RIPE Down or DOSed ?

Thu Feb 27 20:38:45 UTC 2003

On 2/27/2003 at 1:44 PM, william+nanog at hq.dreamhost.com (Will Yardley) wrote:

> There is no public access to rwhois.level3.net (it worked at one point,
> but, accurding to Level3, not intentionally). They say that they don't
> have to make this information available to anyone except ARIN. I was
> always under the impression that delegations had to be publicly visible,
> but looking at ARIN's policy more closely, it seems that the information
> only has to be available to ARIN.

Secrecy over a public resource = no oversight = facilitator of abuse.

It has worked as long as I can remember, and them intentionally
shutting it off is completely against letter and spirit of
ARIN's allocation policy: rwhois, or SWIP delegations, but not
"none of the above". 7018 Realized this for 12.0.0.0/8 at some
point.

Why do I get the distinct feeling that this "move" by Level3 is
aimed not at creating greater customer privacy (it never served
POC email addresses), or protecting themselves from getting their
customer base poached by other providers, but at preventing
people from identifying spamming Level3 customers (of which they
seem to have 100's) by organization name and being able to
correlate activity from different netblocks of theirs.

So instead of select prefixes, most longer than /24 appearing in
the various DNSBLs that do manual listing "by organization"
(Spamhaus SBL, SPEWS, Wirehub), Level3 customers can now look
forward to /24 to /17 knock-outs that should absolutely positive
cover the hiding criminal scum they so willingly receive money
from. And then some. If you are a Level3 customer using Level3
IP space, you might want to expediously insist that your IP space
delegation appears at whois.arin.net properly, or else consider
a new network provider or buying yourself your own /16 on the
grey market^W^W^W^Wacquire a defunct company with a mostly
unused /16.

What did Randy once say?
"I welcome my competitors running their networks this way"....
(paraphrased)