Michael, On Nov 7, 2012, at 7:48 PM, Michael Sinatra <[email protected]> wrote: > On 11/07/2012 10:29, Danny McPherson wrote: > >> Sandy, Can you elaborate what your "concerns about this agreement's >> impact on the envisioned RPKI architecture and dominant use" are? Do >> you have a reference or outline we can review prior to the discussion >> in order to keep this from being a >> bash-the-RIR-and-force-them-into-submission-for-trying-to-deploy-this-stuff >> fest? > > In addition to Sandy's concerns, the agreement contains a third-party > indemnification clause (as do other ARIN RPKI-related agreements) that makes > it difficult for many state and federal government (and large EDUs) to simply > click through and sign. In most of these environments, the network engineers > who would be wanting to try out RPKI would not be permitted to agree to such > indemnification. This may also be true at large corporations. > > This, I think, has very little architectural impact, but it does mean > additional hoops for operators (like myself) to experiment with RPKI and/or > put it in production. As such, further discussion is probably out of scope > for SIDR, and I will take this to arin-discuss@ accordingly. But I did want > to give this group an FYI that this may be at least a speed-bump on the > deployment front.
I (also) commend ARIN for their due diligence on this matter. Commercial operators, in particular, should carefully evaluate the risks posed to their core business (selling Internet transit) by now being reliant on certificate information that directly affects _reachability_information_ carried within their network. That certificate information is maintained by an outside party that's outside the operator organization's _direct_ (immediate) control and for which they, seemingly, have no recourse if (when?) something goes wrong. That risk without remedies/recourse is not something commercial entities are prone to voluntarily accept. Obviously, each operator should seek advice from their own legal counsel as to the risks and make their own decisions. -shane _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
