January 2017 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Language on List
by Jeffrey Race 03 Feb '17

03 Feb '17

On Tue, 31 Jan 2017 11:08:44 +0200, ox wrote: >then again, I may be very wrong - so help me out :) The universal rule of ladies and gentlemen is to avoid giving offense. So one does not discuss or use references (unless in a professional context e.g. doctor) to excretion or sexual behavior. One avoids any negative references to other persons and to political or religious beliefs. Those are good practices for this list. So excluding crap and merde which are offensive words. Re: "generalised swearing. It's a part of modern language" -- that's a culture-specific interpretation. Such behavior doesn't occur in most of the world and it never occurred when I was growing up in 1950s America; then I went abroad for 45 years and coming back to America smutty language is indeed widespread. It's not 'modern': it's a degenerate phenomenon of certain cultures. It's unknown in much of the world. It's repugnant to refined sensibilities. Behaving this way doesn't betoken one's "modernity" -- it betoken's one's personal coarseness. Jeffrey Race

5 7

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 62, Issue 33
by Marilson 01 Feb '17

01 Feb '17

Ho capito, ma non comprendo. Anyway, thanks for the amount of information you sent me off list. But why we exchange information off list ??? Marilson Never so few done so much harm to so many. ------------------------------------------------------------------------------------------- From: HRH Prince Sven Olaf von CyberBunker Sent: Tuesday, January 31, 2017 7:57 PM To: Marilson ; anti-abuse-wg(a)ripe.net Cc: andre(a)ox.co.za Subject: Re: anti-abuse-wg Digest, Vol 62, Issue 33 the revenue on 'spam' is -nothing-. as the magical 'spammer that can pay the invoices you send him' does not exist. it's probably because it's cheaper to just pay hotmail or yahoo, which actually sell spamming their own platforms as a service, than to obtain one single server with us. lolol. the last serious spammer i talked to could not even cough up 60k eur. now, although i'm sure there are many naive sales people out there that fall for the 'we would like 200 servers but we want to try them for free for a week first' trick, but ours generally don't go for that. lol. lemme see. that's 200 servers, times 13500 euros list price to buy, devided by 2 months times 1.50 times profit margin (yes, they pay for the hardware, times 1.5 -every two months-, what country was it again? you wanted to be billed from our .nl front op? 21% VAT.. ok tsjing tsjing... and the spammer goes 'no thanks i'd rather just get google adwords'. capiche? On 31 ينا, 2017 م 09:43, Marilson wrote: We will update the number of emails practiced these days: Source: Cisco http://www.senderbase.org/static/spam/#tab=0 AVERAGE DAILY VOLUME (BILLIONS) – Last Month Spam 473.62 85.56% Legitimate 79.85 14.43% Malware 0.0557 0.0101% 473 billion spam PER DAY in last Month. 172 trillions per year. Mamma mia! It's a lot, but a lot of money! It is clear, clear as crystal, because some ISPs refuse to cancel the contract even knowing that his customer is a felon with convictions in court, proven swindler, known scammer... And several times retaliate because they do not support complaints. Could anyone tell me what the revenue is for hosting and sending 172 trillions of spam per year? Do not be shy, nobody will call you greedy. Marilson Never so few done so much harm to so many. --------------------------------------------------------------------------------------------------------------------- From: anti-abuse-wg-request(a)ripe.net Sent: Tuesday, January 31, 2017 11:24 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 62, Issue 33 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. RBL Discussion Update (Brian Nisbet) 2. Re: anti-abuse-wg Digest, Vol 62, Issue 28 (Marilson) ---------------------------------------------------------------------- Message: 1 Date: Tue, 31 Jan 2017 12:40:00 +0000 From: Brian Nisbet mailto:brian.nisbet@heanet.ie To: mailto:'anti-abuse-wg(a)ripe.net' mailto:anti-abuse-wg@ripe.net Subject: [anti-abuse-wg] RBL Discussion Update Message-ID: mailto:b78a58a0-0de9-53a4-4015-caa906337625@heanet.ie Content-Type: text/plain; charset=utf-8 Ok folks... The RBL Policy discussion is interesting, but we've gone wildly off track and it has become focused, unfortunately, on one provider. I'm not going to tell anyone what to think of Spamhaus, but this conversation is not the right place to go on specifically about them. I think the relevant opinions have been aired and nobody is going to be convinced one way or the other. If there is more discussion of general RBL Policy and whether bans should be longer/shorter/whatever or the other points Andre raised, great. If you aren't talking about this, please don't post it here. There are lots of other lists and forums and things on the Internet where you can post away. Thanks, Brian -- Brian Nisbet, Network Operations Manager HEAnet CLG, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/ ------------------------------ Message: 2 Date: Tue, 31 Jan 2017 11:23:55 -0200 From: "Marilson" mailto:marilson.mapa@gmail.com To: mailto:anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 62, Issue 28 Message-ID: <E24B39EFAF6A483BAE7C62E711605258@xPC> Content-Type: text/plain; charset="iso-8859-1" Yesterday, Andre wrote: > In 2015, the number of emails sent and received per day total over 205 billion... Andre is underestimating the size of the problem and Olaf, the prince of spam, the demolisher, the man who almost broke the internet, pretends to be unaware: During 2010, about 107 trillion emails were sent around the world. Of that total, 89.1% were spam - this corresponds to an average of 262 billion unwanted messages per day, according to data from Royal Pingdom consultancy, which monitors web traffic. 293 billion emails being 262 billion spam, in 2010. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, January 30, 2017 2:21 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 62, Issue 28 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Fwd: Re: RBL policy (HRH Prince Sven Olaf von CyberBunker) 2. Re: Fwd: Re: RBL policy (ox) 3. Re: Fwd: Re: RBL policy (ox) 4. Re: Fwd: Re: RBL policy (HRH Prince Sven Olaf von CyberBunker) ---------------------------------------------------------------------- Message: 1 Date: Mon, 30 Jan 2017 13:19:32 +0000 From: HRH Prince Sven Olaf von CyberBunker mailto:svenk@xs4all.nl To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: mailto:8099bc26-b01b-84e1-2b2e-f5e773ee22f9@xs4all.nl Content-Type: text/plain; charset=UTF-8; format=flowed as for smtp being alive.. out of 4 billion ips some 200k run an smtp server... still a lot more than ftp (including badly configured printers and security cameras).. but considering it's a protocol that was supposed to run on each and every workstation. it's dead. facebook has more users per second than smtp has mails per year. lol. On 30 ???, 2017 ? 01:13, ox wrote: > On Mon, 30 Jan 2017 13:01:46 +0000 > HRH Prince Sven Olaf von CyberBunker mailto:svenk@xs4all.nl wrote: >> no not all dnsbls are a problem. none of the other ones block >> non-directly related prefixes as a means of extortion into complete >> breach of contract. there are some 110 of them last time we checked. >> we only were on the 2 operated by spamhaus. :P >> so by far... pretty much all dnsbl's list the ips that originate the >> 'undesired' traffic, which stops it from >> reaching those that use their service, and that's where it ends for >> them... that's perfectly acceptable. >> (as long as it's the actual end user making the decision to use their >> 'filtering' or not) >> > Okay, got it, thank you for that > >> howeverrrrr... then there is spamhaus... >> > yeah, but it will show good manners if you make a new thread about > that? > >> as for the ripe mailinglist being smtp... yes. it unfortunately still >> is.. and it's about the ONLY thing that still needs smtp, next to >> signing up to habbo hotel. lol. i haven't started the mail client for >> anything else in years. lol. face it: smtp is dead, the reason it is >> dead: is spamhaus itself. making it unreliable. mainly. >> > we will have to agree to disagree (or not agree - with the same > result :) ) > > smtp - 2017 my pov (and own stats) There has never been so much legit > traffic sent ever... > > Easy to check though as everyone on here has their own stats and to > quickly analize 25 vs say 80 (wow - and 443 is just as crazy in terms of > growth as 25!) in 2015 as compared to 2016 - smtp is alive and kicking > (so is 443!) > > Andre > ------------------------------ Message: 2 Date: Mon, 30 Jan 2017 15:37:32 +0200 From: ox mailto:andre@ox.co.za To: HRH Prince Sven Olaf von CyberBunker mailto:svenk@xs4all.nl Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: mailto:mailman.5202.1485793288.1952.anti-abuse-wg@ripe.net Content-Type: text/plain; charset=UTF-8 On Mon, 30 Jan 2017 13:19:32 +0000 HRH Prince Sven Olaf von CyberBunker mailto:svenk@xs4all.nl wrote: > as for smtp being alive.. out of 4 billion ips some 200k run an smtp > server... still a lot more than ftp (including badly configured > printers and security cameras).. but considering it's a protocol that > was supposed to run on each and every workstation. it's dead. > > facebook has more users per second than smtp has mails per year. lol. > https://zephoria.com/top-15-valuable-facebook-statistics/ statistics, facts (after they happened) are so crazy, lol In 2015, the number of emails sent and received per day total over 205 billion... in 2016 email/smtp = +8% lol and 2017 - looks to be even more hectic. - smtp maybe closer to 300 billion (per day) or 109 Trillion emails per year...lol by 2020 we may be at 1000 trillion emails... how many users does facebook have per day. lol > > On 30 ???, 2017 ? 01:13, ox wrote: > > On Mon, 30 Jan 2017 13:01:46 +0000 > > HRH Prince Sven Olaf von CyberBunker mailto:svenk@xs4all.nl wrote: > >> no not all dnsbls are a problem. none of the other ones block > >> non-directly related prefixes as a means of extortion into complete > >> breach of contract. there are some 110 of them last time we > >> checked. we only were on the 2 operated by spamhaus. :P > >> so by far... pretty much all dnsbl's list the ips that originate > >> the 'undesired' traffic, which stops it from > >> reaching those that use their service, and that's where it ends for > >> them... that's perfectly acceptable. > >> (as long as it's the actual end user making the decision to use > >> their 'filtering' or not) > >> > > Okay, got it, thank you for that > > > >> howeverrrrr... then there is spamhaus... > >> > > yeah, but it will show good manners if you make a new thread about > > that? > > > >> as for the ripe mailinglist being smtp... yes. it unfortunately > >> still is.. and it's about the ONLY thing that still needs smtp, > >> next to signing up to habbo hotel. lol. i haven't started the mail > >> client for anything else in years. lol. face it: smtp is dead, the > >> reason it is dead: is spamhaus itself. making it unreliable. > >> mainly. > >> > > we will have to agree to disagree (or not agree - with the same > > result :) ) > > > > smtp - 2017 my pov (and own stats) There has never been so much > > legit traffic sent ever... > > > > Easy to check though as everyone on here has their own stats and to > > quickly analize 25 vs say 80 (wow - and 443 is just as crazy in > > terms of growth as 25!) in 2015 as compared to 2016 - smtp is > > alive and kicking (so is 443!) > > > > Andre > > > > ------------------------------ Message: 3 Date: Mon, 30 Jan 2017 16:36:48 +0200 From: ox mailto:andre@ox.co.za To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: mailto:mailman.5203.1485793288.1952.anti-abuse-wg@ripe.net Content-Type: text/plain; charset=US-ASCII On Mon, 30 Jan 2017 14:25:01 +0000 HRH Prince Sven Olaf von CyberBunker mailto:svenk@xs4all.nl wrote: > although i can't see how you managed to obtain statistics on the > number of emails being sent each day... unless spamhaus would like to > admit that they also spy on dns requests to their dnsbl... which <snip> Okay, we can just agree to disagree - or simply just disagree is also good. lol May I please solicit some comments about Abuse Block lists (Without detracting from RFC 5782 and RFC 6471 or : https://www.ripe.net/publications/docs/ripe-409 ) Considering that DNSBL tech is "MOSTLY" "reactive" (after he abuse) - although - there are - some - DNSBL (apparently Spamhaus? etc etc) that apparently block before anything happens (thank you for pointing this out Simon) The block time policies of RBLs - Not specifically anyone blocklist in particular - just the general policies) *********************************** Among the reactive and pre emptive DNSBL, there are two main types of block lists: No automatic removal and automatic removal Is the policy to auto de-list after a period of time, still accurate? or should block lists not auto de list at all any longer? If still auto de-list - Considering the change in abuse patterns and technology, should the block times be increased or de-creased? Then; Ignoring pre-emptive - predictive (in advance for no reason) blocking: Does society require more specialist non auto de-list DNSBLs? (Would it be helpful to civil society, law enforcement etc to have a "child pornography" dnsbl? or a phish dnsbl? - or is the reactive time to high in order for dynamic ipv4? - but on ipv6 allocations to devices could be more 'permanent'? etc) Andre ------------------------------ Message: 4 Date: Mon, 30 Jan 2017 13:21:54 +0000 From: HRH Prince Sven Olaf von CyberBunker mailto:svenk@xs4all.nl To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: mailto:840945de-6bb5-c7f3-a7e7-231ea0117f23@xs4all.nl Content-Type: text/plain; charset="utf-8"; Format="flowed" smtp is just one of many protocols out there, a primitive, fairly unimportant and severely lacking in terms of security one at that, and it's protection cannot be a reason for any disconnection -ever-. On 30 ???, 2017 ? 