January 2020 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Massive prefix theft in AFRINIC - attributed to an insider
by Michele Neylon - Blacknight 15 Apr '20

15 Apr '20

Great work from Ron Sad to see this happen, though it was to be expected considering how much IPs are now worth -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 04/12/2019, 19:43, "anti-abuse-wg on behalf of Suresh Ramasubramanian" <anti-abuse-wg-bounces(a)ripe.net on behalf of ops.lists(a)gmail.com> wrote: Congratulations, Ron Guilmette. You’ve been doing this for years and this is your biggest success yet. https://mybroadband.co.za/news/internet/330379-how-internet-resources-worth… tl;dr - The insider is apparently Ernest Byaruhanga, AFRINIC employee #2, and he has now separated from AFRINIC --srs

4 4

The Great AFRINIC Heist -- The Enablers
by Ronald F. Guilmette 30 Jan '20

30 Jan '20

As the primary investigator pursuing this case, I have invested more than a little effort into continuing to track what has been going on as AFRINIC attempts to remediate the effects of these thefts. I would like now to provide you all with some insight into the current situation and status relating to the affected stolen AFRINIC blocks and the multiple parties in your own region who are continuing, at present, to provide routing to the various bits and pieces of the stolen AFRINIC IPv4 space. My hope, of course, is that you will all join with me in trying to persuade these networks to cease all routing to all of the stolen AFRINIC address space. A full list of all of the stolen AFRINIC blocks that are still of ongoing concern at the present moment is available here: https://pastebin.com/raw/71zNNriB Note that many of the blocks listed at the link above have already been "reclaimed" as far as the AFRINIC WHOIS records are concerned. But because routing remains almost entirely decoupled from RIR WHOIS data bases, much of this "reclaimed" space is still being routed as I write this. The only difference is that now the space is being routed as bogons, rather than as "legitimately" allocated space. A summary of all of the current routing for all of the stolen AFRINIC IPv4 address space that is still of concern (including routing for recently reclaimed address space that AFRINIC will eventually be returning to its free pool) is provided below. This list is sorted by the number of constituent stolen /24 blocks being routed by each listed network, thus showing the most major offenders at the top. A few footnotes concerning specific ASNs in this list follow below the listing. I urge everyone on this mailing list to share this data as widely as possible in and among the global networking community. In all cases noted below, the networks in question are unambiguously routing IP blocks that were obtained, in the first instance, via thefts perpetrated by one or more AFRINIC insiders and then resold on the black market in secretive deals. In many and perhaps most cases listed below, the relevant networks appear to have been more than happy to accept some cash in exchange for their services, while not looking all that carefully at the purported (but fradulent) "LOA" documents that they were given in order to persuade them to announce routes to stolen IP space. (Repeated use of blatantly fradulent documents has been one of the consistant features of this entire ongoing criminal enterprise.) I would also like to request the assistance of every person on this mailing list in the task of informing all of the networks that are mentioned in the list below, and that are within your own geographic region, that they are each currently announcing routes to stolen IP space. Of course, it is my hope that you will also encourage them, in no uncertain terms, to stop doing this immediately, if not sooner. As you can see below, this Internet crime spree is a globe-spanning and ongoing disaster. There is no way that I can get all of this mess cleaned up on my own. I am therefore relying on all people of honesty and good will, in all regions, to assist me in getting the word to the networks mentioned below, and telling them, very directly, that they are each facilitating a colossal fraud that affects the whole of the global Internet community. (I know for a fact that there is ongoing criminal activity which is being perpetrated from at least some of this provably stolen IP address space, so it is in the self interest of every honest netizen to get this all turned off and shut down.) All routing data is derived from current data published by RIPEstat. ====================================================================== 3719 0 ?? UNROUTED IP SPACE 629 132165 PK Connect Communication 512 18013 HK Asline Limited 504 19969 US Joe's Datacenter, LLC 500 62355 CO Network Dedicated SAS 423 202425 SC IP Volume inc 286 58895 PK Ebone Network (PVT.) Limited 250 136525 PK Wancom (Pvt) Ltd. 192 18530 US Isomedia, Inc. 186 9009 GB M247 Ltd 134 262287 BR Maxihost LTDA 132 204655 NL Novogara LTD 79 132116 IN Ani Network Pvt Ltd 75 136384 PK Optix Pakistan (Pvt.) Limited 68 132422 HK Hong Kong Business Telecom Limited 60 137443 HK Anchnet Asia Limited 48 63956 AU Colocation Australia Pty Ltd 26 132335 IN LeapSwitch Networks Pvt Ltd 21 131284 AF Etisalat Afghan 20 139043 PK WellNetworks (Private) Limited 19 43092 JP OSOA Corporation., LTD 17 36351 US SoftLayer Technologies Inc. 16 56611 NL REBA Communications BV 16 199267 IL Netstyle A. Ltd 16 23679 ID Media Antar Nusa PT. 14 137085 IN Nixi 10 63018 US Dedicated.com 9 136782 JP Pingtan Hotline Co., Limited 8 45671 AU Servers Australia Pty. Ltd 8 57717 NL FiberXpress BV 7 49335 RU LLC "Server v arendy" 7 134451 SG NewMedia Express Pte Ltd 6 49367 IT Seflow S.N.C. Di Marco Brame' & C. 6 26754 ?? {{unknown organization}} 5 198504 AE Star Satellite Communications Company - PJSC 5 198381 AE Star Satellite Communications Company - PJSC 4 38001 SG NewMedia Express Pte Ltd 4 263812 AR TL Group SRL ( IPXON Networks ) 4 30827 GB Extraordinary Managed Services Ltd 4 42831 GB UK Dedicated Servers Limited 4 37200 NG SimbaNET Nigeria Limited 4 133495 PK Vision telecom Private limited 4 198394 AE Star Satellite Communications Company - PJSC 2 44066 DE First Colo GmbH 2 198247 AE Star Satellite Communications Company - PJSC 2 133933 PK NetSat Private Limited 2 328096 UG truIT Uganda Limited 2 38713 PK Satcomm (Pvt.) Ltd. 2 31122 IE Digiweb ltd 2 46562 US Total Server Solutions L.L.C. 2 13737 US Riverfront Internet Systems LLC 2 11990 US Unlimited Net, LLC 2 20860 GB Iomart Cloud Services Limited 2 45382 KR Ehostict 2 17216 US Dc74 Llc 2 16637 ZA Mtn Sa 2 53999 CA Priority Colo Inc 1 23470 US ReliableSite.Net LLC 1 35074 NG Cobranet Limited 1 19832 ZA Link Data Group 1 43945 IL Netstyle A. Ltd 1 134917 IN Ragsaa Communication pvt. ltd. 1 203833 DE First Colo GmbH ====================================================================== The actual current route announcements corresponding to all of the above are listed in the table given here, which is sorted by ASN: https://pastebin.com/raw/XQyJ8EK2 Footnotes: [1] AS62355 gives all indications of being a false front fradulent network, possibly one that was set up by one or more of the black market dealers involved in this case. There is no actual web site associated with its contact domain (networkdedicated.com) at present, the alleged contact phone number in the associated AS WHOIS record was non-working when I tried it, and the street address given for this entity in Bogotá, Columbia, is one that Google maps cannot locate. Traceroutes to the one and only IPv4 block that is being routed by this AS and that is actually registed to the company itself (185.39.8.0/22 -- issued by RIPE NCC) do not terminate in Columbia, South America, as one would expect based on the WHOIS, but rather such traceroutes dead-end somwhere on the network of core-backbone.com (Core-Backbone GmbH, Germany) in the general vicinity of Amsterdam, Netherlands. Please note also that AS62355 appears to be a "leaf" ASN which is connected to the Internet only via AS202425, IP Volume, Ltd. -- Seyhelles. (See below.) https://bgp.he.net/AS62355 [2] The networks of AS202425 (IP volume, Inc. - Seychelles), AS204655 (Novogara, Ltd. - Netherlands), AS56611 (REBA Communications BV - Netherlands), and AS57717 (FiberXpress BV - Netherlands), are all believed by me to be onwed and controled by a certain pair of Dutch gentlemen named Mr. Ferdinand Reinier Van Eeden and Mr. Bartholomeus Johannes ("Bap") Karreman, both of whom I have previously posted about to the NANOG mailing list. For more information on these characters, please google for "Ecatel" and/or "Quasi Networks". Both of those are, I believe, demonstratably the predecessors of what is nowadays being called "IP volume, Inc." [3] AS199267 (Netstyle A. Ltd. - Israel) and AS43945 (Netstyle A. Ltd. - Israel) belongs to the Israeli gentleman featured in Jan Vermeulen's detailed December 4th report on this whole AFRINIC caper. This is the specific fellow who has been going around passing out fradulent LOAs of such shockingly low quality that one wonders why he even bothers. (But I guess they work well enough in the case of many cash-starved networks hungry fo new customers.) [4] AS26754 was formerly an AFRINIC-assigned ASN which was assigned to the entirely fictitious business entity called "ITC'. That entity appears to have just been an imaginary concoction of Mr. Ernest Byaruhanga, formerly a senior employee of AFRINIC (and now the target of an ongoing crimininal investigation) and/or other AFRINIC insiders who worked with or along side Mr. Byaruhanga to criminally strip assets from AFRINIC and its legacy block holders. The registration for this AS number has now been withdrawn by AFRINIC, thus rendering the ASN itself a bogon. [5] AS19832 ("Link Data Group") is yet another fiction that was manufactured out of (nearly) whole cloth, either by Mr. Byaruhanga and/or by other AFRINIC insiders who were working with him. It is not immediately clear why this ASN is still registered, let alone why its route announcements are still being accepted or propagated anywhere.

