Re: Whois using these ARIN services?? (fwd: Consultation on the Future of ARIN’s Directory Servic es)

On 2026-08-14 16:20, John Curran via NANOG wrote:
> NANOGers -
> 
> ARIN is undertaking a community consultation on the Future of ARIN’s
> Directory Services.  If you are interested in this topic, please see
> details below, including how to join the ARIN-consult mailing list.
> 
> Thanks!
> /John
> 
> John Curran
> President and CEO
> American Registry for Internet Numbers
> 
> Begin forwarded message:
> 
> From: ARIN <[email protected]>
> Subject: [ARIN-consult] Consultation on the Future of ARIN’s Directory 
> Services
> Date: August 14, 2026 at 11:16:12 AM EDT
> To: <[email protected]>
> 
> ARIN is seeking feedback from the community on a proposed road map to
> streamline and consolidate its directory services.
> 
> ARIN currently maintains four directory information protocols:
> Whois-RWS, RWhois, Whois (Port 43), and RDAP. Supporting multiple
> redundant services that provide the same information creates
> additional administrative and operational overhead to the
> organization. To reduce ARIN’s attack surface, streamline operations
> and lower future operational overhead, ARIN proposes retiring use of
> older protocols in favor of RDAP as our single, standardized directory
> service.

What excessive attack surface is there to operating whois? Yes, it is an 
additional service, but whois, in some form, has been around since 
forever and I am most certain that after so many years, there are well 
hardened whois servers available.
> 
> This transition is an important step toward improving alignment with
> established IETF standards.

Which rfc calls for the decommissioning of whois? If there is one, I 
have not heard about it yet.

> 
> We have already seen this transition in the domain industry with ICANN
> mandating the use of RDAP for directory services and dropping the
> requirement to support Whois. We also expect RDAP clients to become
> increasingly common in OS distributions in the coming years.

The reason why we have redundant services that provides the same 
information is for backwards compatibility. "[T]o become increasingly 
common in OS distributions in the coming years" does not inspire 
confidence. Right now, a whois client comes packaged and installed in 
every major distro. On a fresh install of fedora 44, I can run ``whois 
1.2.3.4`` and it would just work, contra rdap, which requires an 
additional package (perl-rdapper) to be installed. Going back a bit, 
Fedora 42 has no packaged rdap client, unless you trust copr or snap. 
Fedora 42 only came to EOL this year.

These types of breaking changes must not be made until rdap obtains the 
same level of support that whois does.

> 
> ------
> Benefits of Transition to RDAP 
> 
> - Enhanced Directory Services: Future enhancements, such as
> geolocation, will only be implemented in RDAP. 
> - Standardization and Automation: RDAP’s standardized data structure
> will improve automation for clients and provide greater flexibility in
> managing future data changes. 

Great! That's amazing! However, maintaining rdap and whois 
simultaneously are not mutually exclusive.

> - Reduced Technical Overhead: Removing old and redundant services will
> provide time and cost savings for ARIN. 

What are the expected time and cost savings, and how do they stack up 
against the time and cost of everyone who currently uses whois to 
transition to rdap within the timeframe proposed?