01:17, HRH Prince Sven Olaf von CyberBunker wrote: > > and now it's time for everyone here, to stop giving stevieboy his way > with his absurd definitions of 'abuse'... if there is no law against > it in the country in which the customer recides. its no reason for > disconnection. doing so is not delivering a paid service, caving into > blackmail, and undermining provider immunity by caving in to any > random idiot that just so happens to have gained influence over mail > delivery, and frequently abuses said (advertised) influence to commit > computer sabotage (he knows what the impacts of his listings are, he > advertises with it), to extort the internet industry into wasting > valuable manhours on him and his self-declared 'delisting procedure', > and breach valuable contracts. > > if he mentions any ip address (or worse: personal details) in his > crappy slander and blackmail system he calls 'spamhaus' just call the > feds on him. the guardia civil for example as he currently is in spain. > > viola 13 > > puerta d' andratx. > > under no circumstance should 'spamhaus' be allowed to dictate which > customers to serve and which not. simple as that. > > > now act PROFESSIONAL and stop giving this idiot his way just because > he mentions 'spam'. as if 'spam' > > is the worst thing that ever happened to the internet... how about him > trying to get entire isps disconnected. who gives a shit about him and > his 'spam'. > > > > > On 30 ???, 2017 ? 01:09, HRH Prince Sven Olaf von CyberBunker wrote: >> >> one would almost go and set up a few 1000 smtp servers, all sending >> steve linford viagra offers, just to annoy the guy back. operational >> costs would go through the roof tho lol. >> >> >> On 30 ???, 2017 ? 01:04, HRH Prince Sven Olaf von CyberBunker wrote: >>> >>> btw. this is europe. not america. we can say fuck however many times >>> we want over here. tyvm. and in the case of spamhaus, it's fully >>> applicable. spamhaus IS a cancer. that was using this mailinglist >>> just a few hours ago to try to further the reach of their cancerous >>> censorship tool disguised as a 'spam fighter' >>> >>> >>> On 30 ???, 2017 ? 01:03, HRH Prince Sven Olaf von CyberBunker wrote: >>>> >>>> if the fully appropriate language used is the only thing you can >>>> think of as an argument, that shows it's completely right. lol. >>>> you're free to google 'cb3rob' and see what steve linford told the >>>> 'world press' about our operations in the past. so far for >>>> inappropriate language. >>>> >>>> >>>> >>>> On 30 ???, 2017 ? 12:58, Tobias Knecht wrote: >>>>> Hello, >>>>> >>>>> @Sven Olaf: >>>>> Please stop using this type of offensive language! >>>>> This is a public mailinglist and not a place for you to rant and >>>>> attack in the way you are at the moment. >>>>> >>>>> So step back for a minute, take a deep breath and calm down! >>>>> >>>>> And if you feel you can send a message without using this type of >>>>> language, feel free to do so, otherwise stay away! >>>>> >>>>> If you have any questions, feel free to reach out to me directly. >>>>> >>>>> Thanks, >>>>> >>>>> Tobias >>>>> >>>>> -- >>>>> ?RIPE Anti Abuse Working Group Co-Chair >>>>> >>>>> >>>>> ? >>>>> >>>>> On Mon, Jan 30, 2017 at 1:46 PM, HRH Prince Sven Olaf von >>>>> CyberBunker <svenk(a)xs4all.nl mailto:svenk@xs4all.nl> wrote: >>>>> >>>>> btw it would be of great assistance in this matter if transit >>>>> carriers, simply, only HAD asn's and no ip prefixes that can >>>>> be used as a blackmailing vector. don't quite see why everyone >>>>> combines the 'isp' part with the 'transit providing' part of >>>>> their operations. parties that provide transit, have no need >>>>> for ip space (bgp sessions are better on 10.0.0.0/8 >>>>> <http://10.0.0.0/8> anyway, prevents attack from 'outside'). >>>>> if there are no ip's there is nothing idiots like spamhaus (so >>>>> far they are the only ones) can 'blacklist' to 'build up >>>>> pressure' to breach contracts. so just split up those operations. >>>>> >>>>> >>>>> On 30 ???, 2017 ? 12:32, HRH Prince Sven Olaf von CyberBunker >>>>> wrote: >>>>>> >>>>>> customer wants to send packets from ip A to ip b... did they >>>>>> arrive? -> yes. we did our job. no -> we did not do our job. >>>>>> i can't quite see why we would even need to know what 'smtp' >>>>>> is. nor any of the other obscure shit protocols out there. >>>>>> >>>>>> >>>>>> On 30 ???, 2017 ? 12:30, HRH Prince Sven Olaf von CyberBunker >>>>>> wrote: >>>>>>> >>>>>>> content. is NEVER. network-related-abuse. >>>>>>> >>>>>>> 'making more use of a mail protocol that in every other way >>>>>>> is used as intended' is also not 'network-related-abuse' in >>>>>>> fact it's not abuse at all. it's like tv advertisements. >>>>>>> >>>>>>> 'malware and virusses' all simply exploit the same old >>>>>>> services 'provided' by crappy windows malware, which should >>>>>>> get some import restrictions, and the problem is solved ay. >>>>>>> it's windows itself that is the malware there... >>>>>>> >>>>>>> 'phishing'... so you're saying your bank login procedure >>>>>>> sucks balls and/or you think 16 numbers on the front and 3 >>>>>>> top secret ones on the back of a plastic card people show in >>>>>>> every restaurant they go to are 'security' - go fix your own >>>>>>> crap and stop bothering us, we forward -packets-. we don't >>>>>>> have time to hunt ghosts for your broken financial services. >>>>>>> >>>>>>> 'announcing the whole god damn internet split up into >>>>>>> /24s'.. - yes .. that's 'abuse'. lol. >>>>>>> >>>>>>> and either way... if someone doesn't like what someone else >>>>>>> is doing they can take them to the -appropriate- courts (of >>>>>>> the other party) and try to get them to stop... blackmailing >>>>>>> the sales department of the transit carriers of their >>>>>>> supplier of their supplier of their supplier, will only make >>>>>>> them change isps, cause financial loss (or gains: setup >>>>>>> fees), etc. >>>>>>> >>>>>>> so far all spamhaus has ever established is: >>>>>>> >>>>>>> - a whole lot of unroutable/unsellable/unusable ipv4 >>>>>>> 'burned' ranges. >>>>>>> >>>>>>> - smtp is no longer peer to peer (their bashing on open relays) >>>>>>> >>>>>>> - smtp is no longer real time (graylisting) >>>>>>> >>>>>>> - smtp is no longer reliable (with over 20 million ip >>>>>>> addresses listed despite there only being 300k mailservers >>>>>>> in the world, no wonder!) >>>>>>> >>>>>>> so instead of stopping spam, they managed to kill of smtp. >>>>>>> congratulations. >>>>>>> >>>>>>> everyone now uses skype and facebook (which are real-time >>>>>>> and do have friends-lists) lolol. you have succeeded in >>>>>>> bringing microsoft and facebook users to spy on. well done. >>>>>>> >>>>>>> if smtp is 'getting less' that is only because it has no >>>>>>> users left. people only start it up to read ripe >>>>>>> mailinglists (lol) or sign up for habbo hotel. FACT. lol. >>>>>>> >>>>>>> none of our customers has ever sent UCE from our networks... >>>>>>> because... ever since 2004... we have simply blocked port >>>>>>> 25... smtp only causes -shit- and it -delivers shit- >>>>>>> (abusemail and 'legal' threats about shit that is not our >>>>>>> problem). we sure as hell have some customers that cause >>>>>>> 'shit' but they usually do it in somewhat more profitable >>>>>>> markets than sending 'spam' and most definately can buy a tv >>>>>>> station or 2 to do their advertisements on. tyvm spamhaus. lol. >>>>>>> >>>>>>> where this 'mytical' spammer that can pay our 1000-1500 >>>>>>> euros per month per server would come from, i don't know, i >>>>>>> certainly have never met any... i tried to invoice one 60k >>>>>>> once and he backed off already. poor spammers. they're like >>>>>>> child porn people. can't pay for anything, so not an urgent >>>>>>> issue at all. >>>>>>> >>>>>>> our customers frequently have the entire fucking cia rolling >>>>>>> over their doorstep and if it's not them its the god damn >>>>>>> copyright mafia. slightly different budgetarial picture >>>>>>> there. shit that -is- worth the trouble. >>>>>>> >>>>>>> now, please take your shitty nagging about 'abuse' of your >>>>>>> crappy silly old smtp protocol, which doesn't even >>>>>>> -originate- from our networks in the first fucking place, >>>>>>> and stick it where the sun doesn't shine... as for >>>>>>> malware... windows is the malware there... it facilitates >>>>>>> all the programs residing on top of the same old 1990s badly >>>>>>> implemented os/2 ripoff crap. so basically call mickeysoft >>>>>>> and ask them to fix the bugs they all exploit, or call the >>>>>>> european commission and impose trade bans against microsoft. >>>>>>> simple enough. >>>>>>> >>>>>>> >>>>>>> On 30 ???, 2017 ? 12:13, HRH Prince Sven Olaf von >>>>>>> CyberBunker wrote: >>>>>>>> >>>>>>>> advertising the sale of : viagra, sex slaves, ak47s, porn >>>>>>>> of any kind, human trafficing services, specific animals, >>>>>>>> cocain, data obtained through espionage, encryption >>>>>>>> technology, vpns, gay propaganda, military propaganda, etc >>>>>>>> is subject to applicable local law (if any, and if there is >>>>>>>> none, it's perfectly fine)... not 'spamhaus policies' as >>>>>>>> spamhaus is not supposed to be 'the internet government'. >>>>>>>> even if they think they should be. >>>>>>>> >>>>>>>> if the uk wants to keep certain products from entering >>>>>>>> 'their' territory (and in doing so limit the freedom of >>>>>>>> their own stakeholders/tax payers) that is up to them >>>>>>>> others choose not to work against their own >>>>>>>> stakeholders/tax payers that way. they have a customs >>>>>>>> department to keep said products outside. can't tell others >>>>>>>> not to produce or sell or advertise it. setting up dirty >>>>>>>> front operations like 'spamhaus' to lure naive nerds into >>>>>>>> the illusion that they would be 'fighting spam' is a very >>>>>>>> nasty thing to do. geo-political wise and business wise. >>>>>>>> >>>>>>>> now... in thailand porn is illegal... so... let's >>>>>>>> disconnect all porn sites because thailand wants us to, oh >>>>>>>> but wait, thailand doesn't have a 'spamhaus' thinking they >>>>>>>> rule the entire internet through means of blackmail and >>>>>>>> calling people 'spammers' or 'spam supporters'. >>>>>>>> >>>>>>>> what also works, besides blackmailing with committing >>>>>>>> computer sabotage against the sales department of suppliers >>>>>>>> of suppliers of suppliers of the publisher of a website, >>>>>>>> are: assassins, commandos, carpet bombing, agent orange. >>>>>>>> etc... all of which should be deployed against spamhaus if >>>>>>>> you ask me. :P but a nullroute would suffice. lol. after >>>>>>>> all bgp is an 'advisory' to 'voluntary peers' and 'we don't >>>>>>>> block anything' as they themselves always say. >>>>>>>> >>>>>>>> >>>>>>>> On 30 ???, 2017 ? 11:29, Esa Laitinen wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> On Mon, Jan 30, 2017 at 12:19 PM HRH Prince Sven Olaf von >>>>>>>>> CyberBunker <svenk(a)xs4all.nl mailto:svenk@xs4all.nl> wrote: >>>>>>>>> >>>>>>>>> also it's quite vague that when some mossadis rent >>>>>>>>> servers and run an espionage botnet on it (which we >>>>>>>>> happily intercept ourselves ofcourse) - spamhaus >>>>>>>>> somehow magically never lists -that-.. just >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Looking at the amusing rant of Sven Olaf, it seems that >>>>>>>>> the listing works! >>>>>>>>> >>>>>>>>> Keep up the good work, spamhaus et al! >>>>>>>>> >>>>>>>>> esa >>>>>>>> >>>>>>> >>>>>> >>>>> >>>>> >>>> >>> >> >

