Subject: RE: IPv4

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 3 Aug 2007 04:32:53 -0700

I don't see a cause of action a third party could bring here.

In the past digital has claimed to have used a very large fraction of their allocation. Its just behind a firewall.

Any third party claim would have to be brought against arin for not applying their rules. It is a futile threat because there is no hope of court resolution before the point becomes moot.

If I was the isp in that situation hp has something I want and many others want. There is absolutely nothing to be achieved by threatening hp and much to be lost. Even if the threat worked the party that brought the case and paid for the costs would most likely not get the allocation anyway.

Rather than lay out ten million plus on a lawsuit that is unlikely to achieve the desired result the isp is going to pay hp. The risk of losing the allocation while it still has relevance is nil.

Do not expect the courts to be as willing to step into this situation and decide it the way you think it should be decided. US judges are political appointments. Most are ideologically committed to free market arguments. 

The courts are certainly not going to step in unless the executive takes an issue. I don't see either party wanting to take the diplomatic cost that telling a chineese isp that they cannot buy ipv4 space from a us company that isn't using it would entail. There are much bigger concerns.

Sent from my GoodLink Wireless Handheld (www.good.com)

 -----Original Message-----
From: 	[email-masked] [mailto:[email-masked]]
Sent:	Friday, August 03, 2007 03:35 AM Pacific Standard Time
To:	[email-masked]
Subject:	RE: IPv4

> The only effect that threats from ARIN would have in this 
> situation is to make the situation worse. HP uses the address 
> space internally. Transition to a different address space 
> where they are behind a NAT has real costs for them. They are 
> only going to make the transition if they can recover those costs.

HP has nothing to worry about threats from ARIN. It is the threat of
lawsuits from large ISPs who have been working within the ARIN rules,
that HP should worry about. If the situation arises that ARIN cannot
supply a large ISP with the addresses that it needs, and that large ISP
suspects that HP has more addresses than they can justfy under ARIN's
policy, the the large ISP will sue HP. 

HP is in a very risky postion here if they cannot meet ARIN's
requirements for justifying their address allocation. The wise move for
HP is to audit their addresses, bring themselves into compliance with
ARIN's policies, return the surplus addresses to ARIN and sign a
Registration Services Agreement (RSA).

I suspect that the main reason why HP is in this position is that the
people who manage IPv4 addresses within HP have been flying below the
radar of senior management. In HP and many other companies around the
world, IP addressing is about to come to the attention of senior
management for the first time. I would not bet that senior management
views these issues in quite the same way as their network engineers do.

--Michael Dillon

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: <[email-masked]>
Date: Fri, 3 Aug 2007 13:54:43 +0100

> If I was the isp in that situation hp has something I want and many
others want. There is absolutely nothing to be achieved by threatening
hp and much to be lost. Even if the threat worked the party that brought
the case and paid for the costs would most likely not get the allocation
anyway.

When one company sues another, they often ask for damages. I am saying
that if, as a result of legacy holders hoarding addresses, ARIN is
unable to allocate addresses to an ISP, then the ISP could claim that
the legacy holder has damaged the ISP and sue for damages.
	
> Rather than lay out ten million plus on a lawsuit that is unlikely to
achieve the desired result the isp is going to pay hp. The risk of
losing the allocation while it still has relevance is nil.

Now you are claiming that HP will engage in extortion. Seriously, I do
not believe that senior management at HP is aware of this issue. When
they do become aware of it, I strongly doubt that they will plan to
engage in extortion. And when it comes to pricing those addresses that
HP holds, a large ISP currently pays ARIN $18,000 per year for all the
addresses that it needs.
	
> Do not expect the courts to be as willing to step into this situation
and decide it the way you think it should be decided. US judges are
political appointments. Most are ideologically committed to free market
arguments.

First of all, the courts will only get involved if a lawsuit is
initiated. When I look at all the possible players that might initiate
such a lawsuit, I think that the ISP who fails to get the needed
addresses is most likely. And when I look at all the possible parties
that might be sued, I see that the legacy address holders are in the
weakest position. In fact, HP and other legacy address holders are not
playing by the rules, and people who are committed to free market
arguments are also ususally strongly in favor of playing by the rules.
That's why Enron was not allowed to fade quietly into the sunset.

