The Notes of Lu Heng
Who gave the Internet’s recordkeepers the power to govern it? These Notes follow that question from everyday analogies to a different design for the network.
All Notes
Follow a question, find a particular Note, or read how the argument develops.
76 Notes found · Page 6 / 7
Why can a fake email threaten a business, and what does that say about the registry?
Recently, many RIPE NCC members received an email titled “Download Review,” demanding confirmation of information within 48 hours. The email did not come from RIPE NCC. It was a phishing attempt, exploiting fear—specifically, fear of RIPE NCC’s perceived authority.
Why are the owners of IPv4 absent from the rooms that decide its rules?
IPv4 is the Internet’s most important service enabler. A device or cloud server cannot be online without an IPv4 address. Yet IPv4 is priced as if it were negligible. At roughly $0.30 per month per IP, it enables services worth around $300 per month per server—about 0.1% of the value it makes possible. In any other market, critical enablers capture a meaningful share of the revenue they enable: city-center rent is often ~30% of a shop’s revenue because location is the enabler. By that logic, IPv4’s upper valuation potential is vastly higher than today’s.
Why is an address that enables a $300 server priced at cents?
IPv4 addresses remain one of the most undervalued assets in the global digital economy. Their suppressed valuation is not accidental; it is structural. And that suppression directly translates into suppressed valuations for ISPs and infrastructure businesses worldwide.
What changes when uniqueness is guaranteed by an algorithm instead of an institution?
Today, the Internet’s most fundamental layer—IP address registration—remains centralised in the hands of five private Regional Internet Registries. Each holds a fragment of the global registration database, operates under a single national jurisdiction, and collectively costs hundreds of millions of dollars annually to maintain a system that is, in technical terms, trivial: a registration database measured in hundreds of megabytes. This structure introduces bureaucracy, inefficiency, geopolitical risk, and single points of failure into what has become critical global infrastructure.
How much of a registry’s budget serves its actual mandate?
The cost of running RIPE NCC has become a recurring controversy, and for good reason. To assess it properly, we must start from first principles: what a Regional Internet Registry actually does, and what it is supposed to do.
What does open participation cost, and who is left outside the room?
As APRICOT 2024 concludes, a few points stand out. It was valuable to engage directly with the community on issues shaping the global Internet, and the AGM marked a necessary turning point for APNIC after more than two decades of concentrated control.
Who pays for hundreds of millions in registry budgets, and what do they get for it?
Regional Internet Registries collectively employ hundreds of staff worldwide and operate with annual budgets in the hundreds of millions of dollars, all funded by mandatory membership fees. This funding model exists because RIRs hold a de-facto monopoly over the registration of number resources. The question is whether this scale of expenditure is justified by their actual function.
What did the 2023 APNIC disclosures reveal, and why is incremental reform not enough?
Ahead of the 2023 APNIC elections, I raised serious concerns about its governance. At the time, those concerns were dismissed, and I was publicly attacked by a small but well-connected group with vested interests. Subsequent disclosures proved those warnings correct: APNIC was, in effect, under the legal control of a single individual. For two decades, its sole owner, director, and shareholder held structural power over the Internet for the Asia-Pacific region through a private company arrangement. That concentration of control was dangerous and fundamentally incompatible with the role APNIC claims to serve.
Why do state or treaty-based replacements for the registries fail, and what works instead?
As IPv4 exhaustion rendered the original allocation role of Regional Internet Registries obsolete, a recurring question emerged: should RIRs continue to exist, and if so, in what form? Various alternatives have been proposed—state control, intergovernmental bodies, or treaty-based institutions modeled after organizations like the IAEA. All of these proposals share the same flaw: they attempt to solve a simple technical problem by adding political and bureaucratic complexity.
What do companies actually own after spending billions on IPv4 addresses?
IPv4 addresses are widely treated as assets, traded for billions of dollars by cloud giants and telecom operators. Amazon alone has acquired close to one hundred million IPv4 addresses. Alibaba, Tencent, Huawei, and others have spent hundreds of millions, if not billions, doing the same. Yet there is a detail most boards and CFOs miss: none of those companies actually o
Why must a network have the unconditional right to move its addresses to another registry?
The revision of ICP-2 presents an opportunity to fix a structural weakness in Internet governance: the lack of guaranteed portability of number resources. Portability means that a network must have the unconditional right to move its IP addresses or ASNs from one Regional Internet Registry to another. This should not be optional, conditional, or discretionary; it must be a hard requirement embedded in ICP-2. Without portability, networks are effectively locked into the RIR they first registered with and are forced to bear the consequences of that RIR’s governance failures or operational breakdowns. That dependency creates systemic risk for the Internet itself.
What would it take to move core identifiers out of institutions that predate today’s technology?
The Internet today still relies on legacy structures that allocate and register critical identifiers—names and numbers—through centralised institutions that predate modern decentralised technology. These institutions, known as Regional Internet Registries, were created when the network was small and technical collaboration was informal. As the Internet matured into a global utility, the centralised control of identifiers became a structural vulnerability: a choke point susceptible to power capture, opaque governance and political pressure.