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 62, Issue 33
by Marilson 31 Jan '17

31 Jan '17

We will update the number of emails practiced these days: Source: Cisco http://www.senderbase.org/static/spam/#tab=0 AVERAGE DAILY VOLUME (BILLIONS) – Last Month Spam 473.62 85.56% Legitimate 79.85 14.43% Malware 0.0557 0.0101% 473 billion spam PER DAY in last Month. 172 trillions per year. Mamma mia! It's a lot, but a lot of money! It is clear, clear as crystal, because some ISPs refuse to cancel the contract even knowing that his customer is a felon with convictions in court, proven swindler, known scammer... And several times retaliate because they do not support complaints. Could anyone tell me what the revenue is for hosting and sending 172 trillions of spam per year? Do not be shy, nobody will call you greedy. Marilson Never so few done so much harm to so many. --------------------------------------------------------------------------------------------------------------------- From: anti-abuse-wg-request(a)ripe.net Sent: Tuesday, January 31, 2017 11:24 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 62, Issue 33 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. RBL Discussion Update (Brian Nisbet) 2. Re: anti-abuse-wg Digest, Vol 62, Issue 28 (Marilson) ---------------------------------------------------------------------- Message: 1 Date: Tue, 31 Jan 2017 12:40:00 +0000 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "'anti-abuse-wg(a)ripe.net'" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] RBL Discussion Update Message-ID: <b78a58a0-0de9-53a4-4015-caa906337625(a)heanet.ie> Content-Type: text/plain; charset=utf-8 Ok folks... The RBL Policy discussion is interesting, but we've gone wildly off track and it has become focused, unfortunately, on one provider. I'm not going to tell anyone what to think of Spamhaus, but this conversation is not the right place to go on specifically about them. I think the relevant opinions have been aired and nobody is going to be convinced one way or the other. If there is more discussion of general RBL Policy and whether bans should be longer/shorter/whatever or the other points Andre raised, great. If you aren't talking about this, please don't post it here. There are lots of other lists and forums and things on the Internet where you can post away. Thanks, Brian -- Brian Nisbet, Network Operations Manager HEAnet CLG, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/ ------------------------------ Message: 2 Date: Tue, 31 Jan 2017 11:23:55 -0200 From: "Marilson" <marilson.mapa(a)gmail.com> To: <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 62, Issue 28 Message-ID: <E24B39EFAF6A483BAE7C62E711605258@xPC> Content-Type: text/plain; charset="iso-8859-1" Yesterday, Andre wrote: > In 2015, the number of emails sent and received per day total over 205 billion... Andre is underestimating the size of the problem and Olaf, the prince of spam, the demolisher, the man who almost broke the internet, pretends to be unaware: During 2010, about 107 trillion emails were sent around the world. Of that total, 89.1% were spam - this corresponds to an average of 262 billion unwanted messages per day, according to data from Royal Pingdom consultancy, which monitors web traffic. 293 billion emails being 262 billion spam, in 2010. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, January 30, 2017 2:21 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 62, Issue 28 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Fwd: Re: RBL policy (HRH Prince Sven Olaf von CyberBunker) 2. Re: Fwd: Re: RBL policy (ox) 3. Re: Fwd: Re: RBL policy (ox) 4. Re: Fwd: Re: RBL policy (HRH Prince Sven Olaf von CyberBunker) ---------------------------------------------------------------------- Message: 1 Date: Mon, 30 Jan 2017 13:19:32 +0000 From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <8099bc26-b01b-84e1-2b2e-f5e773ee22f9(a)xs4all.nl> Content-Type: text/plain; charset=UTF-8; format=flowed as for smtp being alive.. out of 4 billion ips some 200k run an smtp server... still a lot more than ftp (including badly configured printers and security cameras).. but considering it's a protocol that was supposed to run on each and every workstation. it's dead. facebook has more users per second than smtp has mails per year. lol. On 30 ???, 2017 ? 01:13, ox wrote: > On Mon, 30 Jan 2017 13:01:46 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> no not all dnsbls are a problem. none of the other ones block >> non-directly related prefixes as a means of extortion into complete >> breach of contract. there are some 110 of them last time we checked. >> we only were on the 2 operated by spamhaus. :P >> so by far... pretty much all dnsbl's list the ips that originate the >> 'undesired' traffic, which stops it from >> reaching those that use their service, and that's where it ends for >> them... that's perfectly acceptable. >> (as long as it's the actual end user making the decision to use their >> 'filtering' or not) >> > Okay, got it, thank you for that > >> howeverrrrr... then there is spamhaus... >> > yeah, but it will show good manners if you make a new thread about > that? > >> as for the ripe mailinglist being smtp... yes. it unfortunately still >> is.. and it's about the ONLY thing that still needs smtp, next to >> signing up to habbo hotel. lol. i haven't started the mail client for >> anything else in years. lol. face it: smtp is dead, the reason it is >> dead: is spamhaus itself. making it unreliable. mainly. >> > we will have to agree to disagree (or not agree - with the same > result :) ) > > smtp - 2017 my pov (and own stats) There has never been so much legit > traffic sent ever... > > Easy to check though as everyone on here has their own stats and to > quickly analize 25 vs say 80 (wow - and 443 is just as crazy in terms of > growth as 25!) in 2015 as compared to 2016 - smtp is alive and kicking > (so is 443!) > > Andre > ------------------------------ Message: 2 Date: Mon, 30 Jan 2017 15:37:32 +0200 From: ox <andre(a)ox.co.za> To: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <mailman.5202.1485793288.1952.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=UTF-8 On Mon, 30 Jan 2017 13:19:32 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > as for smtp being alive.. out of 4 billion ips some 200k run an smtp > server... still a lot more than ftp (including badly configured > printers and security cameras).. but considering it's a protocol that > was supposed to run on each and every workstation. it's dead. > > facebook has more users per second than smtp has mails per year. lol. > https://zephoria.com/top-15-valuable-facebook-statistics/ statistics, facts (after they happened) are so crazy, lol In 2015, the number of emails sent and received per day total over 205 billion... in 2016 email/smtp = +8% lol and 2017 - looks to be even more hectic. - smtp maybe closer to 300 billion (per day) or 109 Trillion emails per year...lol by 2020 we may be at 1000 trillion emails... how many users does facebook have per day. lol > > On 30 ???, 2017 ? 01:13, ox wrote: > > On Mon, 30 Jan 2017 13:01:46 +0000 > > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > >> no not all dnsbls are a problem. none of the other ones block > >> non-directly related prefixes as a means of extortion into complete > >> breach of contract. there are some 110 of them last time we > >> checked. we only were on the 2 operated by spamhaus. :P > >> so by far... pretty much all dnsbl's list the ips that originate > >> the 'undesired' traffic, which stops it from > >> reaching those that use their service, and that's where it ends for > >> them... that's perfectly acceptable. > >> (as long as it's the actual end user making the decision to use > >> their 'filtering' or not) > >> > > Okay, got it, thank you for that > > > >> howeverrrrr... then there is spamhaus... > >> > > yeah, but it will show good manners if you make a new thread about > > that? > > > >> as for the ripe mailinglist being smtp... yes. it unfortunately > >> still is.. and it's about the ONLY thing that still needs smtp, > >> next to signing up to habbo hotel. lol. i haven't started the mail > >> client for anything else in years. lol. face it: smtp is dead, the > >> reason it is dead: is spamhaus itself. making it unreliable. > >> mainly. > >> > > we will have to agree to disagree (or not agree - with the same > > result :) ) > > > > smtp - 2017 my pov (and own stats) There has never been so much > > legit traffic sent ever... > > > > Easy to check though as everyone on here has their own stats and to > > quickly analize 25 vs say 80 (wow - and 443 is just as crazy in > > terms of growth as 25!) in 2015 as compared to 2016 - smtp is > > alive and kicking (so is 443!) > > > > Andre > > > > ------------------------------ Message: 3 Date: Mon, 30 Jan 2017 16:36:48 +0200 From: ox <andre(a)ox.co.za> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <mailman.5203.1485793288.1952.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII On Mon, 30 Jan 2017 14:25:01 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > although i can't see how you managed to obtain statistics on the > number of emails being sent each day... unless spamhaus would like to > admit that they also spy on dns requests to their dnsbl... which <snip> Okay, we can just agree to disagree - or simply just disagree is also good. lol May I please solicit some comments about Abuse Block lists (Without detracting from RFC 5782 and RFC 6471 or : https://www.ripe.net/publications/docs/ripe-409 ) Considering that DNSBL tech is "MOSTLY" "reactive" (after he abuse) - although - there are - some - DNSBL (apparently Spamhaus? etc etc) that apparently block before anything happens (thank you for pointing this out Simon) The block time policies of RBLs - Not specifically anyone blocklist in particular - just the general policies) *********************************** Among the reactive and pre emptive DNSBL, there are two main types of block lists: No automatic removal and automatic removal Is the policy to auto de-list after a period of time, still accurate? or should block lists not auto de list at all any longer? If still auto de-list - Considering the change in abuse patterns and technology, should the block times be increased or de-creased? Then; Ignoring pre-emptive - predictive (in advance for no reason) blocking: Does society require more specialist non auto de-list DNSBLs? (Would it be helpful to civil society, law enforcement etc to have a "child pornography" dnsbl? or a phish dnsbl? - or is the reactive time to high in order for dynamic ipv4? - but on ipv6 allocations to devices could be more 'permanent'? etc) Andre ------------------------------ Message: 4 Date: Mon, 30 Jan 2017 13:21:54 +0000 From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <840945de-6bb5-c7f3-a7e7-231ea0117f23(a)xs4all.nl> Content-Type: text/plain; charset="utf-8"; Format="flowed" smtp is just one of many protocols out there, a primitive, fairly unimportant and severely lacking in terms of security one at that, and it's protection cannot be a reason for any disconnection -ever-. On 30 ???, 2017 ? 01:17, HRH Prince Sven Olaf von CyberBunker wrote: > > and now it's time for everyone here, to stop giving stevieboy his way > with his absurd definitions of 'abuse'... if there is no law against > it in the country in which the customer recides. its no reason for > disconnection. doing so is not delivering a paid service, caving into > blackmail, and undermining provider immunity by caving in to any > random idiot that just so happens to have gained influence over mail > delivery, and frequently abuses said (advertised) influence to commit > computer sabotage (he knows what the impacts of his listings are, he > advertises with it), to extort the internet industry into wasting > valuable manhours on him and his self-declared 'delisting procedure', > and breach valuable contracts. > > if he mentions any ip address (or worse: personal details) in his > crappy slander and blackmail system he calls 'spamhaus' just call the > feds on him. the guardia civil for example as he currently is in spain. > > viola 13 > > puerta d' andratx. > > under no circumstance should 'spamhaus' be allowed to dictate which > customers to serve and which not. simple as that. > > > now act PROFESSIONAL and stop giving this idiot his way just because > he mentions 'spam'. as if 'spam' > > is the worst thing that ever happened to the internet... how about him > trying to get entire isps disconnected. who gives a shit about him and > his 'spam'. > > > > > On 30 ???, 2017 ? 01:09, HRH Prince Sven Olaf von CyberBunker wrote: >> >> one would almost go and set up a few 1000 smtp servers, all sending >> steve linford viagra offers, just to annoy the guy back. operational >> costs would go through the roof tho lol. >> >> >> On 30 ???, 2017 ? 01:04, HRH Prince Sven Olaf von CyberBunker wrote: >>> >>> btw. this is europe. not america. we can say fuck however many times >>> we want over here. tyvm. and in the case of spamhaus, it's fully >>> applicable. spamhaus IS a cancer. that was using this mailinglist >>> just a few hours ago to try to further the reach of their cancerous >>> censorship tool disguised as a 'spam fighter' >>> >>> >>> On 30 ???, 2017 ? 01:03, HRH Prince Sven Olaf von CyberBunker wrote: >>>> >>>> if the fully appropriate language used is the only thing you can >>>> think of as an argument, that shows it's completely right. lol. >>>> you're free to google 'cb3rob' and see what steve linford told the >>>> 'world press' about our operations in the past. so far for >>>> inappropriate language. >>>> >>>> >>>> >>>> On 30 ???, 2017 ? 12:58, Tobias Knecht wrote: >>>>> Hello, >>>>> >>>>> @Sven Olaf: >>>>> Please stop using this type of offensive language! >>>>> This is a public mailinglist and not a place for you to rant and >>>>> attack in the way you are at the moment. >>>>> >>>>> So step back for a minute, take a deep breath and calm down! >>>>> >>>>> And if you feel you can send a message without using this type of >>>>> language, feel free to do so, otherwise stay away! >>>>> >>>>> If you have any questions, feel free to reach out to me directly. >>>>> >>>>> Thanks, >>>>> >>>>> Tobias >>>>> >>>>> -- >>>>> ?RIPE Anti Abuse Working Group Co-Chair >>>>> >>>>> >>>>> ? >>>>> >>>>> On Mon, Jan 30, 2017 at 1:46 PM, HRH Prince Sven Olaf von >>>>> CyberBunker <svenk(a)xs4all.nl <mailto:svenk@xs4all.nl>> wrote: >>>>> >>>>> btw it would be of great assistance in this matter if transit >>>>> carriers, simply, only HAD asn's and no ip prefixes that can >>>>> be used as a blackmailing vector. don't quite see why everyone >>>>> combines the 'isp' part with the 'transit providing' part of >>>>> their operations. parties that provide transit, have no need >>>>> for ip space (bgp sessions are better on 10.0.0.0/8 >>>>> <http://10.0.0.0/8> anyway, prevents attack from 'outside'). >>>>> if there are no ip's there is nothing idiots like spamhaus (so >>>>> far they are the only ones) can 'blacklist' to 'build up >>>>> pressure' to breach contracts. so just split up those operations. >>>>> >>>>> >>>>> On 30 ???, 2017 ? 12:32, HRH Prince Sven Olaf von CyberBunker >>>>> wrote: >>>>>> >>>>>> customer wants to send packets from ip A to ip b... did they >>>>>> arrive? -> yes. we did our job. no -> we did not do our job. >>>>>> i can't quite see why we would even need to know what 'smtp' >>>>>> is. nor any of the other obscure shit protocols out there. >>>>>> >>>>>> >>>>>> On 30 ???, 2017 ? 12:30, HRH Prince Sven Olaf von CyberBunker >>>>>> wrote: >>>>>>> >>>>>>> content. is NEVER. network-related-abuse. >>>>>>> >>>>>>> 'making more use of a mail protocol that in every other way >>>>>>> is used as intended' is also not 'network-related-abuse' in >>>>>>> fact it's not abuse at all. it's like tv advertisements. >>>>>>> >>>>>>> 'malware and virusses' all simply exploit the same old >>>>>>> services 'provided' by crappy windows malware, which should >>>>>>> get some import restrictions, and the problem is solved ay. >>>>>>> it's windows itself that is the malware there... >>>>>>> >>>>>>> 'phishing'... so you're saying your bank login procedure >>>>>>> sucks balls and/or you think 16 numbers on the front and 3 >>>>>>> top secret ones on the back of a plastic card people show in >>>>>>> every restaurant they go to are 'security' - go fix your own >>>>>>> crap and stop bothering us, we forward -packets-. we don't >>>>>>> have time to hunt ghosts for your broken financial services. >>>>>>> >>>>>>> 'announcing the whole god damn internet split up into >>>>>>> /24s'.. - yes .. that's 'abuse'. lol. >>>>>>> >>>>>>> and either way... if someone doesn't like what someone else >>>>>>> is doing they can take them to the -appropriate- courts (of >>>>>>> the other party) and try to get them to stop... blackmailing >>>>>>> the sales department of the transit carriers of their >>>>>>> supplier of their supplier of their supplier, will only make >>>>>>> them change isps, cause financial loss (or gains: setup >>>>>>> fees), etc. >>>>>>> >>>>>>> so far all spamhaus has ever established is: >>>>>>> >>>>>>> - a whole lot of unroutable/unsellable/unusable ipv4 >>>>>>> 'burned' ranges. >>>>>>> >>>>>>> - smtp is no longer peer to peer (their bashing on open relays) >>>>>>> >>>>>>> - smtp is no longer real time (graylisting) >>>>>>> >>>>>>> - smtp is no longer reliable (with over 20 million ip >>>>>>> addresses listed despite there only being 300k mailservers >>>>>>> in the world, no wonder!) >>>>>>> >>>>>>> so instead of stopping spam, they managed to kill of smtp. >>>>>>> congratulations. >>>>>>> >>>>>>> everyone now uses skype and facebook (which are real-time >>>>>>> and do have friends-lists) lolol. you have succeeded in >>>>>>> bringing microsoft and facebook users to spy on. well done. >>>>>>> >>>>>>> if smtp is 'getting less' that is only because it has no >>>>>>> users left. people only start it up to read ripe >>>>>>> mailinglists (lol) or sign up for habbo hotel. FACT. lol. >>>>>>> >>>>>>> none of our customers has ever sent UCE from our networks... >>>>>>> because... ever since 2004... we have simply blocked port >>>>>>> 25... smtp only causes -shit- and it -delivers shit- >>>>>>> (abusemail and 'legal' threats about shit that is not our >>>>>>> problem). we sure as hell have some customers that cause >>>>>>> 'shit' but they usually do it in somewhat more profitable >>>>>>> markets than sending 'spam' and most definately can buy a tv >>>>>>> station or 2 to do their advertisements on. tyvm spamhaus. lol. >>>>>>> >>>>>>> where this 'mytical' spammer that can pay our 1000-1500 >>>>>>> euros per month per server would come from, i don't know, i >>>>>>> certainly have never met any... i tried to invoice one 60k >>>>>>> once and he backed off already. poor spammers. they're like >>>>>>> child porn people. can't pay for anything, so not an urgent >>>>>>> issue at all. >>>>>>> >>>>>>> our customers frequently have the entire fucking cia rolling >>>>>>> over their doorstep and if it's not them its the god damn >>>>>>> copyright mafia. slightly different budgetarial picture >>>>>>> there. shit that -is- worth the trouble. >>>>>>> >>>>>>> now, please take your shitty nagging about 'abuse' of your >>>>>>> crappy silly old smtp protocol, which doesn't even >>>>>>> -originate- from our networks in the first fucking place, >>>>>>> and stick it where the sun doesn't shine... as for >>>>>>> malware... windows is the malware there... it facilitates >>>>>>> all the programs residing on top of the same old 1990s badly >>>>>>> implemented os/2 ripoff crap. so basically call mickeysoft >>>>>>> and ask them to fix the bugs they all exploit, or call the >>>>>>> european commission and impose trade bans against microsoft. >>>>>>> simple enough. >>>>>>> >>>>>>> >>>>>>> On 30 ???, 2017 ? 12:13, HRH Prince Sven Olaf von >>>>>>> CyberBunker wrote: >>>>>>>> >>>>>>>> advertising the sale of : viagra, sex slaves, ak47s, porn >>>>>>>> of any kind, human trafficing services, specific animals, >>>>>>>> cocain, data obtained through espionage, encryption >>>>>>>> technology, vpns, gay propaganda, military propaganda, etc >>>>>>>> is subject to applicable local law (if any, and if there is >>>>>>>> none, it's perfectly fine)... not 'spamhaus policies' as >>>>>>>> spamhaus is not supposed to be 'the internet government'. >>>>>>>> even if they think they should be. >>>>>>>> >>>>>>>> if the uk wants to keep certain products from entering >>>>>>>> 'their' territory (and in doing so limit the freedom of >>>>>>>> their own stakeholders/tax payers) that is up to them >>>>>>>> others choose not to work against their own >>>>>>>> stakeholders/tax payers that way. they have a customs >>>>>>>> department to keep said products outside. can't tell others >>>>>>>> not to produce or sell or advertise it. setting up dirty >>>>>>>> front operations like 'spamhaus' to lure naive nerds into >>>>>>>> the illusion that they would be 'fighting spam' is a very >>>>>>>> nasty thing to do. geo-political wise and business wise. >>>>>>>> >>>>>>>> now... in thailand porn is illegal... so... let's >>>>>>>> disconnect all porn sites because thailand wants us to, oh >>>>>>>> but wait, thailand doesn't have a 'spamhaus' thinking they >>>>>>>> rule the entire internet through means of blackmail and >>>>>>>> calling people 'spammers' or 'spam supporters'. >>>>>>>> >>>>>>>> what also works, besides blackmailing with committing >>>>>>>> computer sabotage against the sales department of suppliers >>>>>>>> of suppliers of suppliers of the publisher of a website, >>>>>>>> are: assassins, commandos, carpet bombing, agent orange. >>>>>>>> etc... all of which should be deployed against spamhaus if >>>>>>>> you ask me. :P but a nullroute would suffice. lol. after >>>>>>>> all bgp is an 'advisory' to 'voluntary peers' and 'we don't >>>>>>>> block anything' as they themselves always say. >>>>>>>> >>>>>>>> >>>>>>>> On 30 ???, 2017 ? 11:29, Esa Laitinen wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> On Mon, Jan 30, 2017 at 12:19 PM HRH Prince Sven Olaf von >>>>>>>>> CyberBunker <svenk(a)xs4all.nl <mailto:svenk@xs4all.nl>> wrote: >>>>>>>>> >>>>>>>>> also it's quite vague that when some mossadis rent >>>>>>>>> servers and run an espionage botnet on it (which we >>>>>>>>> happily intercept ourselves ofcourse) - spamhaus >>>>>>>>> somehow magically never lists -that-.. just >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Looking at the amusing rant of Sven Olaf, it seems that >>>>>>>>> the listing works! >>>>>>>>> >>>>>>>>> Keep up the good work, spamhaus et al! >>>>>>>>> >>>>>>>>> esa >>>>>>>> >>>>>>> >>>>>> >>>>> >>>>> >>>> >>> >> >