> 
> ------
> Timeline and Retirement Planning
> 
> This consultation seeks community input for the proposed retirement
> timelines below. We are keenly interested in receiving specific input
> on any barriers and/or obstacles these changes may create for
> customers, as well as steps ARIN can take to ensure a smooth
> transition. Note that the retirement plans for each impacted directory
> service will be completed independently, though in some cases work may
> be conducted concurrently.
> 
> ***
> Whois-RWS Retirement Plan and Timeline
> 
> ARIN currently offers Whois-RWS in two formats: an API and a web
> interface (located at https://whois.arin.net/ui/). Because the API has
> the same functionality between Whois-RWS and RDAP, ARIN proposes
> sunsetting the Whois-RWS API following a 180-day customer outreach
> program. This will include updating the Whois-RWS payloads to include
> a notification to users, as well as a robust communication
> strategy that includes announcements, social promotion, and other
> outreach.
> 
> The Whois-RWS web interface will remain available until work is
> completed to ensure parity, providing equivalent query capabilities to
> RDAP. The changeover from Whois-RWS to RDAP will be transparent to end
> users visiting that URL. ARIN will inform the community a minimum of
> 30 days before the retirement of the Whois-RWS web interface, noting
> the switch to RDAP will not change the end user experience.
> 
> ***
> RWhois Retirement Plan and Timeline
> 
> When RWhois server use is retired, we will provide organizations with
> a recommendation for an open-source RDAP server implementation. To
> help ease the transition and migration of data, ARIN plans to provide
> a conversion tool for populating that recommended RDAP server with
> existing RWhois data. When the tool is publicly available, ARIN
> proposes a 365-day sunsetting timeline for RWhois. This will allow for
> robust communication and direct outreach to organizations who use
> RWhois and plan to either convert to the RDAP client or discontinue
> their use of local clients and report their reassignment information
> directly to ARIN instead.
> 
> ***
> Whois (Port 43) Retirement Plan and Timeline
> 
> ARIN understands that Whois (Port 43) carries a high volume of queries
> and will require the longest timeline to retire. We propose a two-year
> sunsetting window, during which ARIN will engage in active outreach to
> users. This will include updates to Whois (Port 43) results during the
> sunsetting period that will contain information about the retirement
> deadline.
> 
> Because Whois (Port 43) has been the historically preferred method of
> querying Internet number resource registration data, it remains
> heavily used by cybersecurity professionals, researchers, law
> enforcement, and many other types of organizations. ARIN will seek to
> engage beyond our community to raise awareness of the planned
> retirement date for Whois (Port 43).
> 
> ------
> After the retirement of the directory service protocols described
> above and listed below, ARIN will only support RDAP as our single,
> standardized directory service.
> 
> - Whois-RWS: on or after 1 July 2027
> - RWhois: dependent on migration tool release date, but no sooner than
> 1 January 2028
> - Whois (Port 43): on or after 1 January 2029
> 
> Throughout the sunsetting process for all services, ARIN will engage
> with our community to ensure customers and users are well-informed
> about the retirement of the described services and ARIN’s transition
> to RDAP as its standard directory service.

With all due respect, ARIN is an internet registry. ARIN is not some 
tech company that must be at the forefront of innovation, moving fast 
and breaking things.
> 
> We look forward to your feedback on the proposed timelines for
> retirement for Whois-RWS, RWhois, and Whois (Port 43). We ask that you
> consider each service independently, with the understanding that each
> of these services may impact your organization differently.

Hard no on two years for Whois as there is insufficient Rdap support at 
this time.

No comment on Whois-RWS and RWhois.

> 
> Please provide comments to [email protected]. You can subscribe to
> this mailing list at
> https://lists.arin.net/mailman/listinfo/arin-consult.
> 
> This consultation will remain open until 5:00 PM ET on 14 September
> 2026. ARIN seeks clear direction through community input, so your
> feedback is important.
> 
> Thank you for your continued support in improving ARIN’s services.
> 
> Regards,
> 
> John Curran
> President and CEO
> ARIN
> 
> ------
> Relevant links:
> - Presentation from ARIN 56:
> https://www.arin.net/participate/meetings/ARIN56/materials/arin56_directoryservices.pdf
> - IETF Standard for RDAP: https://www.rfc-editor.org/info/std95
> - Guide to RDAP Client Implementations:
> https://rdap.rcode3.com/client_implementations/index.html
> - ARIN RDAP Documentation: 
> https://www.arin.net/resources/registry/whois/rdap/
> _______________________________________________
> ARIN-Consult
> _______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/[email protected]/message/VPMTFPBUX5YC6NLFMFNTWFZCDZF5X47O/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/LTYDQCW6HHMETMNBWDS37A3RPKIHUTKW/