By the way, the IETF is probably the wrong venue to discuss this issue.
ICANN or ARIN would be a better place to move the discussion to.

--Michael Dillon

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 3 Aug 2007 17:29:50 +0200

> I don't see a cause of action a third party could bring here.

Agree. I'm not a lawyer, but I doubt that random IP users have  
standing for suing other random IP users.

> In the past digital has claimed to have used a very large fraction  
> of their allocation. Its just behind a firewall.
>

They used to run a big FTP server at 16.1 for a long time. There are  
several levels of use, ranging from public servers to private,  
through not-very-visible routed use to unrouted internal. Obviously  
with any type of use, it's going to be painful to move away from that  
to free up the space, but the question is how much internet-wide pain  
we're willing to accept to avoid some private pain for organizations  
having those very large address blocks.

However, by the time that the pain level is high enough that we get  
around to answering that, it's going to be too late to do much about  
it. If we really only have 3.5 years left, it's pretty much too late  
to do anything with IPv4. And if our address use keeps going up (195  
million addresses used in the past 12 months, doesn't even include  
corrections for ARIN book keeping strangeness), we'll be burning  
through 400 million addresses or so in 2010, so reclaiming ALL ~ 40  
legacy class As means little more than a year extra time. We can just  
as easily create that extra year by taking action NOW instead of next  
year.

> Rather than lay out ten million plus on a lawsuit that is unlikely  
> to achieve the desired result the isp is going to pay hp.
>

Ok, so money changes hands, and then what? ARIN obviously can't  
rubberstamp the title transfer after this week's public declaration  
against address trading, so the ISP in question will have to get the  
rest of the world to route it despite angry looks (or worse?) from  
ARIN. And forget about routing certificates, which should be deployed  
to some degree by then.

> Do not expect the courts to be as willing to step into this  
> situation and decide it the way you think it should be decided. US  
> judges are political appointments. Most are ideologically committed  
> to free market arguments.
>

I don't think many of them are willing to make a ruling that  
effectively breaks the internet.

---

From: Harald Alvestrand <[email-masked]>
Date: Wed, 08 Aug 2007 12:07:40 +0200

> ARIN. And forget about routing certificates, which should be deployed 
Routing certificates are simple. If HP "sells" (lends, leases, gifts, 
insert-favourite-transaction-type-here) address space to someone, HP 
issues a certificate (or set of certificates) saying that this is how HP 
wants the address space to be routed; the fact that the routes point to 
non-HP facilities is nothing that the route certificate verifiers can 
(or should) care about.

My $0.02.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 8 Aug 2007 16:36:54 +0200

On 8-aug-2007, at 12:07, Harald Alvestrand wrote:

> Routing certificates are simple. If HP "sells" (lends, leases,  
> gifts, insert-favourite-transaction-type-here) address space to  
> someone, HP issues a certificate (or set of certificates) saying  
> that this is how HP wants the address space to be routed; the fact  
> that the routes point to non-HP facilities is nothing that the  
> route certificate verifiers can (or should) care about.

If this is how it works, then apparently you CAN de facto own address  
space after all.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 8 Aug 2007 10:08:43 -0700

The problem as I see it is that we have spotted the iceberg and we face a choice, at this point we still have time to steer away and avoid it, instead we seem to have people attempting to legislate the iceberg out of existence.
 
People have traded IPv4 address blocks as assets with a financial value for some time. There is plenty of bankruptcy and divorce law precedent to establish this. 
 
My concern with respect to certificates is that at the current time certificates are not used in BGP. If anyone tries to use the introduction of certificates to establish a power that the stakeholders do not recognize as valid the result will be to stall deployment. 
 
The system becomes directly analogous to the value proposition of SDMI to the manufacturers of MP3 players: 'deploy our security technology so that we can re-establish control that we have lost'. 

________________________________

From: Iljitsch van Beijnum [mailto:[email-masked]]

---

From: Stephen Kent <[email-masked]>
Date: Wed, 8 Aug 2007 13:25:13 -0400

At 4:36 PM +0200 8/8/07, Iljitsch van Beijnum wrote:
>If this is how it works, then apparently you CAN de facto own 
>address space after all.
>

The RIRs are working to enable clean transfer of address space 
holdings, using X.509 certs. While one could do what what Harald 
suggested, the new address space holder would have to worry about HP 
revoking the cert it issued to effect the transfer. A "cleaner" model 
would call for HP to effect the transfer through a registry, so that 
HP is no longer in the cert path.