1 0

Re: [anti-abuse-wg] RBL Discussion Update
by ox 31 Jan '17

31 Jan '17

On Tue, 31 Jan 2017 14:08:44 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > spamhaus, simply, fucked with the wrong guys there. lolol. if that > somehow caused 'interference' on the internet, then so be it. it's > generally better to have some short period complete downtime than to > have 100 years of fuckery going on. maybe they learned something for > next time. lol. > hmmm, I like downtime, gives me a gap to go surfing, I love surfing :) then again it is not my Internet, it is yours - and my surfboard is not plugged in. lol Still, not wanting to point out the very obvious here, but, you are ranting about Spamhaus... Andre

1 0

Re: [anti-abuse-wg] RBL Discussion Update
by ox 31 Jan '17

31 Jan '17

On Tue, 31 Jan 2017 14:05:12 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > as -that- is what all those spamhaus listings (the ones -before- the > escalations, which are pure and solely blackmail) are -mostly- about: > trade policy. not spam. not virusses. > *yawn* still ranting about Spamhaus... Andre

1 0

Re: [anti-abuse-wg] RBL Discussion Update
by ox 31 Jan '17

31 Jan '17

On Tue, 31 Jan 2017 13:47:53 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > it's not only about spamhaus, it's about any rbl that -potentially- > -could get the idea- that they could force isps to 'contact them' by > not having auto-delisting and/or also listing non-directly related > ip's (Such as ips routed by the same parties or ips having urls > resolving to them in 'spam', which could negatively impact an smtpd > running on that ip, which is not the smtpd that originated the > 'spam'). > furthermore, you're not in a position to make 'demands'. we own the > internet. you don't. > yes, your rants from two emails ago was still only about Spamhaus :) And, any RBL can list any IP number they please and there are so many good and trusted RBLs that do not have any auto de-listing. Right now, even some of the large DNSBL that do have automatic removal, is thinking about stopping auto removals and there are suggestions to have "minimum listing times" I am not sure exactly what that means or how it will work, but I assume that the specific list will not remove any listing for a set period of time (like a penalty box) In my own opinion, I think that all listing removals should only be manual and that there is a set number of removals, after which listing becomes permanent. and, I am not demanding anything. lol Andre

1 0

Re: [anti-abuse-wg] RBL Discussion Update
by ox 31 Jan '17

31 Jan '17

On Tue, 31 Jan 2017 13:29:21 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > > --------------------------------- > > Request for comments: > > proposal policy in case of an RBL trying to excersise force to either: > Easy answer: RBLs cannot "force" anyone to do anything. An RBL is simply a list. Everyone has free choice whether to use ANY list - or not to use any list. If you have the mis-fortune of being on a list, that someone else trusts, take it up with whomever maintains whatever list. Your mini rfc, is Mad and senseless ranting and raving about wind and air. lol and... is still only about Spamhaus... Andre

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 62, Issue 28
by Marilson 31 Jan '17