1 0

ORG-DTL20-RIPE
by Ronald F. Guilmette 29 Jan '20

29 Jan '20

46.3.0.0/16 46.232.0.0/17 80.243.128.0/20 149.126.192.0/18 https://bgp.he.net/AS55933#_prefixes https://bgp.he.net/AS207636#_prefixes

1 0

Re: [anti-abuse-wg] [routing-wg] AS12679 -- 206.195.224.0/19
by Ronald F. Guilmette 29 Jan '20

29 Jan '20

In message <CACWOCC-=kRCxGMO7sodDBWXM9o9kFbdeKW+RK9B1Tihf7cWDOA(a)mail.gmail.com>, Job Snijders <job(a)instituut.net> wrote: >All snide aside, did you report this prefix=E2=80=99s current state to ARIN > through >their fraud form? If not, I'm happy to do so. Negative. I did not do so and I shall not do so. Like all of the RIRs, ARIN's forms and their procedures for dealing with these kinds of issues are, by intent, black holes. I give them the product of my hard work and my diligent effort and research and what do I get back? Do I get a bug bounty? No. Do I get a 10% finders fee for finding the facts that allow some block to be returned to its rightful (legacy) owner or to the RIR free pool? No. Do I get any kind of reward whatsoever? No. Do I at least get a courtesy follow-up after a certain period of time has elapsed, telling me whether they think I am right or wrong? NO! I don't get squat! I don't get either a confirmation, or a rebuttal. In fact I don't get anything at all. I don't even get a polite thank you. But let's just forget about that. Do you really think that me filling some bloody stupid form is really going to chage the process -or- the outcomes? Do you seriously think that YOU filling out the form will have any better effect? If so, I'm going to have to ask you to defend that belief in light of the known facts. Do you really think that ARIN is utterly ignorant about this, even though I got an on-the-record ``no comment'' comment directly from John Curran about it before I even posted it? https://mailman.nanog.org/pipermail/nanog/2019-August/102791.html If not, then how do you explain the fact that after 5 months ARIN hasn't lifted a finger to do a damn thing about it? Looking forward to you explaining this to me Job. I'm all ears. Regards, rfg P.S. I don't need to seek out any web forms or any RIR if I want to experience first-hand this level of lethargic and studied inaction. As I like to tell people, if I ever want to experience this kind of utter lack of productive activity... well... I have relatives for that!

2 3

The curious case of 159.174.0.0/16
by Ronald F. Guilmette 29 Jan '20

29 Jan '20

Just posted: https://mailman.nanog.org/pipermail/nanog/2020-January/105672.html

1 0

AS12679 -- 206.195.224.0/19
by Ronald F. Guilmette 27 Jan '20

27 Jan '20

Thrift Drug, Inc. of Pennsylvania was bought out in October, 1996 by the Rite Aid pharmacy chain (US): https://www.riteaid.com/corporate/news/-/pressreleases/news-room/1996/rite-… https://en.wikipedia.org/wiki/Thrift_Drug https://opencorporates.com/companies/us_pa/2002644 Unfortunately, the parent company, Rite Aid, never got the memo to tell that that Thrify Drug, Inc owned the legacy IPv4 block 206.195.224.0/19. The results were predictable. This /19 has been repeatedly squatted on in recent years, as shown by RIPEstat: https://stat.ripe.net/widget/routing-history#w.resource=206.195.224.1 2016-08-15 AS42861 RU Foton Telecom, CJSC Network Operation Centre 2017-12-08 AS65075 -- {{reserved ASN}} 2018-03-26 AS28191 BR Jupiter Telecomunicacoes e Informatica Ltda 2019-08-24 AS20473 US Choopa, LLC 2019-10-11 AS12679 RU Iceberg Telecom Ltd. The 206.195.224.0/19 block is currently being squatted on by AS12679, Iceburg Telecom (Moscow). It appears that this ASN is also and likewise squatting on a great number of other blocks as well: https://bgp.he.net/AS12679#_prefixes AS12679 (Iceburg) appears to be a "leaf" ASN, connected to the public Internet only via AS25227 (Avantel, Close Joint Stock Company, Moscow) which it turn appears to be getting more than 3/4ths of its own IPv4 connectivity from AS9002 (RETN): https://bgp.he.net/AS25227 Suggest filtering all route announcements from both AS12679 -and- also AS25227 until they each decide if they would like to be part of the civilized internet. ====================================================================== [Source: whois://whois.arin.net 2020-01-27 04:18:39 UTC] NetRange: 206.195.224.0 - 206.195.255.255 CIDR: 206.195.224.0/19 NetName: THRIFT-NET-1 NetHandle: NET-206-195-224-0-1 Parent: NET206 (NET-206-0-0-0-0) NetType: Direct Assignment OriginAS: AS12679 Organization: Thrift Drug, Inc. (THRIFT) RegDate: 1995-08-03 Updated: 2019-09-24 Ref: https://rdap.arin.net/registry/ip/206.195.224.0 OrgName: Thrift Drug, Inc. OrgId: THRIFT Address: 100 Delta Drive City: Pittsburgh StateProv: PA PostalCode: 15238 Country: US RegDate: 1994-03-15 Updated: 2019-08-14 Ref: https://rdap.arin.net/registry/entity/THRIFT OrgAbuseHandle: WEBBK16-ARIN OrgAbuseName: Webb, Kristi OrgAbusePhone: +1-885-923-1290 OrgAbuseEmail: kwebb(a)thriftdrug.org OrgAbuseRef: https://rdap.arin.net/registry/entity/WEBBK16-ARIN OrgTechHandle: WEBBK16-ARIN OrgTechName: Webb, Kristi OrgTechPhone: +1-885-923-1290 OrgTechEmail: kwebb(a)thriftdrug.org OrgTechRef: https://rdap.arin.net/registry/entity/WEBBK16-ARIN