Steve

---

From: Bill Manning <[email-masked]>
Date: Thu, 9 Aug 2007 06:35:19 -0700

> HP is no longer in the cert path.

	and they would then not have to worry about the RIR revoking the cert?

--bill

-- 
--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: Stephen Kent <[email-masked]>
Date: Thu, 9 Aug 2007 10:49:20 -0400

At 6:35 AM -0700 8/9/07, Bill Manning wrote:
>...

The RIRs are recognized as neutral, primary address space allocators 
who have contractual relationships with the folks to whom they 
allocate addresses. I think it might be more attractive to the new 
holder of address space to have a relationship with an RIR vs. the 
former address space holder, a company that might be acquired by 
another company, change business orientation, declare bankruptcy, ...

Steve

---

From: Bill Manning <[email-masked]>
Date: Thu, 9 Aug 2007 09:03:20 -0700

> another company, change business orientation, declare bankruptcy, ...

	"...are recognsied..."  - by whom?
	"... I think..."	- may not be a shared point of view.

	One might assume that when GE issues certs for subnets of its
	address space, that a contractual relationship would exist.

	And I am pretty sure that GE has been around for quite a few years 
	longer than all the RIR's combined.

	RIR's are legal entities, just like other companies... and are subject
	to the same problems that companies have, e.g. aquired, changed 
	orientation, bankruptcy... etc.  They are NOT special.

-- 
--bill

---

From: Stephen Kent <[email-masked]>
Date: Thu, 9 Aug 2007 12:59:38 -0400

>	"... I think..."	- may not be a shared point of view.

On the IETF list many messages represent points of view that are not 
widely shared :-).

>	address space, that a contractual relationship would exist.

I agree that a legal agreement with a large company (e.g., GE or HP) 
might be just as good a guarantee as an analogous agreement with an 
RIR.

>	longer than all the RIR's combined.

It has, but it has been in and out of various business areas as the 
CEO and Board have decided what is and is not a good place to make 
money as times change.

>	orientation, bankruptcy... etc.  They are NOT special.

I disagree with your suggestion that the RIRs are not special. They 
are recognized as being "special" by ICANN.

I will not pursue a rat hole  discussion on whether ICANN is "special" :-).

Steve

---

From: Bill Manning <[email-masked]>
Date: Thu, 9 Aug 2007 11:40:42 -0700

> I will not pursue a rat hole  discussion on whether ICANN is "special" :-).

	ICANN is also a legal entity, with the same vulnerabilities
	as all other companies including RIR's... which was my point.  
	"Special" is reserved for governments... :)

--bill

---

From: Stephen Kent <[email-masked]>
Date: Thu, 9 Aug 2007 16:35:02 -0400

At 11:40 AM -0700 8/9/07, Bill Manning wrote:
>O...

The U.S. Dept. of Commerce recognizes ICANN exclusively (via an MoU) 
with regard to certain Internet functions, so maybe that makes ICANN 
"special," once removed :-).

---

From: Bill Manning <[email-masked]>
Date: Thu, 9 Aug 2007 14:35:01 -0700

> "special," once removed :-).

are you asserting DoC will step in to save ICANN from bad business choices/practices?
that ICANN will not be allowed to fail?  I'd be willing to believe the functions
will be protected, but not specific institutions.  

--bill

---

From: David Kessens <[email-masked]>
Date: Thu, 9 Aug 2007 15:12:43 -0700

Stephen,

> "special," once removed :-).

For many other governments and companies anywhere in the world, a
large shareholder owned company is way more neutral than an entity
that is special in the way you just described.

David Kessens
---

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 10 Aug 2007 16:14:30 +0900

> 	as all other companies including RIR's... which was my point.  

So are CAs of PKIs, which is why PKIs are merely weakly secure.

> 	"Special" is reserved for governments... :)

How do you think about the goverment of Iraq? Even USG is not very
special.

						Masataka Ohta