31 Jan '17

Yesterday, Andre wrote: > In 2015, the number of emails sent and received per day total over 205 billion... Andre is underestimating the size of the problem and Olaf, the prince of spam, the demolisher, the man who almost broke the internet, pretends to be unaware: During 2010, about 107 trillion emails were sent around the world. Of that total, 89.1% were spam - this corresponds to an average of 262 billion unwanted messages per day, according to data from Royal Pingdom consultancy, which monitors web traffic. 293 billion emails being 262 billion spam, in 2010. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, January 30, 2017 2:21 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 62, Issue 28 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Fwd: Re: RBL policy (HRH Prince Sven Olaf von CyberBunker) 2. Re: Fwd: Re: RBL policy (ox) 3. Re: Fwd: Re: RBL policy (ox) 4. Re: Fwd: Re: RBL policy (HRH Prince Sven Olaf von CyberBunker) ---------------------------------------------------------------------- Message: 1 Date: Mon, 30 Jan 2017 13:19:32 +0000 From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <8099bc26-b01b-84e1-2b2e-f5e773ee22f9(a)xs4all.nl> Content-Type: text/plain; charset=UTF-8; format=flowed as for smtp being alive.. out of 4 billion ips some 200k run an smtp server... still a lot more than ftp (including badly configured printers and security cameras).. but considering it's a protocol that was supposed to run on each and every workstation. it's dead. facebook has more users per second than smtp has mails per year. lol. On 30 ???, 2017 ? 01:13, ox wrote: > On Mon, 30 Jan 2017 13:01:46 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> no not all dnsbls are a problem. none of the other ones block >> non-directly related prefixes as a means of extortion into complete >> breach of contract. there are some 110 of them last time we checked. >> we only were on the 2 operated by spamhaus. :P >> so by far... pretty much all dnsbl's list the ips that originate the >> 'undesired' traffic, which stops it from >> reaching those that use their service, and that's where it ends for >> them... that's perfectly acceptable. >> (as long as it's the actual end user making the decision to use their >> 'filtering' or not) >> > Okay, got it, thank you for that > >> howeverrrrr... then there is spamhaus... >> > yeah, but it will show good manners if you make a new thread about > that? > >> as for the ripe mailinglist being smtp... yes. it unfortunately still >> is.. and it's about the ONLY thing that still needs smtp, next to >> signing up to habbo hotel. lol. i haven't started the mail client for >> anything else in years. lol. face it: smtp is dead, the reason it is >> dead: is spamhaus itself. making it unreliable. mainly. >> > we will have to agree to disagree (or not agree - with the same > result :) ) > > smtp - 2017 my pov (and own stats) There has never been so much legit > traffic sent ever... > > Easy to check though as everyone on here has their own stats and to > quickly analize 25 vs say 80 (wow - and 443 is just as crazy in terms of > growth as 25!) in 2015 as compared to 2016 - smtp is alive and kicking > (so is 443!) > > Andre > ------------------------------ Message: 2 Date: Mon, 30 Jan 2017 15:37:32 +0200 From: ox <andre(a)ox.co.za> To: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <mailman.5202.1485793288.1952.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=UTF-8 On Mon, 30 Jan 2017 13:19:32 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > as for smtp being alive.. out of 4 billion ips some 200k run an smtp > server... still a lot more than ftp (including badly configured > printers and security cameras).. but considering it's a protocol that > was supposed to run on each and every workstation. it's dead. > > facebook has more users per second than smtp has mails per year. lol. > https://zephoria.com/top-15-valuable-facebook-statistics/ statistics, facts (after they happened) are so crazy, lol In 2015, the number of emails sent and received per day total over 205 billion... in 2016 email/smtp = +8% lol and 2017 - looks to be even more hectic. - smtp maybe closer to 300 billion (per day) or 109 Trillion emails per year...lol by 2020 we may be at 1000 trillion emails... how many users does facebook have per day. lol > > On 30 ???, 2017 ? 01:13, ox wrote: > > On Mon, 30 Jan 2017 13:01:46 +0000 > > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > >> no not all dnsbls are a problem. none of the other ones block > >> non-directly related prefixes as a means of extortion into complete > >> breach of contract. there are some 110 of them last time we > >> checked. we only were on the 2 operated by spamhaus. :P > >> so by far... pretty much all dnsbl's list the ips that originate > >> the 'undesired' traffic, which stops it from > >> reaching those that use their service, and that's where it ends for > >> them... that's perfectly acceptable. > >> (as long as it's the actual end user making the decision to use > >> their 'filtering' or not) > >> > > Okay, got it, thank you for that > > > >> howeverrrrr... then there is spamhaus... > >> > > yeah, but it will show good manners if you make a new thread about > > that? > > > >> as for the ripe mailinglist being smtp... yes. it unfortunately > >> still is.. and it's about the ONLY thing that still needs smtp, > >> next to signing up to habbo hotel. lol. i haven't started the mail > >> client for anything else in years. lol. face it: smtp is dead, the > >> reason it is dead: is spamhaus itself. making it unreliable. > >> mainly. > >> > > we will have to agree to disagree (or not agree - with the same > > result :) ) > > > > smtp - 2017 my pov (and own stats) There has never been so much > > legit traffic sent ever... > > > > Easy to check though as everyone on here has their own stats and to > > quickly analize 25 vs say 80 (wow - and 443 is just as crazy in > > terms of growth as 25!) in 2015 as compared to 2016 - smtp is > > alive and kicking (so is 443!) > > > > Andre > > > > ------------------------------ Message: 3 Date: Mon, 30 Jan 2017 16:36:48 +0200 From: ox <andre(a)ox.co.za> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <mailman.5203.1485793288.1952.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII On Mon, 30 Jan 2017 14:25:01 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > although i can't see how you managed to obtain statistics on the > number of emails being sent each day... unless spamhaus would like to > admit that they also spy on dns requests to their dnsbl... which <snip> Okay, we can just agree to disagree - or simply just disagree is also good. lol May I please solicit some comments about Abuse Block lists (Without detracting from RFC 5782 and RFC 6471 or : https://www.ripe.net/publications/docs/ripe-409 ) Considering that DNSBL tech is "MOSTLY" "reactive" (after he abuse) - although - there are - some - DNSBL (apparently Spamhaus? etc etc) that apparently block before anything happens (thank you for pointing this out Simon) The block time policies of RBLs - Not specifically anyone blocklist in particular - just the general policies) *********************************** Among the reactive and pre emptive DNSBL, there are two main types of block lists: No automatic removal and automatic removal Is the policy to auto de-list after a period of time, still accurate? or should block lists not auto de list at all any longer? If still auto de-list - Considering the change in abuse patterns and technology, should the block times be increased or de-creased? Then; Ignoring pre-emptive - predictive (in advance for no reason) blocking: Does society require more specialist non auto de-list DNSBLs? (Would it be helpful to civil society, law enforcement etc to have a "child pornography" dnsbl? or a phish dnsbl? - or is the reactive time to high in order for dynamic ipv4? - but on ipv6 allocations to devices could be more 'permanent'? etc) Andre ------------------------------ Message: 4 Date: Mon, 30 Jan 2017 13:21:54 +0000 From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Fwd: Re: RBL policy Message-ID: <840945de-6bb5-c7f3-a7e7-231ea0117f23(a)xs4all.nl> Content-Type: text/plain; charset="utf-8"; Format="flowed" smtp is just one of many protocols out there, a primitive, fairly unimportant and severely lacking in terms of security one at that, and it's protection cannot be a reason for any disconnection -ever-. On 30 ???, 2017 ? 01:17, HRH Prince Sven Olaf von CyberBunker wrote: > > and now it's time for everyone here, to stop giving stevieboy his way > with his absurd definitions of 'abuse'... if there is no law against > it in the country in which the customer recides. its no reason for > disconnection. doing so is not delivering a paid service, caving into > blackmail, and undermining provider immunity by caving in to any > random idiot that just so happens to have gained influence over mail > delivery, and frequently abuses said (advertised) influence to commit > computer sabotage (he knows what the impacts of his listings are, he > advertises with it), to extort the internet industry into wasting > valuable manhours on him and his self-declared 'delisting procedure', > and breach valuable contracts. > > if he mentions any ip address (or worse: personal details) in his > crappy slander and blackmail system he calls 'spamhaus' just call the > feds on him. the guardia civil for example as he currently is in spain. > > viola 13 > > puerta d' andratx. > > under no circumstance should 'spamhaus' be allowed to dictate which > customers to serve and which not. simple as that. > > > now act PROFESSIONAL and stop giving this idiot his way just because > he mentions 'spam'. as if 'spam' > > is the worst thing that ever happened to the internet... how about him > trying to get entire isps disconnected. who gives a shit about him and > his 'spam'. > > > > > On 30 ???, 2017 ? 01:09, HRH Prince Sven Olaf von CyberBunker wrote: >> >> one would almost go and set up a few 1000 smtp servers, all sending >> steve linford viagra offers, just to annoy the guy back. operational >> costs would go through the roof tho lol. >> >> >> On 30 ???, 2017 ? 01:04, HRH Prince Sven Olaf von CyberBunker wrote: >>> >>> btw. this is europe. not america. we can say fuck however many times >>> we want over here. tyvm. and in the case of spamhaus, it's fully >>> applicable. spamhaus IS a cancer. that was using this mailinglist >>> just a few hours ago to try to further the reach of their cancerous >>> censorship tool disguised as a 'spam fighter' >>> >>> >>> On 30 ???, 2017 ? 01:03, HRH Prince Sven Olaf von CyberBunker wrote: >>>> >>>> if the fully appropriate language used is the only thing you can >>>> think of as an argument, that shows it's completely right. lol. >>>> you're free to google 'cb3rob' and see what steve linford told the >>>> 'world press' about our operations in the past. so far for >>>> inappropriate language. >>>> >>>> >>>> >>>> On 30 ???, 2017 ? 12:58, Tobias Knecht wrote: >>>>> Hello, >>>>> >>>>> @Sven Olaf: >>>>> Please stop using this type of offensive language! >>>>> This is a public mailinglist and not a place for you to rant and >>>>> attack in the way you are at the moment. >>>>> >>>>> So step back for a minute, take a deep breath and calm down! >>>>> >>>>> And if you feel you can send a message without using this type of >>>>> language, feel free to do so, otherwise stay away! >>>>> >>>>> If you have any questions, feel free to reach out to me directly. >>>>> >>>>> Thanks, >>>>> >>>>> Tobias >>>>> >>>>> -- >>>>> ?RIPE Anti Abuse Working Group Co-Chair >>>>> >>>>> >>>>> ? >>>>> >>>>> On Mon, Jan 30, 2017 at 1:46 PM, HRH Prince Sven Olaf von >>>>> CyberBunker <svenk(a)xs4all.nl <mailto:svenk@xs4all.nl>> wrote: >>>>> >>>>> btw it would be of great assistance in this matter if transit >>>>> carriers, simply, only HAD asn's and no ip prefixes that can >>>>> be used as a blackmailing vector. don't quite see why everyone >>>>> combines the 'isp' part with the 'transit providing' part of >>>>> their operations. parties that provide transit, have no need >>>>> for ip space (bgp sessions are better on 10.0.0.0/8 >>>>> <http://10.0.0.0/8> anyway, prevents attack from 'outside'). >>>>> if there are no ip's there is nothing idiots like spamhaus (so >>>>> far they are the only ones) can 'blacklist' to 'build up >>>>> pressure' to breach contracts. so just split up those operations. >>>>> >>>>> >>>>> On 30 ???, 2017 ? 12:32, HRH Prince Sven Olaf von CyberBunker >>>>> wrote: >>>>>> >>>>>> customer wants to send packets from ip A to ip b... did they >>>>>> arrive? -> yes. we did our job. no -> we did not do our job. >>>>>> i can't quite see why we would even need to know what 'smtp' >>>>>> is. nor any of the other obscure shit protocols out there. >>>>>> >>>>>> >>>>>> On 30 ???, 2017 ? 12:30, HRH Prince Sven Olaf von CyberBunker >>>>>> wrote: >>>>>>> >>>>>>> content. is NEVER. network-related-abuse. >>>>>>> >>>>>>> 'making more use of a mail protocol that in every other way >>>>>>> is used as intended' is also not 'network-related-abuse' in >>>>>>> fact it's not abuse at all. it's like tv advertisements. >>>>>>> >>>>>>> 'malware and virusses' all simply exploit the same old >>>>>>> services 'provided' by crappy windows malware, which should >>>>>>> get some import restrictions, and the problem is solved ay. >>>>>>> it's windows itself that is the malware there... >>>>>>> >>>>>>> 'phishing'... so you're saying your bank login procedure >>>>>>> sucks balls and/or you think 16 numbers on the front and 3 >>>>>>> top secret ones on the back of a plastic card people show in >>>>>>> every restaurant they go to are 'security' - go fix your own >>>>>>> crap and stop bothering us, we forward -packets-. we don't >>>>>>> have time to hunt ghosts for your broken financial services. >>>>>>> >>>>>>> 'announcing the whole god damn internet split up into >>>>>>> /24s'.. - yes .. that's 'abuse'. lol. >>>>>>> >>>>>>> and either way... if someone doesn't like what someone else >>>>>>> is doing they can take them to the -appropriate- courts (of >>>>>>> the other party) and try to get them to stop... blackmailing >>>>>>> the sales department of the transit carriers of their >>>>>>> supplier of their supplier of their supplier, will only make >>>>>>> them change isps, cause financial loss (or gains: setup >>>>>>> fees), etc. >>>>>>> >>>>>>> so far all spamhaus has ever established is: >>>>>>> >>>>>>> - a whole lot of unroutable/unsellable/unusable ipv4 >>>>>>> 'burned' ranges. >>>>>>> >>>>>>> - smtp is no longer peer to peer (their bashing on open relays) >>>>>>> >>>>>>> - smtp is no longer real time (graylisting) >>>>>>> >>>>>>> - smtp is no longer reliable (with over 20 million ip >>>>>>> addresses listed despite there only being 300k mailservers >>>>>>> in the world, no wonder!) >>>>>>> >>>>>>> so instead of stopping spam, they managed to kill of smtp. >>>>>>> congratulations. >>>>>>> >>>>>>> everyone now uses skype and facebook (which are real-time >>>>>>> and do have friends-lists) lolol. you have succeeded in >>>>>>> bringing microsoft and facebook users to spy on. well done. >>>>>>> >>>>>>> if smtp is 'getting less' that is only because it has no >>>>>>> users left. people only start it up to read ripe >>>>>>> mailinglists (lol) or sign up for habbo hotel. FACT. lol. >>>>>>> >>>>>>> none of our customers has ever sent UCE from our networks... >>>>>>> because... ever since 2004... we have simply blocked port >>>>>>> 25... smtp only causes -shit- and it -delivers shit- >>>>>>> (abusemail and 'legal' threats about shit that is not our >>>>>>> problem). we sure as hell have some customers that cause >>>>>>> 'shit' but they usually do it in somewhat more profitable >>>>>>> markets than sending 'spam' and most definately can buy a tv >>>>>>> station or 2 to do their advertisements on. tyvm spamhaus. lol. >>>>>>> >>>>>>> where this 'mytical' spammer that can pay our 1000-1500 >>>>>>> euros per month per server would come from, i don't know, i >>>>>>> certainly have never met any... i tried to invoice one 60k >>>>>>> once and he backed off already. poor spammers. they're like >>>>>>> child porn people. can't pay for anything, so not an urgent >>>>>>> issue at all. >>>>>>> >>>>>>> our customers frequently have the entire fucking cia rolling >>>>>>> over their doorstep and if it's not them its the god damn >>>>>>> copyright mafia. slightly different budgetarial picture >>>>>>> there. shit that -is- worth the trouble. >>>>>>> >>>>>>> now, please take your shitty nagging about 'abuse' of your >>>>>>> crappy silly old smtp protocol, which doesn't even >>>>>>> -originate- from our networks in the first fucking place, >>>>>>> and stick it where the sun doesn't shine... as for >>>>>>> malware... windows is the malware there... it facilitates >>>>>>> all the programs residing on top of the same old 1990s badly >>>>>>> implemented os/2 ripoff crap. so basically call mickeysoft >>>>>>> and ask them to fix the bugs they all exploit, or call the >>>>>>> european commission and impose trade bans against microsoft. >>>>>>> simple enough. >>>>>>> >>>>>>> >>>>>>> On 30 ???, 2017 ? 12:13, HRH Prince Sven Olaf von >>>>>>> CyberBunker wrote: >>>>>>>> >>>>>>>> advertising the sale of : viagra, sex slaves, ak47s, porn >>>>>>>> of any kind, human trafficing services, specific animals, >>>>>>>> cocain, data obtained through espionage, encryption >>>>>>>> technology, vpns, gay propaganda, military propaganda, etc >>>>>>>> is subject to applicable local law (if any, and if there is >>>>>>>> none, it's perfectly fine)... not 'spamhaus policies' as >>>>>>>> spamhaus is not supposed to be 'the internet government'. >>>>>>>> even if they think they should be. >>>>>>>> >>>>>>>> if the uk wants to keep certain products from entering >>>>>>>> 'their' territory (and in doing so limit the freedom of >>>>>>>> their own stakeholders/tax payers) that is up to them >>>>>>>> others choose not to work against their own >>>>>>>> stakeholders/tax payers that way. they have a customs >>>>>>>> department to keep said products outside. can't tell others >>>>>>>> not to produce or sell or advertise it. setting up dirty >>>>>>>> front operations like 'spamhaus' to lure naive nerds into >>>>>>>> the illusion that they would be 'fighting spam' is a very >>>>>>>> nasty thing to do. geo-political wise and business wise. >>>>>>>> >>>>>>>> now... in thailand porn is illegal... so... let's >>>>>>>> disconnect all porn sites because thailand wants us to, oh >>>>>>>> but wait, thailand doesn't have a 'spamhaus' thinking they >>>>>>>> rule the entire internet through means of blackmail and >>>>>>>> calling people 'spammers' or 'spam supporters'. >>>>>>>> >>>>>>>> what also works, besides blackmailing with committing >>>>>>>> computer sabotage against the sales department of suppliers >>>>>>>> of suppliers of suppliers of the publisher of a website, >>>>>>>> are: assassins, commandos, carpet bombing, agent orange. >>>>>>>> etc... all of which should be deployed against spamhaus if >>>>>>>> you ask me. :P but a nullroute would suffice. lol. after >>>>>>>> all bgp is an 'advisory' to 'voluntary peers' and 'we don't >>>>>>>> block anything' as they themselves always say. >>>>>>>> >>>>>>>> >>>>>>>> On 30 ???, 2017 ? 11:29, Esa Laitinen wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> On Mon, Jan 30, 2017 at 12:19 PM HRH Prince Sven Olaf von >>>>>>>>> CyberBunker <svenk(a)xs4all.nl <mailto:svenk@xs4all.nl>> wrote: >>>>>>>>> >>>>>>>>> also it's quite vague that when some mossadis rent >>>>>>>>> servers and run an espionage botnet on it (which we >>>>>>>>> happily intercept ourselves ofcourse) - spamhaus >>>>>>>>> somehow magically never lists -that-.. just >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Looking at the amusing rant of Sven Olaf, it seems that >>>>>>>>> the listing works! >>>>>>>>> >>>>>>>>> Keep up the good work, spamhaus et al! >>>>>>>>> >>>>>>>>> esa >>>>>>>> >>>>>>> >>>>>> >>>>> >>>>> >>>> >>> >> >