2 6

Periodic Reminder: List Conduct
by Brian Nisbet 21 Jan '20

21 Jan '20

Colleagues, It seems that at some point in every large list discussion I am compelled to send a mail of this type. This is not in response to any single mail, rather it is a reminder to all. Please remember to conduct yourselves well on this list, to discuss the matter at hand and not to attack the person writing the email. Most of the list discussion takes place in the appropriate manner, but I realise that when we're discussing matters about which any of us are passionate we can forget this. Ad hominem attacks, general slights, unfounded accusations, and many other things do not contribute to the list discussion. The Co-Chairs can't tell you not to send them by private mail (albeit we'd greatly prefer you didn't) nor to act in this manner in other for a (albeit we'd prefer if you didn't do that either), but we can tell you not to do it here, so please don't. Thank you all for your interest and passion for this subject. Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

8 11

@EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox")
by Marcolla, Sara Veronica 20 Jan '20

20 Jan '20

Very well put, Sérgio. Thank you for voicing clearly the concern of (at least a part of) the community. We should not forget that, according to the provisions of RIPE NCC audits, “every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of the RIPE NCC services and to assist the RIPE NCC with audits and security checks”. Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general. If the community does not agree that everyone has the right to a safe, spam free, crime free Internet, maybe we have some issue to solve here first. Kind regards, Sara Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of Sérgio Rocha Sent: 16 January 2020 13:38 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") Hi, Agree, This anti-abuse list seems the blocking group to any anit-abuse response measure. It's amazing that nobody cant propose anything without receiving a shower of all sorts of arguments against There is an idea that everyone has to hold, if as a community we cannot organize a policy, one of these days there will be a problem that will make governments take the opportunity to legislate and we will no longer have the free and open internet. There are a feew ideas that is simple to understand: 1 - If you have been assigned a network you have responsibilities, paying should not be the only one. 2 - There is no problem with email, since ever are made solutions to integrate with emails. There is no need to invent a new protocol. Who has a lot of abuse, invests in integrating these emails. 3 - If you have no ability to manage abuse should not have addressing, leave it to professionals. The internet is critical for everyone, the ability for actors to communicate with each other to respond to abuse must exist and RIPE must ensure that it exists. It’s like the relation with local governments, there is a set of information that has to be kept up to date to avoid problems, in RIPE it must be the same. Sergio From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Fi Shing Sent: 16 de janeiro de 2020 04:55 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") >> Best not to judge the race until it has been fully run. I just do not understand how anyone on this list (other than a criminal or a business owner that wants to reduce over heads by abolishing an employee who has to sit and monitor an abuse desk) could be talking about making it easier for abuse to flourish. It is idiotic and is not ad hominem. This list is filled with people who argue for weeks, perhaps months, about the catastrophic world ending dangers of making an admin verify an abuse address ONCE a year .... and then someone says "let's abolish abuse desk all together" and these idiots emerge from the wood work like the termites that they are and there's no resistance? The good news is that nothing talked about on this list is ever implemented, so .. talk away you criminals. --------- Original Message --------- Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com<mailto:rfg@tristatelogic.com>> Date: 1/16/20 11:47 am To: "anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>" <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> In message <20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@ email19.asia.godaddy.com<mailto:20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@%0bemail19.asia.godaddy.com>>, "Fi Shing" <phishing(a)storey.xxx<mailto:phishing@storey.xxx>> wrote: >That is the most stupid thing i've read on this list. Well, I think you shouldn't be quite so harsh in your judgement. It is not immediately apparent that you have been on the list for all that long. So perhaps you should stick around for awhile longer before making such comments. If you do, I feel sure that there will be any number of stupider things that may come to your attention, including even a few from your's truly. Best not to judge the race until it has been fully run. >Which criminal is paying you to say this nonsense, because no ordinary person >that has ever received a spam email would ever say such crap. I would also offer the suggestion that such inartful commentary, being as it is, ad hominem, is not at all likely to advance your agenda. It may have felt good, but I doubt that you have changed a single mind, other than perhaps one or two who will now be persuaded to take the opposing position, relative to whatever it was that you had hoped to achieve. Regards, rfg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

12 27

Fw: working in new version of 2019-04 (Validation of "abuse-mailbox")
by ripedenis＠yahoo.co.uk 17 Jan '20

