BGP Security and PKI Hierarchies

Michael Dillon said:

The fees are not charged for past services that were
received for free, only for future services.

So you are saying that legacy space holder who signed a memberhsip
agreement would not owe the usual yearly fee associated with their
legacy space holdings but only those fees associated with any
future address space allocations/assignments? I imagine that would
please the legacy space holders.

Do you know that this would be the case? I'm not a registry
canon law expert myself.

--Sandy

Michael Dillon said:

>The fees are not charged for past services that were
>received for free, only for future services.

So you are saying that legacy space holder who signed a memberhsip
agreement would not owe the usual yearly fee associated with their
legacy space holdings but only those fees associated with any
future address space allocations/assignments? I imagine that would
please the legacy space holders.

Do you know that this would be the case? I'm not a registry
canon law expert myself.

  i believe Michael is extrapolating his ideal and
  not the actual practice at RIRs.

--bill

>The fees are not charged for past services that were
>received for free, only for future services.

So you are saying that legacy space holder who signed a memberhsip
agreement would not owe the usual yearly fee associated with their
legacy space holdings but only those fees associated with any
future address space allocations/assignments?

Of course they would pay the normal membership fee.
In ARIN, this fee is roughly related to the size of the
address space holding, but only roughly. It is a flat
fee for the annual membership subscription and it covers
all the whois listings, changes to whois entries,
in-addr.arpa hosting, ip6.arpa hosting, and new address
allocations for the whole year.

The fee is not directly related to the address holding,
i.e. ARIN members do not pay a fee for the addresses
which are allocated to them. The subscription fee is
higher for larger allocations because larger organizations
use more services more often. The holder of a class C only
pays $1250 per year which seems a reasonable business
expense for supporting the RIRs. And the holder of a
class B would pay only $9,000 and a class A holder would
pay the maximum rate of $18,000.

It's hard to imagine an organization who can afford to run
a network using BGP to announce a class C block and not
be able to afford $1250 per year.

--Michael Dillon

Sounds like a failure of imagination to me.

> >The fees are not charged for past services that were
> >received for free, only for future services.

   i believe Michael is extrapolating his ideal and
   not the actual practice at RIRs.

Not at all. Past services are anything that was received
for free in the past. Future services are anything that
is received as a normal paid member of ARIN. The ARIN
membership fee is determined by the size of the address
allocation that was received in the past, but it is not
a payment for past services.

Why is this so hard for people to understand?

If I received a copy of Windows 3.1 for free then I
can use it forever without paying. But if I want
to get a copy of Windows XP, then I must pay the
normal fee for Windows XP. Microsoft will not charge
me an additional fee over and above the normal fee
that everyone else pays for XP.

Many people registered .com domain names for free.
Then one day, there was an annual fee. However,
nobody was charged an annual fee for the PAST YEARS
in which they had had free use of their .com domain
name. The level of the playing field was raised, but
it remained a level playing field.

--Michael Dillon

The statement Michael forgot was "using PI space" -
lots of "Bob's bait & tackle shop" types of operations
use BGP to announce a /24 to two providers. I have
yet to find an organization which is concerned about
getting new PI space which would have a problem paying
that amount per year. They may exist, but they're
certainly not the majority of the groups looking for
PI IP.

David Barak
Need Geek Rock? Try The Franchise:
http://www.listentothefranchise.com

They definitely exist.

Joe

> I have
> yet to find an organization which is concerned

about

> getting new PI space which would have a problem

paying

> that amount per year. They may exist,

They definitely exist.

Okay, I'll take your word for it - although given the
other costs implied in an organization which has
sufficiently robust connectivity to make PA space
problematic, I'm a bit surprised.

Perhaps these are non-profits? Even then, I would
expect that $1200 per year is still much lower than
the circuit costs...

Maybe my imagination just isn't good enough: could you
toss me an example-type of organization where that
would be problematic?

David Barak
Need Geek Rock? Try The Franchise:
http://www.listentothefranchise.com

Oh, my mistake -- you're talking about new organisations looking to acquire PI space. I was talking about organisations who have grandfathered (and hence zero-fee) PI space.

I don't have any examples of the former, and I tend to agree with your assessment for that.

Joe

The Internet != for-profit-only corporate netspace.

US$1250 may be little more than a urinal mint for businesses, but $1250 can
be a steep yearly fee to tack on to nonprofits that are already paying for
connectivity, equipment maintenance (of typically outdated equipment), and
likely other services from their upstream(s).

And since multihoming is the New Internet Insurance Policy[tm]....

> It's hard to imagine an organization who can afford to run
> a network using BGP to announce a class C block and not
> be able to afford $1250 per year.

The Internet != for-profit-only corporate netspace.

In that case, the organization is not an ISP which
means that they are not growing which means that they
don't need as much of ARIN's services, therefore they
can swap their class C block for an ARIN /24 and only
pay $100 as an end user. Presumably ARIN could be convinced
to waive the one-time initial allocation fee in this case
since the initial allocation happened years ago.

Then, having joined the club that 99% of us belong to,
they won't have any problems with using newer services
like BGP cert signing.

--Michael Dillon

The problem is *because* they are not ISP and don't have a clue
they'll use a lot of ARINs services. "Why doesn't this work,
how do I do that..." RIPE started requiring the x-ncc-regid
thing in email partly because of the newbie and clueless crowd.

After reading this thread well after it has ended...why does it seem that a lot of folks equate "trust" with "paying money?"

Trust isn't about who can pay what but maintaining a system that conveys trust does *cost* money.

The RIRs are not-for-profit themselves. That doesn't mean service-for-no-fee. I don't see that an RIR has any obligation to speak on behalf of (in this case, issue certificates for) any other organization that holds IP space and has not established any arrangement with the RIR. On the other hand, any such organization cannot expect an RIR to do something for them for free.

If the ISP industry wants there to be certificates for the so-called swamp space (badly enough), what would stop them from subsidizing the the work?