1 0

RBL Discussion Update
by Brian Nisbet 31 Jan '17

31 Jan '17

Ok folks... The RBL Policy discussion is interesting, but we've gone wildly off track and it has become focused, unfortunately, on one provider. I'm not going to tell anyone what to think of Spamhaus, but this conversation is not the right place to go on specifically about them. I think the relevant opinions have been aired and nobody is going to be convinced one way or the other. If there is more discussion of general RBL Policy and whether bans should be longer/shorter/whatever or the other points Andre raised, great. If you aren't talking about this, please don't post it here. There are lots of other lists and forums and things on the Internet where you can post away. Thanks, Brian -- Brian Nisbet, Network Operations Manager HEAnet CLG, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 31 Jan '17

31 Jan '17

Strafgesetzbuch (StGB) § 240 Nötigung (1) Wer einen Menschen rechtswidrig mit Gewalt oder durch Drohung mit einem empfindlichen Übel zu einer Handlung, Duldung oder Unterlassung nötigt, wird mit Freiheitsstrafe bis zu drei Jahren oder mit Geldstrafe bestraft. (2) Rechtswidrig ist die Tat, wenn die Anwendung der Gewalt oder die Androhung des Übels zu dem angestrebten Zweck als verwerflich anzusehen ist. (3) Der Versuch ist strafbar. (4) In besonders schweren Fällen ist die Strafe Freiheitsstrafe von sechs Monaten bis zu fünf Jahren. Ein besonders schwerer Fall liegt in der Regel vor, wenn der Täter 1. eine Schwangere zum Schwangerschaftsabbruch nötigt oder 2. seine Befugnisse oder seine Stellung als Amtsträger mißbraucht. being forced to spend manhours (= money) to 'delist' from 3rd party dns blacklists is 'empflindliche uebel', and yes you are forcing them into a 'handlung (delisting/acting AGAINST their paying customer), duldung (ignoring the fact that you call them and others affected by your block 'spammers') or 'unterlassung' (interfering with their provider immunity and right to sell services to anyone, anywhere, and keep doing so - as long as those don't break the law -there- and even if they do you can still sell them services as that's their problem -there- not yours. per-se. ;) now. that's just the blackmail part and just the BRD part... other eu memberstates usually have simular laws... if you knowingly and willingly insert ips into a blackmail infrastructure which you have advertised with the argument that you KNOW a listing has impact on 1/3rd of the worlds mail delivery, or worse, such as spamhaus DROP, where you KNOW a listing causes part of the internet to completely drop that traffic, as you advertise it just for -that- purpose and know how many nodes use it, that completely falls under pretty much any computer sabotage act out there -ever-. but... ofcourse... to you... some not-even-illegal use of 'smtp' or some wintendo virusses that could be out there, are of higher priority than keeping the internet working, and not breaking any laws yourself. keep in mind, we, the owners of the internet, isps and carriers, and yes we do OWN it, 'tolerate' blacklists... as long as they don't go around making silly demands, such as 'contacting' them, or gaining too much influence and starting to 'demand' to disconnect things without even bothering to get a court order. what's next... the RIAA setting up one as well? On 31 ينا, 2017 ص 04:17, ox wrote: > On Mon, 30 Jan 2017 13:21:54 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> smtp is just one of many protocols out there, a primitive, fairly >> unimportant and severely lacking in terms of security one at that, >> and it's protection cannot be a reason for any disconnection -ever-. >> > This thread is about DNSBL and not about the smtp protocol but the > replies helped us all understand why it is important to permanently list > entire IP ranges. (Even if the resources change hands) > > Personally, I think that block times should be increased or become more > permanent. > > Practically and right now, some of the block lists that I feed data > into is talking about discontinuing 24 hour blocks completely and > moving to much longer block times. > > Other lists are considering completely discontinuing auto de-listing. > > The effect of this will mean that abuse@ will have to become more responsive > in order to avoid being more permanently listed. > > Andre > > > > > > > > > > > >

2 3

Re: [anti-abuse-wg] Fwd: Re: Fwd: Re: RBL policy
by ox 31 Jan '17

31 Jan '17

On Tue, 31 Jan 2017 10:09:57 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > your ethics argument is funny as that applies equally well to > boko-haram and al-quida. lol. > You are exactly correct! You, yourself, also said that people can decide if or which DNSBL they want to or do not want to use... Nobody is forcing anyone to use any list. So, in fact even if example.com is listing your ipv4/6 on null route border drop, this means only as much as whatever society attaches whatever value to We do not all have the same ethics at all. Just a little while ago I had to point out that we all, in general (or overwhelmingly like in 99% of us) may share some basic ethics (like 99.9% of all people believe it is not cool to eat people) So the various lists have different ethics, some have business cases that over rule their ethics, some may even be criminals themselves, etc etc Andre

1 0

Re: [anti-abuse-wg] Language on List
by Lu Heng 31 Jan '17

31 Jan '17

Hi I agree that personal attack should not happen. As for the language usage, I believe casual language should be ok for the list, as we are not lawyers but geeks. And, as many of us are not native speaker, mistake on grammer as well as wording should be accepted. Just my 2 cents:) With regards. Lu On 31 January 2017 at 17:34, ox <andre(a)ox.co.za> wrote: > On Tue, 31 Jan 2017 09:21:37 +0000 > Brian Nisbet <brian.nisbet(a)heanet.ie> wrote: > > I shall be more clear, in that case. I have little or no problem with > > generalised swearing. It's a part of modern language and while I > > generally would not use it in professional written communications > > myself, I'm not going to attempt to censor anyone else for it. > > > > What I do not believe is acceptable is ad hominem attacks. There were > > what I believe were implied anti-Semetic comments made during the > > recent thread and that is not something that is allowed. Simple as > > that. > > > +1 > > and thank you so much for being direct, it needed to be said so that > there is no confusion about the problem that exists. > > Andre > > -- -- Kind regards. Lu

1 0

Language on List
by Brian Nisbet 31 Jan '17

31 Jan '17

Colleagues, While the Anti-Abuse WG welcomes a free exchange of ideas and opinions, it does not welcome personal abuse of any kind. This includes, but is absolutely not limited to, their ethnicity or religion. Please remember this as we all continue to work together to make the Internet a better place. Brian Co-Chair, RIPE AA WG -- Brian Nisbet, Network Operations Manager HEAnet CLG, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

2 3

Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 31 Jan '17

31 Jan '17

-------- Forwarded Message -------- Subject: Re: [anti-abuse-wg] RBL policy Date: Mon, 30 Jan 2017 10:51:40 +0000 From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> Organization: Republic CyberBunker To: Simon Forster <simon-lists(a)ldml.com> On 30 ينا, 2017 ص 09:39, Simon Forster wrote: >> On 30 Jan 2017, at 06:13, ox <andre(a)ox.co.za> wrote: >> >> Hello All, >> >> May I please solicit some comments about Abuse Block lists >> (Without detracting from RFC 5782 and RFC 6471 or : >> https://www.ripe.net/publications/docs/ripe-409 ) >> >> Firstly, the background for the start of this thread is simply: As the >> use of machine learning technology is now also applied and adapted for >> the use of cyber criminals (including spammers, scammers, etc) the >> rules and what is socially acceptable is and has changed. Global >> politics, protectionism, nationalism and the other 'isms' are also >> causing change. >> >> Considering that DNSBL tech is "reactive" (after he abuse) > This statement appears to be exclusionary — and is one often levelled against DNSBLs. All DNSBLs are not wholly reactive. > > Firstly, one needs to acknowledge that all DNSBLs are not they same. > > Secondly, some listings in some DNSBLs are proactive. i.e. Made before abuse is seen. As I work for the commercial arm of Spamhaus, I know their offerings quite well and can confidently state that some of the Spamhaus block lists contain proactive and/or precautionary listings. > > to be exact: the criminal organisation spamhaus their illegal blacklists effected some 20 million ips on our last scan of their entire database contents. (although that's a bit hard to do, as named kept crashing running 24 cores of gethostbyname() on 10ge , so we may have missed a few million here and there) at a simultanious portscan of the entire ipv4 internet, it turned out there were only some 200000 smtp servers left however. > that leads to the conclusion that 99% of the listings is purely there for blackmail purposes, and has nothing to do with your silly old SMTP protocol AT ALL. the only reason to list those others is to put pressure on people to 1: spend manhours on interacting with the (non-sollicited) spamhaus 'organisation' and 2: illegally force people into breach of contract with their clients. listing sales department networks of transit carriers to breach national carriers and connected hosting farms into breach of contract with a customer, of which steve linford does not like the CONTENT on the website, kinda, fucks up statistics ay. face it: smtp is dead, and needs no 'protection' at all.. also ip addresses identify nodes in a network, not people. also: forcing people to contact spamhaus, causes manhours to be spent on communication, which is extortion, as we have no contractual relation with spamhaus whatsoever, so trying to force carriers and isps into communication with them, is a crime. (although only punishable by 3 months in .nl ;) the 'we don't block anything' argument doesn't go. spamhaus advertises the fact that they have influence on roughly 1/3rd of mail delivery so they know damn well that by entering an ip on their list, of a sales department of a transit carrier, like they did with at least: tata and tiscali, that they are deliberately obstructing data communications and therefore violating any and all computer sabotage acts. as for the way in which they advertise their BGP feed. let's just say that we have BGP feeds as well. and we will use them AGAINST spamhaus again. (it's called an internet exchange you dummy ;) "we advise our peers to nullroute traffic to spamhaus or give a preferred route to one of our dns servers which always returns 127.0.0.2" :P we still kinda had it with their fuckery. they simply should roll over and die. if not they should get some help. fun fact: with all the 110 competing 'auto list / auto-de-list' dnsbls in the world, there never was -any- issue whatsoever... having cghq jew linford crying in the jew press that we would be 'spammers' may have worked to spread slander... however fact of the matter is that smtp is loong dead and we usually don't even read it, sometimes don't have servers for it, and in any case, blocked port 25 on all our networks by default ever since 2004. lolol. (who the FUCK still uses smtp anyway, and why the hell would 'abuse' of it be an excuse to disconnect paying customers - if any - as we certainly never could FIND any "spammers" that could afford our fees ;) what we see here is a CGHQ JTRIG operation (Spamhaus) trying to enforce UK laws and trade policy upon the rest of the internet, it has nothing to do with 'abuse' spamhaus is a political operation run by the jews at CGHQ. stophaus is a colation of cyberdivisions of armies fighting them. china, russia, and the republic cyberbunker have every right in the world to just nuke linford off the surface of this planet. and that's probably just what we should have done in the first fucking place. > I imagine SURBL does likewise. Other block lists probably have similar policies / inputs. > Simon > > >> The block time policies of RBLs >> *********************************** >> There are two main types of block lists: No automatic removal and >> automatic removal >> >> Is the policy to auto de-list after a period of time, still accurate? >> >> Considering the change in abuse patterns and technology, should the >> block times be increased or de-creased? >> >> Does society require more specialist non auto de-list DNSBLs? >> (Would it be helpful to law enforcement to have a "child pornography" >> dnsbl? or a phish dnsbl? - or is the reactive time to high in order >> for dynamic ipv4? - but on ipv6 allocations to devices could be more >> 'permanent'? etc) >> >> Andre >> >