17 Jan '20

Yes of course it would have to be an automated process. A benefit of encrypting all the data is that it keeps the RIPE NCC out of any legal actions that may follow. They are simply a forwarding service and have no other details. cheers denis co-chair DB-WG On Friday, 17 January 2020, 11:59:51 CET, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: I will be fine with this (having RIPE NCC as an intermediator just to send the abuse report), if instead of a web form (or in addition to it), it is possible to automate it, for example RIPE NCC also accepts x-arf via email. RIPE NCC has the obligation to keep the information without disclosing it, so why we need to have a way to encypt it so RIPE NCC can’t read it? Furthermore, this should be an automated process. The staff is not going to handle every report manually. And moreover, in case of a bigger dispute, even if going to the courts, RIPE NCC can provide in a neutral way all the info of what happened. However, I’ve the feeling that in order to get this working, the policy must mandate that all the responser from the operator which customer is producing the abuse, also follow the same path, so: Abuse reporter (Victim or its ISP) -> RIPE NCC -> abuser operator -> RIPE NCC -> abuse reporter Otherwise, there will not be a way for RIPE to have stats of who is responding to abuse cases and who is not, or even simpler than that, what abuse mailboxes get bounced (which will be a policy violation if happens all the time with the same operator). Never mind we decide or not that not-responding is an abuse-c violation. Stats are good, even if not published with operator names. El 17/1/20 1:12, "anti-abuse-wg en nombre de ripedenis--- via anti-abuse-wg" <anti-abuse-wg-bounces(a)ripe.net en nombre de anti-abuse-wg(a)ripe.net> escribió: Hi Sergio As I read through this thread similar ideas came to my mind. The question I would ask is "Is it too late to take a completely different approach to abuse contacts and reporting via the RIPE Database?" Suppose we had a standard form available via the ripe.net website for providing details of abuse. If you are able to find the "abuse-c:" details in the database now then you must know the IP address involved. The RIPE NCC could send the report to the abuse contact taken from the database via the specified IP address. This does not have to be an email interface either. We could look at other options. The RIPE NCC would then at least know if the report was successfully delivered. Using a standard form would make it much easier for the resource holder to interpret the information. Someone said: "Making such a scheme compulsory would be unacceptable to people who wish to interact with network owners without disclosing that in public ..." I have no understanding of the technology involved here, but when I send you a message on WhatsApp it is encrypted end to end. WhatsApp have no idea (they say) of the content of the message. Would it be possible to submit a form on ripe.net in a way that the content of that form is encrypted and sent to the resource holder so the RIPE NCC have no idea of the content of the form? That would satisfy this concern. Regardless of the outcome of the RIPE Database Requirements Task Force, something like this could still be implemented as it is external to the RIPE Database. Food for thought... cheers denis co-chair DB-WG On Wednesday, 15 January 2020, 10:22:28 CET, Sérgio Rocha <sergio.rocha(a)makeitsimple.pt> wrote: Hi, Maybe we can change the approach. If RIPE website had a platform to post abuse report, that send the email for the abuse contact, it will be possible to evaluate the responsiveness of the abuse contact. This way anyone that report an abuse could assess not only the response but also the effectiveness of the actions taken by the network owner. After some time with this evaluations we would easy to realize who manages the reports and even who does not respond at all. Sérgio -----Original Message----- From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Gert Doering Sent: 15 de janeiro de 2020 08:06 To: Carlos Friaças <cfriacas(a)fccn.pt> Cc: Gert Doering <gert(a)space.net>; anti-abuse-wg <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") Hi, On Wed, Jan 15, 2020 at 07:23:38AM +0000, Carlos Friaças via anti-abuse-wg wrote: > I obviously don't speak for the incident handling community, but i > think this (making it optional) would be a serious step back. The > current situation is already very bad when in some cases we know from > the start that we are sending (automated) messages/notices to blackholes. So why is it preferrable to send mails which are not acted on, as opposed to "not send mail because you know beforehand that the other network is not interested"? I can see that it is frustrating - but I still cannot support a policy change which will not help dealing with irresponsible networks in any way, but at the same time increases costs and workload for those that do the right thing alrady. > To an extreme, there should always be a known contact responsible for > any network infrastructure. If this is not the case, what's the > purpose of a registry then? "a known contact" and "an *abuse-handling* contact" is not the same thing. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox")
by Ángel González Berdasco 17 Jan '20

17 Jan '20

Well, I do see the value of an option (a magic email value?) meaning "this entity supports the use of its network for abusive purposes and will take no action on any abuse report". That would save time for everyone involved, and would allow to easily block those networks from accesing ours!

22 72

working in new version of 2019-04 (Validation of "abuse-mailbox")
by JORDI PALET MARTINEZ 17 Jan '20

17 Jan '20

Hi Michele, (changing the subject so we can correctly track this and following emails) The last version is available here: https://www.ripe.net/participate/policies/proposals/2019-04 But the goal of this discussion is to understand what the community want, for making a new version. I think we are having a good discussion with several key points and already looking in a way forward. Regards, Jordi @jordipalet El 17/1/20 11:49, "anti-abuse-wg en nombre de Michele Neylon - Blacknight" <anti-abuse-wg-bounces(a)ripe.net en nombre de michele(a)blacknight.com> escribió: I've been trying to follow the back and forth here over the last few days and to be honest I'm rather confused. Which text is actually being proposed? A lot of the discussion here seems to have gone off into all sorts of tangents and it's hard to see what is actually being discussed Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

working in new version of 2019-04 (Validation of "abuse-mailbox")
by JORDI PALET MARTINEZ 17 Jan '20

17 Jan '20

Hi all, I'm working in a new version of the proposal 2019-04 (Validation of "abuse-mailbox"). In the last discussion phase, the only detailed response to this proposal that I got was from Carlos Friacas (which I will respond in detail later-on, as this may also help to revive the discussion). The main question/issue here is still that the actual policy is just a "technical validation". It confirms that there is a mailbox but it doesn't confirm that: 1) Accept emails for abuse reporting 2) The mailbox is the right one and not from someone else, not related to the abuse processing 3) The mailbox is attended and not a black-hole, so nobody pay attention to the abuse reports, or even worst, not full Anything not fulfilling that is useless (as will not fulfil the mission for that mailbox), and then we don't need an abuse-c at all. Even more, I think we can say that an invalid contact, it is against the role of the RIR for having accurate data. It will be interesting if the staff can provide actual data from the existing policy (ripe-705), such as: 1) Has the validation already been performed in all the contacts or only a % of the LIRs and end-users? 2) How many have failed in the first run? 3) After that failure (for those that failed), have the contacts been updated, or only a % of them? Has this helped to located "not anymore existing LIRs or end-users"? How much time, average, takes for the invalid contacts to be corrected? Have them been validated again after some months? 4) How many (%) of those that didn't failed we know that are real abuse-c contacts and not just an existing mailbox that may be not from the right person/team, or even bouncing emails or nobody reading them? I'm happy to hear other inputs, stats, data, etc. Regards, Jordi @jordipalet ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

7 17

@EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox")
by Marcolla, Sara Veronica 17 Jan '20

