They portray themselves as offering accurate IP ranges, when what 
they've got amounts to some guess-work.  They don't really have any way 
to catch errors like the Choopa.net example Tom Keays gave, or the 
consortium sub-range in mine.  Unless, of course, the way they catch 
those is to rely on people from the institutions to eventually log in 
and correct those for them.

I'm going to go ahead and update my institutions ranges with them 
anyway, because I think I have to.  But I'm not going to like them for 
it.

Will

On 2020-12-04 16:49, Tom Keays wrote:
> A couple of years ago, when I was reviewing the IP set up for Scitation 
> for
> my institution, I noticed it included an unfamiliar IP range,
> 216.155.128.000 - 216.155.128.063. This was not the first time I had
> encountered this range (although I don't have a record of what the 
> previous
> vendors were where I found it). After spending some time investigating, 
> I
> determined that it belonged to an internet hosting company called
> Choopa.net. Definitely a bogus listing for us.
> 
> Anyway, when I first set up my account at The IP Registry, they also 
> listed
> this range. When I told them about it and asked them how they got it 
> and
> explained that it should never have been there in their records, they
> replied, "This IP range was supplied to us by a number of publishers 
> who
> are using it to provide access."
> 
> I don't really know how this range got listed as being valid for my
> institution. Was it there because individual social engineered 
> somebody's
> support team in order to get free access to online resources? I have to
> assume so. I also don't know if The IP Registry got it from the 
> e-resource
> vendors and accepted it without question or the vendors got it from 
> them,
> again without question. Either way, it made me worry about trusting 
> them
> too far.
> 
> Tom
> 
> On Fri, Dec 4, 2020 at 2:33 PM Jeremiah Kellogg <[log in to unmask]> 
> wrote:
> 
>> Yikes, this does sound like we're being forced into a service whether 
>> we
>> want to use it or not.  At our institution we're the default owner of 
>> a
>> range of IPs we manage on behalf of a public library consortium that 
>> we're
>> not actually a part of (so the consortium shouldn't be accessing our
>> databases).  The IP registry had grabbed that range of IPs and 
>> included
>> them in our profile, but had them pending verification from our 
>> institution
>> that we actually owned them before making them available to 
>> publishers.  I
>> ended up editing that range to exclude the consortium IPs, and then no
>> longer had to verify the remaining range of IPs that were correct.  
>> Now
>> that I really think about this, had I not made those edits, our proxy
>> server would have been excluded and we would have faced a situation 
>> where
>> our students, faculty and staff were denied access to the services 
>> they
>> should be able to access.  So we would have faced the opposite problem 
>> that
>> you experienced, Will, where people would be denied access rather than
>> given access they shouldn't have.  Either way, the only apparent way 
>> these
>> problems can be fixed is by signing up with the IP registry and 
>> updating
>> things ourselves... and that's kind of underhanded.  I'm not sure I'd 
>> worry
>> too much about the legalities because it appears vendors, unlike our
>> institutions, participate willingly, and if they're willing to take 
>> the
>> ipregistry's word that our IP ranges are accurate that's on them.  
>> It's
>> just really frustrating to think that we'd face these kinds of 
>> problems due
>> to an outside entity getting things wrong on our behalf, and the only 
>> way
>> to fix them is by signing up with them and making corrections.
>> 
>> I don't think I mind them selling our improved IP data to vendors 
>> because
>> that's the kind of thing most free services need to do to pay the 
>> bills
>> these days. I might be putting the work into it, but it's not so much 
>> that
>> I feel like I'm putting more in than I'm getting out of it.  However, 
>> as
>> you point out, Will, there doesn't appear to be a mechanism for opting 
>> out
>> of their system, and that really stinks.  I haven't dug too deep, but 
>> I
>> wonder if there's a way of setting things up with vendors who use that
>> service to stop using it when we make such a request?  I think I'm 
>> pretty
>> much on the same page as you, Will.  It's a great idea for a service, 
>> but
>> being forced into it will understandably leave a bad taste in people's
>> mouths, and it also casts a bit of shadow on the service's integrity.  
>> I
>> get that participation is important for this kind of thing, but I 
>> suspect
>> there are better ways of getting people onboard!
>> 
>> On Thu, Dec 3, 2020 at 6:02 PM Will Martin <[log in to unmask]> 
>> wrote:
>> 
>> > I am concerned by the fact that the IP Registry appears to have gone
>> > around figuring out the IP ranges for schools based on public records
>> > from the IANA and a bunch of vendor records.  I'm sure that was
>> > difficult, and their site says it took four years.  When it was done,
>> > they announced that 58% of IP ranges were wrong, and began selling the
>> > service to vendors and telling them what our IP addresses are based on
>> > their analysis.
>> >
>> > I claimed the account for my institution and discovered that there were
>> > 26 vendors already pulling my university's IP ranges from the IP
>> > Registry.  Unfortunately, the IP ranges were wrong.  To name a few
>> > problems:
>> >
>> > 1) They conflated us with another school in the same university system.
>> >
>> > 2) They could not know that there are a couple of IP ranges that we
>> > prefer to be treated as "off campus" even though they belong to the
>> > University.
>> >
>> > 3) They had no way to know that one particular range of our IPs is
>> > assigned to a library consortium in our state, and used for proxy
>> > servers that serve the other institutions in the university system plus
>> > several dozen public libraries.
>> >
>> > The third point is critical.  By distributing these erroneous IP ranges
>> > on my school's behalf, without permission, the IP registry has
>> > effectively granted access to 26 of our subscriptions to basically
>> > everyone in my state.  We are thus in violation of our license
>> > agreements and will be at risk of legal action by the publishers until I
>> > can sort this mess out.
>> >
>> > Because this involves multiple institutions -- my own, the broader
>> > university system, the aforementioned library consortium -- I am going
>> > to have to contact and explain the situation to a lot of people, and
>> > spend a lot of time checking and re-checking IP ranges, all in service
>> > of updating the IP Registry's records.
>> >
>> > Then they get to turn around and charge the publishers for my work.
>> >
>> > But frankly, their business model feels like extortion to me. We have to
>> > verify their records, or there's a chance that our resources will be
>> > accessible to people who should not have access because their analysis
>> > was incorrect.  They appear to have engineered a situation that puts my
>> > institution in potential legal jeopardy, which we can only get out of by
>> > improving the data that the IP Registry is selling for a profit.
>> >
>> > I am not happy with them.  The basic idea -- a centralized repository of
>> > IP ranges for bulk updating publisher records -- is both sound and
>> > useful.  But their business model leaves a bad taste in my mouth.  If I
>> > could, I would opt out of the system.  But they do not appear to have
>> > made a mechanism available to do so.
>> >
>> > Will Martin
>> >
>> > Head of Digital Initiatives, Systems and Services
>> > Chester Fritz Library
>> > University of North Dakota
>> >
>> 
>> 
>> --
>> Jeremiah Kellogg
>> Systems Librarian
>> Pierce Library
>> Eastern Oregon University
>> [log in to unmask]
>> (541) 962-3017
>>