5 22

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

although i can't see how you managed to obtain statistics on the number of emails being sent each day... unless spamhaus would like to admit that they also spy on dns requests to their dnsbl... which would lead to entirely different diplomatic issues... as quite a few government entities also send them queries every time a mail is received... perl -e "print ((510000+293000)*60*24)" 1156320000.. not considering that each of those posts (just photos and posts, not comments, chat, etc) reaches -multiple people- at the same time within a closed user group (friends, friends of friends) etc. and that's just facebook alone. maybe you included messages sent by your wrongly configured crond to root@ in your statistics haha. also: trying to push 250B messages through the fairly limited number of smtpds (Feel free to scan port 25 and count them for yourself) could turn out a bit hard... lol... postfix and sendmail are not exactly optimized for such things lolol. in the 1990s you would have had a point, in the 1990s we used smtp for every little shit from. "orders for the snackbar anyone" to "there is this guy here that wants this or that" - in as far as that wasn't done over irc. but those days are looong over. and smtp has been deliberately broken not to be reliable (graylisting) in terms of near-instant delivery. also i would like to see some statistics as to 'how much spam' all of those dnsbls, and spamhaus seperately did manage to stop, as scaring customers to the next isp won't stop them from what they're doing anyway. lolol.. also statistics on how many people after all that shit caused by spamhaus now have stopped using smtp alltogether because it never actually works anyway... 'you ahve sent a mail to the government of berlin but you are on spamhaus, goodbye'... fuck it, where is the fax machine. On 30 ينا, 2017 م 01:37, ox wrote: > On Mon, 30 Jan 2017 13:19:32 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> as for smtp being alive.. out of 4 billion ips some 200k run an smtp >> server... still a lot more than ftp (including badly configured >> printers and security cameras).. but considering it's a protocol that >> was supposed to run on each and every workstation. it's dead. >> >> facebook has more users per second than smtp has mails per year. lol. >> > https://zephoria.com/top-15-valuable-facebook-statistics/ > statistics, facts (after they happened) are so crazy, lol > > In 2015, the number of emails sent and received per day total over 205 > billion... > > in 2016 email/smtp = +8% lol > > and 2017 - looks to be even more hectic. - smtp maybe closer to 300 > billion (per day) or 109 Trillion emails per year...lol > > by 2020 we may be at 1000 trillion emails... > > how many users does facebook have per day. lol > >> On 30 ينا, 2017 م 01:13, ox wrote: >>> On Mon, 30 Jan 2017 13:01:46 +0000 >>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >>>> no not all dnsbls are a problem. none of the other ones block >>>> non-directly related prefixes as a means of extortion into complete >>>> breach of contract. there are some 110 of them last time we >>>> checked. we only were on the 2 operated by spamhaus. :P >>>> so by far... pretty much all dnsbl's list the ips that originate >>>> the 'undesired' traffic, which stops it from >>>> reaching those that use their service, and that's where it ends for >>>> them... that's perfectly acceptable. >>>> (as long as it's the actual end user making the decision to use >>>> their 'filtering' or not) >>>> >>> Okay, got it, thank you for that >>> >>>> howeverrrrr... then there is spamhaus... >>>> >>> yeah, but it will show good manners if you make a new thread about >>> that? >>> >>>> as for the ripe mailinglist being smtp... yes. it unfortunately >>>> still is.. and it's about the ONLY thing that still needs smtp, >>>> next to signing up to habbo hotel. lol. i haven't started the mail >>>> client for anything else in years. lol. face it: smtp is dead, the >>>> reason it is dead: is spamhaus itself. making it unreliable. >>>> mainly. >>>> >>> we will have to agree to disagree (or not agree - with the same >>> result :) ) >>> >>> smtp - 2017 my pov (and own stats) There has never been so much >>> legit traffic sent ever... >>> >>> Easy to check though as everyone on here has their own stats and to >>> quickly analize 25 vs say 80 (wow - and 443 is just as crazy in >>> terms of growth as 25!) in 2015 as compared to 2016 - smtp is >>> alive and kicking (so is 443!) >>> >>> Andre >>> >>

2 1

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

we currently have 5-6 lirs in active operation... basically just because of spamshit constantly trying to blackmail us into 'compliance' to their silly and illegal demands... do the math on ipv4 space going to waste. lol On 30 ينا, 2017 م 01:37, ox wrote: > On Mon, 30 Jan 2017 13:19:32 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> as for smtp being alive.. out of 4 billion ips some 200k run an smtp >> server... still a lot more than ftp (including badly configured >> printers and security cameras).. but considering it's a protocol that >> was supposed to run on each and every workstation. it's dead. >> >> facebook has more users per second than smtp has mails per year. lol. >> > https://zephoria.com/top-15-valuable-facebook-statistics/ > statistics, facts (after they happened) are so crazy, lol > > In 2015, the number of emails sent and received per day total over 205 > billion... > > in 2016 email/smtp = +8% lol > > and 2017 - looks to be even more hectic. - smtp maybe closer to 300 > billion (per day) or 109 Trillion emails per year...lol > > by 2020 we may be at 1000 trillion emails... > > how many users does facebook have per day. lol > >> On 30 ينا, 2017 م 01:13, ox wrote: >>> On Mon, 30 Jan 2017 13:01:46 +0000 >>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >>>> no not all dnsbls are a problem. none of the other ones block >>>> non-directly related prefixes as a means of extortion into complete >>>> breach of contract. there are some 110 of them last time we >>>> checked. we only were on the 2 operated by spamhaus. :P >>>> so by far... pretty much all dnsbl's list the ips that originate >>>> the 'undesired' traffic, which stops it from >>>> reaching those that use their service, and that's where it ends for >>>> them... that's perfectly acceptable. >>>> (as long as it's the actual end user making the decision to use >>>> their 'filtering' or not) >>>> >>> Okay, got it, thank you for that >>> >>>> howeverrrrr... then there is spamhaus... >>>> >>> yeah, but it will show good manners if you make a new thread about >>> that? >>> >>>> as for the ripe mailinglist being smtp... yes. it unfortunately >>>> still is.. and it's about the ONLY thing that still needs smtp, >>>> next to signing up to habbo hotel. lol. i haven't started the mail >>>> client for anything else in years. lol. face it: smtp is dead, the >>>> reason it is dead: is spamhaus itself. making it unreliable. >>>> mainly. >>>> >>> we will have to agree to disagree (or not agree - with the same >>> result :) ) >>> >>> smtp - 2017 my pov (and own stats) There has never been so much >>> legit traffic sent ever... >>> >>> Easy to check though as everyone on here has their own stats and to >>> quickly analize 25 vs say 80 (wow - and 443 is just as crazy in >>> terms of growth as 25!) in 2015 as compared to 2016 - smtp is >>> alive and kicking (so is 443!) >>> >>> Andre >>> >>

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

their entire concept of thinking is deliberately wrong... ip addresses do NOT identify people. so blacklists, will never work, especially not if you list half hte rest of the internet with that, to extort into disconnection, after which, the client simply moves elsewhere. doh. On 30 ينا, 2017 م 01:37, ox wrote: > On Mon, 30 Jan 2017 13:19:32 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> as for smtp being alive.. out of 4 billion ips some 200k run an smtp >> server... still a lot more than ftp (including badly configured >> printers and security cameras).. but considering it's a protocol that >> was supposed to run on each and every workstation. it's dead. >> >> facebook has more users per second than smtp has mails per year. lol. >> > https://zephoria.com/top-15-valuable-facebook-statistics/ > statistics, facts (after they happened) are so crazy, lol > > In 2015, the number of emails sent and received per day total over 205 > billion... > > in 2016 email/smtp = +8% lol > > and 2017 - looks to be even more hectic. - smtp maybe closer to 300 > billion (per day) or 109 Trillion emails per year...lol > > by 2020 we may be at 1000 trillion emails... > > how many users does facebook have per day. lol > >> On 30 ينا, 2017 م 01:13, ox wrote: >>> On Mon, 30 Jan 2017 13:01:46 +0000 >>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >>>> no not all dnsbls are a problem. none of the other ones block >>>> non-directly related prefixes as a means of extortion into complete >>>> breach of contract. there are some 110 of them last time we >>>> checked. we only were on the 2 operated by spamhaus. :P >>>> so by far... pretty much all dnsbl's list the ips that originate >>>> the 'undesired' traffic, which stops it from >>>> reaching those that use their service, and that's where it ends for >>>> them... that's perfectly acceptable. >>>> (as long as it's the actual end user making the decision to use >>>> their 'filtering' or not) >>>> >>> Okay, got it, thank you for that >>> >>>> howeverrrrr... then there is spamhaus... >>>> >>> yeah, but it will show good manners if you make a new thread about >>> that? >>> >>>> as for the ripe mailinglist being smtp... yes. it unfortunately >>>> still is.. and it's about the ONLY thing that still needs smtp, >>>> next to signing up to habbo hotel. lol. i haven't started the mail >>>> client for anything else in years. lol. face it: smtp is dead, the >>>> reason it is dead: is spamhaus itself. making it unreliable. >>>> mainly. >>>> >>> we will have to agree to disagree (or not agree - with the same >>> result :) ) >>> >>> smtp - 2017 my pov (and own stats) There has never been so much >>> legit traffic sent ever... >>> >>> Easy to check though as everyone on here has their own stats and to >>> quickly analize 25 vs say 80 (wow - and 443 is just as crazy in >>> terms of growth as 25!) in 2015 as compared to 2016 - smtp is >>> alive and kicking (so is 443!) >>> >>> Andre >>> >>

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

as smtp also leaks ip addresses which are nobody's fucking business on the application/user layer anyway all over the place, and we don't want spamhaus to 'connect some dots'... we simply obtain services ELSEWHERE. lol. which we can do over and over and over again should the need be there, as well as simply getting more BV/LTD/GMBH/IBCs and starting more lirs causing more 'burned ip space' thanks to spamhaus. yay. ay. lol. On 30 ينا, 2017 م 01:37, ox wrote:

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

as you can see all of their crap certainly never stopped me from sending any email if i feel the URGE to. (and that urge, i assure you, is only because ripe seems to think smtp is still relevant and uses it for every little shit where they should just use jabber or something like that). On 30 ينا, 2017 م 01:37, ox wrote: > On Mon, 30 Jan 2017 13:19:32 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> as for smtp being alive.. out of 4 billion ips some 200k run an smtp >> server... still a lot more than ftp (including badly configured >> printers and security cameras).. but considering it's a protocol that >> was supposed to run on each and every workstation. it's dead. >> >> facebook has more users per second than smtp has mails per year. lol. >> > https://zephoria.com/top-15-valuable-facebook-statistics/ > statistics, facts (after they happened) are so crazy, lol > > In 2015, the number of emails sent and received per day total over 205 > billion... > > in 2016 email/smtp = +8% lol > > and 2017 - looks to be even more hectic. - smtp maybe closer to 300 > billion (per day) or 109 Trillion emails per year...lol > > by 2020 we may be at 1000 trillion emails... > > how many users does facebook have per day. lol > >> On 30 ينا, 2017 م 01:13, ox wrote: >>> On Mon, 30 Jan 2017 13:01:46 +0000 >>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >>>> no not all dnsbls are a problem. none of the other ones block >>>> non-directly related prefixes as a means of extortion into complete >>>> breach of contract. there are some 110 of them last time we >>>> checked. we only were on the 2 operated by spamhaus. :P >>>> so by far... pretty much all dnsbl's list the ips that originate >>>> the 'undesired' traffic, which stops it from >>>> reaching those that use their service, and that's where it ends for >>>> them... that's perfectly acceptable. >>>> (as long as it's the actual end user making the decision to use >>>> their 'filtering' or not) >>>> >>> Okay, got it, thank you for that >>> >>>> howeverrrrr... then there is spamhaus... >>>> >>> yeah, but it will show good manners if you make a new thread about >>> that? >>> >>>> as for the ripe mailinglist being smtp... yes. it unfortunately >>>> still is.. and it's about the ONLY thing that still needs smtp, >>>> next to signing up to habbo hotel. lol. i haven't started the mail >>>> client for anything else in years. lol. face it: smtp is dead, the >>>> reason it is dead: is spamhaus itself. making it unreliable. >>>> mainly. >>>> >>> we will have to agree to disagree (or not agree - with the same >>> result :) ) >>> >>> smtp - 2017 my pov (and own stats) There has never been so much >>> legit traffic sent ever... >>> >>> Easy to check though as everyone on here has their own stats and to >>> quickly analize 25 vs say 80 (wow - and 443 is just as crazy in >>> terms of growth as 25!) in 2015 as compared to 2016 - smtp is >>> alive and kicking (so is 443!) >>> >>> Andre >>> >>

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

as for smtp being alive.. out of 4 billion ips some 200k run an smtp server... still a lot more than ftp (including badly configured printers and security cameras).. but considering it's a protocol that was supposed to run on each and every workstation. it's dead. facebook has more users per second than smtp has mails per year. lol. On 30 ينا, 2017 م 01:13, ox wrote: > On Mon, 30 Jan 2017 13:01:46 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> no not all dnsbls are a problem. none of the other ones block >> non-directly related prefixes as a means of extortion into complete >> breach of contract. there are some 110 of them last time we checked. >> we only were on the 2 operated by spamhaus. :P >> so by far... pretty much all dnsbl's list the ips that originate the >> 'undesired' traffic, which stops it from >> reaching those that use their service, and that's where it ends for >> them... that's perfectly acceptable. >> (as long as it's the actual end user making the decision to use their >> 'filtering' or not) >> > Okay, got it, thank you for that > >> howeverrrrr... then there is spamhaus... >> > yeah, but it will show good manners if you make a new thread about > that? > >> as for the ripe mailinglist being smtp... yes. it unfortunately still >> is.. and it's about the ONLY thing that still needs smtp, next to >> signing up to habbo hotel. lol. i haven't started the mail client for >> anything else in years. lol. face it: smtp is dead, the reason it is >> dead: is spamhaus itself. making it unreliable. mainly. >> > we will have to agree to disagree (or not agree - with the same > result :) ) > > smtp - 2017 my pov (and own stats) There has never been so much legit > traffic sent ever... > > Easy to check though as everyone on here has their own stats and to > quickly analize 25 vs say 80 (wow - and 443 is just as crazy in terms of > growth as 25!) in 2015 as compared to 2016 - smtp is alive and kicking > (so is 443!) > > Andre >