17 Jan '20

Alex, You say “they just feel this issue should be address via leveraging RIPE resouces”, but I do not see so far any concrete proposal in the sense of addressing issues, only shooting down proposals (for good or bad reasons, I am not entering into the merit here) one after the other. Let’s leverage any resource, but at the same let’s solve the problems – without deflecting the attention with every message. Cheers, Sara From: Alex de Joode <alex(a)idgara.nl> Sent: 16 January 2020 16:30 To: Marcolla, Sara Veronica <Sara.Marcolla(a)europol.europa.eu> Cc: 'Sérgio Rocha' <sergio.rocha(a)makeitsimple.pt>; 'anti-abuse-wg(a)ripe.net' <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] @EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox") Hi Sara, The issue with your statement below is that RIPE NCC cannot (legally, under Dutch contract law) disconnect resources if a resource holder (or more likely his customer) does not (properly) deal with abuse complaints. (for instance due to reasons of proportionality) Currently RIPE NCC mandates an email address for receiving abuse notices (which is good, as companies can specify a specific address that is monitored by people who can take action, and notifiers have a way to find out where to sent notices for speedy resolution). The availability of this address is checked by RIPE. So the current system basically works to enhance the infrastructure for those that are willing to deal with abuse notices. Some within this community do feel this is not enough. That as RIPE controls resources, RIPE should be put in a position to leverage these resources in such a way as to ensure all it's resource holders deal with abuse notice in a proper way. This would then lead to a crime free internet and everybody is happy. Implementing this is a fundament shift in the role and responsibility of RIPE. A large and vocal group here, do not believe this "deputisation" is the direction RIPE should pursue. That does not mean they are in favour of a "un-safe, spam infested, crime ridden internet", they just feel this issue should be address via leveraging RIPE resouces. -- IDGARA | Alex de Joode | alex(a)idgara.nl<mailto:alex@idgara.nl> | +31651108221 | Skype:adejoode On Thu, 16-01-2020 14h 23min, "Marcolla, Sara Veronica" <Sara.Marcolla(a)europol.europa.eu<mailto:Sara.Marcolla@europol.europa.eu>> wrote: Very well put, Sérgio. Thank you for voicing clearly the concern of (at least a part of) the community. We should not forget that, according to the provisions of RIPE NCC audits, “every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of the RIPE NCC services and to assist the RIPE NCC with audits and security checks”. Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general. If the community does not agree that everyone has the right to a safe, spam free, crime free Internet, maybe we have some issue to solve here first. Kind regards, Sara Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net<mailto:anti-abuse-wg-bounces@ripe.net>> On Behalf Of Sérgio Rocha Sent: 16 January 2020 13:38 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") Hi, Agree, This anti-abuse list seems the blocking group to any anit-abuse response measure. It's amazing that nobody cant propose anything without receiving a shower of all sorts of arguments against There is an idea that everyone has to hold, if as a community we cannot organize a policy, one of these days there will be a problem that will make governments take the opportunity to legislate and we will no longer have the free and open internet. There are a feew ideas that is simple to understand: 1 - If you have been assigned a network you have responsibilities, paying should not be the only one. 2 - There is no problem with email, since ever are made solutions to integrate with emails. There is no need to invent a new protocol. Who has a lot of abuse, invests in integrating these emails. 3 - If you have no ability to manage abuse should not have addressing, leave it to professionals. The internet is critical for everyone, the ability for actors to communicate with each other to respond to abuse must exist and RIPE must ensure that it exists. It’s like the relation with local governments, there is a set of information that has to be kept up to date to avoid problems, in RIPE it must be the same. Sergio From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Fi Shing Sent: 16 de janeiro de 2020 04:55 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") >> Best not to judge the race until it has been fully run. I just do not understand how anyone on this list (other than a criminal or a business owner that wants to reduce over heads by abolishing an employee who has to sit and monitor an abuse desk) could be talking about making it easier for abuse to flourish. It is idiotic and is not ad hominem. This list is filled with people who argue for weeks, perhaps months, about the catastrophic world ending dangers of making an admin verify an abuse address ONCE a year .... and then someone says "let's abolish abuse desk all together" and these idiots emerge from the wood work like the termites that they are and there's no resistance? The good news is that nothing talked about on this list is ever implemented, so .. talk away you criminals. --------- Original Message --------- Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com<mailto:rfg@tristatelogic.com>> Date: 1/16/20 11:47 am To: "anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>" <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> In message <20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@ email19.asia.godaddy.com<mailto:20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@%0bemail19.asia.godaddy.com>>, "Fi Shing" <phishing(a)storey.xxx<mailto:phishing@storey.xxx>> wrote: >That is the most stupid thing i've read on this list. Well, I think you shouldn't be quite so harsh in your judgement. It is not immediately apparent that you have been on the list for all that long. So perhaps you should stick around for awhile longer before making such comments. If you do, I feel sure that there will be any number of stupider things that may come to your attention, including even a few from your's truly. Best not to judge the race until it has been fully run. >Which criminal is paying you to say this nonsense, because no ordinary person >that has ever received a spam email would ever say such crap. I would also offer the suggestion that such inartful commentary, being as it is, ad hominem, is not at all likely to advance your agenda. It may have felt good, but I doubt that you have changed a single mind, other than perhaps one or two who will now be persuaded to take the opposing position, relative to whatever it was that you had hoped to achieve. Regards, rfg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. ******************* ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

5 9

Abuse mailbox validation?
by Michele Neylon - Blacknight 17 Jan '20

17 Jan '20

I've been trying to follow the back and forth here over the last few days and to be honest I'm rather confused. Which text is actually being proposed? A lot of the discussion here seems to have gone off into all sorts of tangents and it's hard to see what is actually being discussed Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

1 0

Re: [anti-abuse-wg] @EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox")
by JORDI PALET MARTINEZ 17 Jan '20

