************************