2 1

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

no not all dnsbls are a problem. none of the other ones block non-directly related prefixes as a means of extortion into complete breach of contract. there are some 110 of them last time we checked. we only were on the 2 operated by spamhaus. :P so by far... pretty much all dnsbl's list the ips that originate the 'undesired' traffic, which stops it from reaching those that use their service, and that's where it ends for them... that's perfectly acceptable. (as long as it's the actual end user making the decision to use their 'filtering' or not) howeverrrrr... then there is spamhaus... which goes 'oh on 1.2.3.4 is a website of which the url was mentioned in some UCE', let's list 1.2.3.4 and demand complete disconnection at the isp, if they don't do it we list 1.2.3.0/24, if they still don't cooperate with us we'll run some traceroutes and sh ip bgps and see who suppliers their isp with most of their transit and list their networks as well. (and -those- usually -do- use smtp ;) as for 194.109/16. that ain't ours. lol. you didn't actually think i was gonna disclose OUR front operations' prefixes to spamhaus again right? lol. (plus you'll be hard pushed to find an smtp server on any of those anyway - it's obsolete...;) as for the ripe mailinglist being smtp... yes. it unfortunately still is.. and it's about the ONLY thing that still needs smtp, next to signing up to habbo hotel. lol. i haven't started the mail client for anything else in years. lol. face it: smtp is dead, the reason it is dead: is spamhaus itself. making it unreliable. mainly. On 30 ينا, 2017 م 12:52, ox wrote: > On Mon, 30 Jan 2017 12:30:13 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> now, please take your shitty nagging about 'abuse' of your crappy >> silly old smtp protocol, which doesn't even -originate- from our >> networks in the first fucking place, and stick it where the sun >> doesn't shine... as for malware... windows is the malware there... it > <snip snip> > > You are obviously an intelligent person and I am sure you have a lot to > contribute to an emailing list discussing abuse involving smtp where > you have subscribed using smtp, etc etc. > > What would really help (instead of simply /dev/null) would be some type > of structure to your rantings as some of it seems actually valuable and > important but it is mixed in with so much bullshit that it is too much > work and effort to separate the shit from the gold. > > Is your problem with RBL's in general? - Are you saying that all DNSBL > is evil? or just Spamhaus? You obviously have not nulled all 25 - as > poc of your 194.109.24.25:25 is well functional :) > > Also, maybe for clarity - Not all DNSBL uses pre emtive blocking, as we > established Simon Forster said that "All DNSBL are not the same" > > Sorry to be asking something which you may already have said in your > long rants somewhere, just that it will take too long to read all the crap > you wrote - easier to just ask :) > > Andre > > >

2 1

Re: [anti-abuse-wg] RBL policy
by Simon Forster 30 Jan '17

30 Jan '17

> On 30 Jan 2017, at 06:13, ox <andre(a)ox.co.za> wrote: > > Hello All, > > May I please solicit some comments about Abuse Block lists > (Without detracting from RFC 5782 and RFC 6471 or : > https://www.ripe.net/publications/docs/ripe-409 ) > > Firstly, the background for the start of this thread is simply: As the > use of machine learning technology is now also applied and adapted for > the use of cyber criminals (including spammers, scammers, etc) the > rules and what is socially acceptable is and has changed. Global > politics, protectionism, nationalism and the other 'isms' are also > causing change. > > Considering that DNSBL tech is "reactive" (after he abuse) This statement appears to be exclusionary — and is one often levelled against DNSBLs. All DNSBLs are not wholly reactive. Firstly, one needs to acknowledge that all DNSBLs are not they same. Secondly, some listings in some DNSBLs are proactive. i.e. Made before abuse is seen. As I work for the commercial arm of Spamhaus, I know their offerings quite well and can confidently state that some of the Spamhaus block lists contain proactive and/or precautionary listings. I imagine SURBL does likewise. Other block lists probably have similar policies / inputs. Simon > The block time policies of RBLs > *********************************** > There are two main types of block lists: No automatic removal and > automatic removal > > Is the policy to auto de-list after a period of time, still accurate? > > Considering the change in abuse patterns and technology, should the > block times be increased or de-creased? > > Does society require more specialist non auto de-list DNSBLs? > (Would it be helpful to law enforcement to have a "child pornography" > dnsbl? or a phish dnsbl? - or is the reactive time to high in order > for dynamic ipv4? - but on ipv6 allocations to devices could be more > 'permanent'? etc) > > Andre >

2 3

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by Sergey 30 Jan '17

30 Jan '17

There is no such country as 'the republic cyberbunker'. On 01/30/17 14:26, HRH Prince Sven Olaf von CyberBunker wrote: > > the republic cyberbunker nor the countries in which the customers > operate have laws against viagra. too bad for the uk and their spamhaus. > > > On 30 ينا, 2017 ص 11:06, Sergey wrote: >> >> And you earn money on those who send offers for viagra. Let's talk >> turkey. >> >> >> On 01/30/17 14:00, HRH Prince Sven Olaf von CyberBunker wrote: >>> let's make one thing absolutely clear: if your 1960s instant >>> messenger of choice (smtp) doesn't have >>> a friends list, therefore is full of strangers sending you offers >>> for viagra... that is YOUR problem. >>> you either fix YOUR protocol of choice to have, for example, a >>> friends list, OR you gtfo and stop using it.. none of which is OUR >>> problem.. we OWN the internet, we have nothing to do with whatever the >>> hell goes on on your silly old protocol. it's not even 'abuse'. if >>> you get UCE it's working as documented. >>> >>> hate to break the news to you but we won't pull any single plugs >>> just people advertise some urls >>> in antique smtp shit... lolol. just let it die. problem solved. >>> >>> >>> On 30 ينا, 2017 ص 10:53, HRH Prince Sven Olaf von CyberBunker wrote: >>>> >>>> >>>> >>>> >>>> -------- Forwarded Message -------- >>>> Subject: Re: [anti-abuse-wg] RBL policy >>>> Date: Mon, 30 Jan 2017 10:51:40 +0000 >>>> From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> >>>> Organization: Republic CyberBunker >>>> To: Simon Forster <simon-lists(a)ldml.com> >>>> >>>> >>>> >>>> On 30 ينا, 2017 ص 09:39, Simon Forster wrote: >>>> >> On 30 Jan 2017, at 06:13, ox<andre(a)ox.co.za> wrote: >>>> >> >>>> >> Hello All, >>>> >> >>>> >> May I please solicit some comments about Abuse Block lists >>>> >> (Without detracting from RFC 5782 and RFC 6471 or : >>>> >>https://www.ripe.net/publications/docs/ripe-409 ) >>>> >> >>>> >> Firstly, the background for the start of this thread is simply: As the >>>> >> use of machine learning technology is now also applied and adapted for >>>> >> the use of cyber criminals (including spammers, scammers, etc) the >>>> >> rules and what is socially acceptable is and has changed. Global >>>> >> politics, protectionism, nationalism and the other 'isms' are also >>>> >> causing change. >>>> >> >>>> >> Considering that DNSBL tech is "reactive" (after he abuse) >>>> > This statement appears to be exclusionary — and is one often levelled against DNSBLs. All DNSBLs are not wholly reactive. >>>> > >>>> > Firstly, one needs to acknowledge that all DNSBLs are not they same. >>>> > >>>> > Secondly, some listings in some DNSBLs are proactive. i.e. Made before abuse is seen. As I work for the commercial arm of Spamhaus, I know their offerings quite well and can confidently state that some of the Spamhaus block lists contain proactive and/or precautionary listings. >>>> > >>>> >>>> > to be exact: the criminal organisation spamhaus their illegal blacklists effected some 20 million ips on our last scan of their entire database contents. (although that's a bit hard to do, as named kept crashing running 24 cores of gethostbyname() on 10ge , so we may have missed a few million here and there) >>>> at a simultanious portscan of the entire ipv4 internet, it turned out >>>> there were only some 200000 smtp servers left however. >>>> > that leads to the conclusion that 99% of the listings is purely there for blackmail purposes, and has nothing to do with your silly old SMTP protocol AT ALL. the only reason to list those others is to put pressure on people to 1: spend manhours on interacting with the (non-sollicited) spamhaus 'organisation' and 2: illegally force people into breach of contract with their clients. >>>> >>>> listing sales department networks of transit carriers to breach national >>>> carriers and connected hosting farms into breach of contract with a >>>> customer, of which steve linford does not like the CONTENT on the >>>> website, kinda, fucks up statistics ay. >>>> >>>> face it: smtp is dead, and needs no 'protection' at all.. also ip >>>> addresses identify nodes in a network, not people. >>>> >>>> also: forcing people to contact spamhaus, causes manhours to be spent on >>>> communication, which is extortion, as we have no contractual relation >>>> with spamhaus whatsoever, so trying to force carriers and isps into >>>> communication with them, is a crime. (although only punishable by 3 >>>> months in .nl ;) >>>> >>>> the 'we don't block anything' argument doesn't go. spamhaus advertises >>>> the fact that they have influence on roughly 1/3rd of mail delivery so >>>> they know damn well that by entering an ip on their list, of a sales >>>> department of a transit carrier, like they did with at least: tata and >>>> tiscali, that they are deliberately obstructing data communications and >>>> therefore violating any and all computer sabotage acts. >>>> >>>> as for the way in which they advertise their BGP feed. let's just say >>>> that we have BGP feeds as well. and we will use them AGAINST spamhaus >>>> again. (it's called an internet exchange you dummy ;) "we advise our >>>> peers to nullroute traffic to spamhaus or give a preferred route to one >>>> of our dns servers which always returns 127.0.0.2" :P >>>> >>>> we still kinda had it with their fuckery. >>>> >>>> they simply should roll over and die. if not they should get some help. >>>> >>>> fun fact: with all the 110 competing 'auto list / auto-de-list' dnsbls >>>> in the world, there never was -any- issue whatsoever... >>>> >>>> having cghq jew linford crying in the jew press that we would be >>>> 'spammers' may have worked to spread slander... however fact of the >>>> matter is that smtp is loong dead and we usually don't even read it, >>>> sometimes don't have servers for it, and in any case, blocked port 25 on >>>> all our networks by default ever since 2004. lolol. (who the FUCK still >>>> uses smtp anyway, and why the hell would 'abuse' of it be an excuse to >>>> disconnect paying customers - if any - as we certainly never could FIND >>>> any "spammers" that could afford our fees ;) >>>> >>>> what we see here is a CGHQ JTRIG operation (Spamhaus) trying to enforce >>>> UK laws and trade policy upon the rest of the internet, it has nothing >>>> to do with 'abuse' spamhaus is a political operation run by the jews at >>>> CGHQ. >>>> >>>> stophaus is a colation of cyberdivisions of armies fighting them. china, >>>> russia, and the republic cyberbunker have every right in the world to >>>> just nuke linford off the surface of this planet. and that's probably >>>> just what we should have done in the first fucking place. >>>> >>>> > I imagine SURBL does likewise. Other block lists probably have similar policies / inputs. >>>> > Simon >>>> > >>>> > >>>> >> The block time policies of RBLs >>>> >> *********************************** >>>> >> There are two main types of block lists: No automatic removal and >>>> >> automatic removal >>>> >> >>>> >> Is the policy to auto de-list after a period of time, still accurate? >>>> >> >>>> >> Considering the change in abuse patterns and technology, should the >>>> >> block times be increased or de-creased? >>>> >> >>>> >> Does society require more specialist non auto de-list DNSBLs? >>>> >> (Would it be helpful to law enforcement to have a "child pornography" >>>> >> dnsbl? or a phish dnsbl? - or is the reactive time to high in order >>>> >> for dynamic ipv4? - but on ipv6 allocations to devices could be more >>>> >> 'permanent'? etc) >>>> >> >>>> >> Andre >>>> >> >>>> > >>>> >>> >> >> -- >> Kind regards, >> CTO at >> *Foton Telecom CJSC* >> Tel.: +7 (499) 679-99-99 >> AS42861 on PeeringDB <http://as42861.peeringdb.com/>, Qrator >> <https://radar.qrator.net/as42861>, BGP.HE.NET >> <http://bgp.he.net/AS42861> > -- Kind regards, CTO at *Foton Telecom CJSC* Tel.: +7 (499) 679-99-99 AS42861 on PeeringDB <http://as42861.peeringdb.com/>, Qrator <https://radar.qrator.net/as42861>, BGP.HE.NET <http://bgp.he.net/AS42861>

2 1

RBL policy
by ox 30 Jan '17

30 Jan '17

Hello All, May I please solicit some comments about Abuse Block lists (Without detracting from RFC 5782 and RFC 6471 or : https://www.ripe.net/publications/docs/ripe-409 ) Firstly, the background for the start of this thread is simply: As the use of machine learning technology is now also applied and adapted for the use of cyber criminals (including spammers, scammers, etc) the rules and what is socially acceptable is and has changed. Global politics, protectionism, nationalism and the other 'isms' are also causing change. Considering that DNSBL tech is "reactive" (after he abuse) The block time policies of RBLs *********************************** There are two main types of block lists: No automatic removal and automatic removal Is the policy to auto de-list after a period of time, still accurate? Considering the change in abuse patterns and technology, should the block times be increased or de-creased? Does society require more specialist non auto de-list DNSBLs? (Would it be helpful to law enforcement to have a "child pornography" dnsbl? or a phish dnsbl? - or is the reactive time to high in order for dynamic ipv4? - but on ipv6 allocations to devices could be more 'permanent'? etc) Andre

1 0

abuse-c implementation
by ripedenis＠yahoo.co.uk 16 Jan '17

16 Jan '17

Colleagues We have started a discussion on the Database Working Group mailing list about resolving the issues with the "abuse-c:" implementation. We are currently identifying the issues and finalising the problem statement. If you would like to join this discussion it would help if you can do so on the DB WG mailing list, then it is all kept in one place. You can find the start of this discussion here:https://www.ripe.net/ripe/mail/archives/db-wg/2017-January/005492.html cheersdenisco-chair DB-WG

1 0