17 Jan '20

Hi Alex, Undersood, and thanks a lot; it is very helpful to know that the ecommerce directive has a problem. As said, I’m not advocating for RIPE to take actions if the operator doesn’t react on an abuse case. What I’m trying to make sure, mainly, is that the abuse contact is a *real one*. The actual validation doesn’t ensure this. So the current situation (using your words) is not correct. I think this is the main problem. I believe most of the LIRs/end-users, don’t understand that there is a “small” problem here. So a direct question. Do you think it is acceptable that RIPE NCC does a good validation (as done by ARIN, APNIC and soon LACNIC), or it is acceptable that any operator can use a fake email? Regards, Jordi @jordipalet El 16/1/20 18:04, "Alex de Joode" <adejoode(a)idgara.nl> escribió: Hi Jordi, The inability based on the current ecommerce directive to adequately hold providers responsible when they ignore notices is the reason the Dutch government came up with some 'suggestions' on how to fix these. I'm involved in mitigating the adverse effects of these proposals. (I'm a lawyer and a lobbyist, so a double bad ;)) In my opinion RIPE should ensure those willing have an easy means of knowing who to contact. (that is the current situation) Full mailboxes/bounces etc is something the resource holder should take care of himself. Resource holders who are not interested in properly handling notices, and are striving for a 'McColo status' should be dealt with. However that should not be a role nor a responsibility of RIPE. Europol' EC3, JIT's, local police etc should primarily deal with this (yes takes time and effeort). Advocating for a role for RIPE basically is outsourcing policing (based on Term of Service, something advocated by "your local police" as this looks like a "quick fix" however expect them to insist your ToS needs to have an article "x" and "y" soon.), and removes a lot of due process safeguards you have under the criminal system. If the internet is a "wretched hive of scum and villainy" the powers that be should allocate enough resources to deal with the problem. -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 | Skype:adejoode On Thu, 16-01-2020 17h 17min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: Hi Alex, My reading of the eCommerce Directive (https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32000L0031) is different. Some points (most relevant text only): (40) … the provisions of this Directive relating to liability should not preclude the development and effective operation, by the different interested parties, of technical systems of protection and identification and of technical surveillance instruments … (44) A service provider who deliberately collaborates with one of the recipients of his service in order to undertake illegal acts goes beyond the activities of "mere conduit" or "caching" and as a result cannot benefit from the liability exemptions established for these activities. (46) In order to benefit from a limitation of liability, the provider of an information society service, consisting of the storage of information, upon obtaining actual knowledge or awareness of illegal activities has to act expeditiously to remove or to disable access to the information concerned ... So, if I'm reading it correctly (not being a lawyer), a service provider not acting against abuse when it has been informed of so, is liable. I'm sure if the service provider tries to avoid being "informed" by not looking at notifications (email, postal, fax, etc.), they will also be liable in front of courts. Regards, Jordi @jordipalet El 16/1/20 16:40, "Alex de Joode" <alex(a)idgara.nl> escribió: Jordi, Nice analogy, but when you add the eCommerce Directive into the mix, where a network provider (or hosting provider) is not liable for what their users do, the outcome changes. Only if you have knowledge there might be a possibility for liability, but if you do not accept abuse notices, and therefore do not have knowledge you are not liable. Also note there is no monitoring obligation, but if you do monitor you can gain knowledge and become liable for -everything-. So the current legal environment (in the EU) isn't very 'pro' abuse handling. -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 | Skype:adejoode On Thu, 16-01-2020 15h 18min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: Let’s try to see it from another perspective. If you’re an electricity provider, and one of your customers injects 1.000 v into the network and thus create damages to other customers (even from other electricity providers), the electricity provider must have the means to resolve the problem, disconnect that customer if needed, and pay the damages if the customer creating them don’t do that. When this happens, most of the time, the customer insurance will cover it, initially, and then claim to the electricity provider insurance, which in turn, can claim to the customer creating the trouble. If insurance doesn’t work, most of the time, law will make the electricity provider responsible at the same level of the defaulting customer (especially if this one doesn’t pay the damages). I’m sure that this is the same in every EU country. Can we agree on that? This is totally symmetric to the Internet. An operator provides a service. If a customer is creating damages, even to customers of other operators, the minimum that the provider of the defaulting customer should be able to do is: 1) Receive the abuse report (it can be automated) 2) Investigate the abuse (it can be automated in many cases, especially if we mandate a format for the reporting, and there are open source tools that do that for most of the cases) 3) If it is against the AUP which its customers, take actions, warnings to the customer the first time, etc., even disconnecting the customer (of course, this means losing customers such as spammers that pay a lot …) I don’t expect to respond to the abuse, but it’s nice to do. There are many open source ticket systems that do most of this. I don’t expect to compensate the victims, but I’m sure it can be done if the victims go to the courts. No difference with the electricity example, just we don’t have (as I know) this kind of insurance for Internet abuses. Actually, it will be very nice to have those insurances, because insurance companies have the power to put together many claims in the courts, so operators that don’t care about abuse pay for it. Saludos, Jordi @jordipalet El 16/1/20 15:03, "anti-abuse-wg en nombre de Volker Greimann" <anti-abuse-wg-bounces(a)ripe.net en nombre de vgreimann(a)key-systems.net> escribió: Hi Sara, isn't making the world (and the internet) first and foremost a job of law enforcement agencies like the police and Europol? While I agree that everyone has a role to play, crime prevention and protection of the public is part of the LEA job description, right? Civil society entities certainly have a role to play, but it does not help trying to deputize them into a role they do not carry. I disagree that the contract language you quote puts any duty of care regarding the abuse of any networks by third parties on the parties to the agreement. That duty may arise from other sources, but this language is directed at its own information the party provides to RIPE NCC and the cooperation with any audits. Just because it includes the word security does not mean it refers to all thinkable security issues. The ability of any part of the internet infrastructure to curtail abuse that somehow touches services it providers is usually severely curtailed and its ability to review abuse complaints is usually limited to the resources it provides. In many cases, that is simply not enough information to go on when dealing with many common forms of abuse. Best, Volker Am 16.01.2020 um 14:23 schrieb Marcolla, Sara Veronica: Very well put, Sérgio. Thank you for voicing clearly the concern of (at least a part of) the community. We should not forget that, according to the provisions of RIPE NCC audits, “every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of the RIPE NCC services and to assist the RIPE NCC with audits and security checks”. Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general. If the community does not agree that everyone has the right to a safe, spam free, crime free Internet, maybe we have some issue to solve here first. Kind regards, Sara Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands http://www.europol.europa.eu From: anti-abuse-wg anti-abuse-wg-bounces(a)ripe.net On Behalf Of Sérgio Rocha Sent: 16 January 2020 13:38 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") Hi, Agree, This anti-abuse list seems the blocking group to any anit-abuse response measure. It's amazing that nobody cant propose anything without receiving a shower of all sorts of arguments against There is an idea that everyone has to hold, if as a community we cannot organize a policy, one of these days there will be a problem that will make governments take the opportunity to legislate and we will no longer have the free and open internet. There are a feew ideas that is simple to understand: 1 - If you have been assigned a network you have responsibilities, paying should not be the only one. 2 - There is no problem with email, since ever are made solutions to integrate with emails. There is no need to invent a new protocol. Who has a lot of abuse, invests in integrating these emails. 3 - If you have no ability to manage abuse should not have addressing, leave it to professionals. The internet is critical for everyone, the ability for actors to communicate with each other to respond to abuse must exist and RIPE must ensure that it exists. It’s like the relation with local governments, there is a set of information that has to be kept up to date to avoid problems, in RIPE it must be the same. Sergio From: anti-abuse-wg [anti-abuse-wg-bounces(a)ripe.net] On Behalf Of Fi Shing Sent: 16 de janeiro de 2020 04:55 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") >> Best not to judge the race until it has been fully run. I just do not understand how anyone on this list (other than a criminal or a business owner that wants to reduce over heads by abolishing an employee who has to sit and monitor an abuse desk) could be talking about making it easier for abuse to flourish. It is idiotic and is not ad hominem. This list is filled with people who argue for weeks, perhaps months, about the catastrophic world ending dangers of making an admin verify an abuse address ONCE a year .... and then someone says "let's abolish abuse desk all together" and these idiots emerge from the wood work like the termites that they are and there's no resistance? The good news is that nothing talked about on this list is ever implemented, so .. talk away you criminals. --------- Original Message --------- Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Date: 1/16/20 11:47 am To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> In message <mailto:20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@ email19.asia.godaddy.com>, "Fi Shing" <phishing(a)storey.xxx> wrote: >That is the most stupid thing i've read on this list. Well, I think you shouldn't be quite so harsh in your judgement. It is not immediately apparent that you have been on the list for all that long. So perhaps you should stick around for awhile longer before making such comments. If you do, I feel sure that there will be any number of stupider things that may come to your attention, including even a few from your's truly. Best not to judge the race until it has been fully run. >Which criminal is paying you to say this nonsense, because no ordinary person >that has ever received a spam email would ever say such crap. I would also offer the suggestion that such inartful commentary, being as it is, ad hominem, is not at all likely to advance your agenda. It may have felt good, but I doubt that you have changed a single mind, other than perhaps one or two who will now be persuaded to take the opposing position, relative to whatever it was that you had hoped to achieve. Regards, rfg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. ******************* -- Volker A. Greimann ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it. ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it. ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

6 6

Proposal
by Ronald F. Guilmette 16 Jan '20

16 Jan '20

My apologies. I see that I must make a slight but important correction to my proposal... Be it resolved that: Henceforth, and until this policy is retracted, it shall be the policy and practice of RIPE NCC to place electronic copies of all documents used to establish the bona fides of each and every RIPE member WHICH IS NOT A NATURAL PERSON on the RIPE web site, and in a manner which will allow free and unfettered public access to all such documents. Discuss. Regards, rfg

1 0

Re: [anti-abuse-wg] @EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox")
by JORDI PALET MARTINEZ 16 Jan '20

16 Jan '20

Hi Sara, While I fully agree with Sergio and yourself, the issue here is that this part of your text “Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general” Is not documented, so not “obvious” (as legal text) to everyone or I’m missing something? Of course, I fail to see that any operator can deny that … but is not in the text. Regards, Jordi @jordipalet El 16/1/20 14:24, "anti-abuse-wg en nombre de Marcolla, Sara Veronica" <anti-abuse-wg-bounces(a)ripe.net en nombre de Sara.Marcolla(a)europol.europa.eu> escribió: Very well put, Sérgio. Thank you for voicing clearly the concern of (at least a part of) the community. We should not forget that, according to the provisions of RIPE NCC audits, “every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of the RIPE NCC services and to assist the RIPE NCC with audits and security checks”. Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general. If the community does not agree that everyone has the right to a safe, spam free, crime free Internet, maybe we have some issue to solve here first. Kind regards, Sara Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of Sérgio Rocha Sent: 16 January 2020 13:38 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") Hi, Agree, This anti-abuse list seems the blocking group to any anit-abuse response measure. It's amazing that nobody cant propose anything without receiving a shower of all sorts of arguments against There is an idea that everyone has to hold, if as a community we cannot organize a policy, one of these days there will be a problem that will make governments take the opportunity to legislate and we will no longer have the free and open internet. There are a feew ideas that is simple to understand: 1 - If you have been assigned a network you have responsibilities, paying should not be the only one. 2 - There is no problem with email, since ever are made solutions to integrate with emails. There is no need to invent a new protocol. Who has a lot of abuse, invests in integrating these emails. 3 - If you have no ability to manage abuse should not have addressing, leave it to professionals. The internet is critical for everyone, the ability for actors to communicate with each other to respond to abuse must exist and RIPE must ensure that it exists. It’s like the relation with local governments, there is a set of information that has to be kept up to date to avoid problems, in RIPE it must be the same. Sergio From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Fi Shing Sent: 16 de janeiro de 2020 04:55 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") >> Best not to judge the race until it has been fully run. I just do not understand how anyone on this list (other than a criminal or a business owner that wants to reduce over heads by abolishing an employee who has to sit and monitor an abuse desk) could be talking about making it easier for abuse to flourish. It is idiotic and is not ad hominem. This list is filled with people who argue for weeks, perhaps months, about the catastrophic world ending dangers of making an admin verify an abuse address ONCE a year .... and then someone says "let's abolish abuse desk all together" and these idiots emerge from the wood work like the termites that they are and there's no resistance? The good news is that nothing talked about on this list is ever implemented, so .. talk away you criminals. --------- Original Message --------- Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Date: 1/16/20 11:47 am To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> In message <20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@ email19.asia.godaddy.com>, "Fi Shing" <phishing(a)storey.xxx> wrote: >That is the most stupid thing i've read on this list. Well, I think you shouldn't be quite so harsh in your judgement. It is not immediately apparent that you have been on the list for all that long. So perhaps you should stick around for awhile longer before making such comments. If you do, I feel sure that there will be any number of stupider things that may come to your attention, including even a few from your's truly. Best not to judge the race until it has been fully run. >Which criminal is paying you to say this nonsense, because no ordinary person >that has ever received a spam email would ever say such crap. I would also offer the suggestion that such inartful commentary, being as it is, ad hominem, is not at all likely to advance your agenda. It may have felt good, but I doubt that you have changed a single mind, other than perhaps one or two who will now be persuaded to take the opposing position, relative to whatever it was that you had hoped to achieve. Regards, rfg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. ******************* ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

2 1

@EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox")
by Marcolla, Sara Veronica 16 Jan '20

16 Jan '20

Hi Volker, Did you realize you just proved Sergio’s point? I do agree, Law Enforcement have a duty in maintaining security. But as it happens that municipalities have a duty in maintaining the roads clean of litter and organize pick-ups for rubbish, this does not exempt all citizens and business to also try not to litter. One role does not exclude the other, and everyone should be compelled to do their bit. Sara From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of Volker Greimann Sent: 16 January 2020 15:03 To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] @EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox") Hi Sara, isn't making the world (and the internet) first and foremost a job of law enforcement agencies like the police and Europol? While I agree that everyone has a role to play, crime prevention and protection of the public is part of the LEA job description, right? Civil society entities certainly have a role to play, but it does not help trying to deputize them into a role they do not carry. I disagree that the contract language you quote puts any duty of care regarding the abuse of any networks by third parties on the parties to the agreement. That duty may arise from other sources, but this language is directed at its own information the party provides to RIPE NCC and the cooperation with any audits. Just because it includes the word security does not mean it refers to all thinkable security issues. The ability of any part of the internet infrastructure to curtail abuse that somehow touches services it providers is usually severely curtailed and its ability to review abuse complaints is usually limited to the resources it provides. In many cases, that is simply not enough information to go on when dealing with many common forms of abuse. Best, Volker Am 16.01.2020 um 14:23 schrieb Marcolla, Sara Veronica: Very well put, Sérgio. Thank you for voicing clearly the concern of (at least a part of) the community. We should not forget that, according to the provisions of RIPE NCC audits, “every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of the RIPE NCC services and to assist the RIPE NCC with audits and security checks”. Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general. If the community does not agree that everyone has the right to a safe, spam free, crime free Internet, maybe we have some issue to solve here first. Kind regards, Sara Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net><mailto:anti-abuse-wg-bounces@ripe.net> On Behalf Of Sérgio Rocha Sent: 16 January 2020 13:38 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") Hi, Agree, This anti-abuse list seems the blocking group to any anit-abuse response measure. It's amazing that nobody cant propose anything without receiving a shower of all sorts of arguments against There is an idea that everyone has to hold, if as a community we cannot organize a policy, one of these days there will be a problem that will make governments take the opportunity to legislate and we will no longer have the free and open internet. There are a feew ideas that is simple to understand: 1 - If you have been assigned a network you have responsibilities, paying should not be the only one. 2 - There is no problem with email, since ever are made solutions to integrate with emails. There is no need to invent a new protocol. Who has a lot of abuse, invests in integrating these emails. 3 - If you have no ability to manage abuse should not have addressing, leave it to professionals. The internet is critical for everyone, the ability for actors to communicate with each other to respond to abuse must exist and RIPE must ensure that it exists. It’s like the relation with local governments, there is a set of information that has to be kept up to date to avoid problems, in RIPE it must be the same. Sergio From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Fi Shing Sent: 16 de janeiro de 2020 04:55 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") >> Best not to judge the race until it has been fully run. I just do not understand how anyone on this list (other than a criminal or a business owner that wants to reduce over heads by abolishing an employee who has to sit and monitor an abuse desk) could be talking about making it easier for abuse to flourish. It is idiotic and is not ad hominem. This list is filled with people who argue for weeks, perhaps months, about the catastrophic world ending dangers of making an admin verify an abuse address ONCE a year .... and then someone says "let's abolish abuse desk all together" and these idiots emerge from the wood work like the termites that they are and there's no resistance? The good news is that nothing talked about on this list is ever implemented, so .. talk away you criminals. --------- Original Message --------- Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com<mailto:rfg@tristatelogic.com>> Date: 1/16/20 11:47 am To: "anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>" <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> In message <20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@ email19.asia.godaddy.com<mailto:20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@%0bemail19.asia.godaddy.com>>, "Fi Shing" <phishing(a)storey.xxx<mailto:phishing@storey.xxx>> wrote: >That is the most stupid thing i've read on this list. Well, I think you shouldn't be quite so harsh in your judgement. It is not immediately apparent that you have been on the list for all that long. So perhaps you should stick around for awhile longer before making such comments. If you do, I feel sure that there will be any number of stupider things that may come to your attention, including even a few from your's truly. Best not to judge the race until it has been fully run. >Which criminal is paying you to say this nonsense, because no ordinary person >that has ever received a spam email would ever say such crap. I would also offer the suggestion that such inartful commentary, being as it is, ad hominem, is not at all likely to advance your agenda. It may have felt good, but I doubt that you have changed a single mind, other than perhaps one or two who will now be persuaded to take the opposing position, relative to whatever it was that you had hoped to achieve. Regards, rfg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. ******************* -- Volker A. Greimann ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

@EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox")
by Marcolla, Sara Veronica 16 Jan '20

16 Jan '20

Hi Jordi, Indeed. However, it’s exactly what policies like the abuse –c and this new iteration of your proposal are trying to solve. Apparently, in a sea of denial/counterarguments/gaslighting. I do indeed hope more “security” people from ISPs and CERTs can join the discourse and make it proceed in the right direction. Fingers crossed. Kind regards, Sara M Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of JORDI PALET MARTINEZ via anti-abuse-wg Sent: 16 January 2020 14:54 To: 'anti-abuse-wg(a)ripe.net' <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] @EXT: RE: working in new version of 2019-04 (Validation of "abuse-mailbox") Hi Sara, While I fully agree with Sergio and yourself, the issue here is that this part of your text “Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general” Is not documented, so not “obvious” (as legal text) to everyone or I’m missing something? Of course, I fail to see that any operator can deny that … but is not in the text. Regards, Jordi @jordipalet El 16/1/20 14:24, "anti-abuse-wg en nombre de Marcolla, Sara Veronica" <anti-abuse-wg-bounces(a)ripe.net<mailto:anti-abuse-wg-bounces@ripe.net> en nombre de Sara.Marcolla(a)europol.europa.eu<mailto:Sara.Marcolla@europol.europa.eu>> escribió: Very well put, Sérgio. Thank you for voicing clearly the concern of (at least a part of) the community. We should not forget that, according to the provisions of RIPE NCC audits, “every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of the RIPE NCC services and to assist the RIPE NCC with audits and security checks”. Complete, accurate information goes hand in hand with a duty of care, of promptly taking actions against abuse, and should be accompanied by a social responsibility of trying to make the Internet a safe and secure place for everyone, thus not enabling actively DDoS, spammers, and criminals in general. If the community does not agree that everyone has the right to a safe, spam free, crime free Internet, maybe we have some issue to solve here first. Kind regards, Sara Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net<mailto:anti-abuse-wg-bounces@ripe.net>> On Behalf Of Sérgio Rocha Sent: 16 January 2020 13:38 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") Hi, Agree, This anti-abuse list seems the blocking group to any anit-abuse response measure. It's amazing that nobody cant propose anything without receiving a shower of all sorts of arguments against There is an idea that everyone has to hold, if as a community we cannot organize a policy, one of these days there will be a problem that will make governments take the opportunity to legislate and we will no longer have the free and open internet. There are a feew ideas that is simple to understand: 1 - If you have been assigned a network you have responsibilities, paying should not be the only one. 2 - There is no problem with email, since ever are made solutions to integrate with emails. There is no need to invent a new protocol. Who has a lot of abuse, invests in integrating these emails. 3 - If you have no ability to manage abuse should not have addressing, leave it to professionals. The internet is critical for everyone, the ability for actors to communicate with each other to respond to abuse must exist and RIPE must ensure that it exists. It’s like the relation with local governments, there is a set of information that has to be kept up to date to avoid problems, in RIPE it must be the same. Sergio From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Fi Shing Sent: 16 de janeiro de 2020 04:55 To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") >> Best not to judge the race until it has been fully run. I just do not understand how anyone on this list (other than a criminal or a business owner that wants to reduce over heads by abolishing an employee who has to sit and monitor an abuse desk) could be talking about making it easier for abuse to flourish. It is idiotic and is not ad hominem. This list is filled with people who argue for weeks, perhaps months, about the catastrophic world ending dangers of making an admin verify an abuse address ONCE a year .... and then someone says "let's abolish abuse desk all together" and these idiots emerge from the wood work like the termites that they are and there's no resistance? The good news is that nothing talked about on this list is ever implemented, so .. talk away you criminals. --------- Original Message --------- Subject: Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox") From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com<mailto:rfg@tristatelogic.com>> Date: 1/16/20 11:47 am To: "anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>" <anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>> In message <20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@ email19.asia.godaddy.com<mailto:20200115155949.af7f9f79718891d8e76b551cf73e1563.e548b98006.mailapi@%0bemail19.asia.godaddy.com>>, "Fi Shing" <phishing(a)storey.xxx<mailto:phishing@storey.xxx>> wrote: >That is the most stupid thing i've read on this list. Well, I think you shouldn't be quite so harsh in your judgement. It is not immediately apparent that you have been on the list for all that long. So perhaps you should stick around for awhile longer before making such comments. If you do, I feel sure that there will be any number of stupider things that may come to your attention, including even a few from your's truly. Best not to judge the race until it has been fully run. >Which criminal is paying you to say this nonsense, because no ordinary person >that has ever received a spam email would ever say such crap. I would also offer the suggestion that such inartful commentary, being as it is, ad hominem, is not at all likely to advance your agenda. It may have felt good, but I doubt that you have changed a single mind, other than perhaps one or two who will now be persuaded to take the opposing position, relative to whatever it was that you had hoped to achieve. Regards, rfg ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. ******************* ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it. ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox")
by Leo Vegoda 16 Jan '20

16 Jan '20

On Wed, Jan 15, 2020 at 11:02 AM Jeffrey Race <jrace(a)post.harvard.edu> wrote: [...] > Aside from the reciprocity issue, it's a basic engineering rule > that systems target their goal only when a corrective > feedback path exists. That feedback path does not need to be a personally written e-mail. Instead, it is possible to use signals like the absence of a reliable reporting mechanism to make decisions about not accepting some or all traffic from an abusing network. My main concern with proposal 2019-04 is that it would make everyone look the same. It then takes time and effort to distinguish the networks that will actually use abuse reports to fix problems from those that won't or just don't have the ability to do so. While I would accept Gert's proposal for making abuse-c an optional attribute, the reason I offered a counter proposal for publishing "a statement to the effect that the network operator does not act on abuse reports" is to add clarity at a high level. In the first case, it avoids wasting resources lodging reports that will be ignored. Secondly, it provides reliable statistical information about the networks whose operators claim to use abuse reports to clean things up. This would provide a metric that could be used both by other network operators to guide operational policies and governments or regulators to set theirs. Finally, we don't yet know what the RIPE Database Requirements TF will recommend. But I think that building a new business process on the existing model for publishing contact information assumes they won't recommend changes. Let's wait until they report before asking the RIPE NCC to build new workflows on a model that the community might want to change. Kind regards, Leo Vegoda

5 4

Fresh News from the Dark Continent
by Ronald F. Guilmette 16 Jan '20

16 Jan '20

This was to be expected, but it is good to know that it really did happen. https://mybroadband.co.za/news/security/335226-here-are-the-police-charges-… I have high hopes for the new AFRINIC CEO. Quite obviously, he is not at all tained by the sins of the past, which have been, rather unfortunately, replete. Regards, rfg

1 0

Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox")
by Leo Vegoda 15 Jan '20

15 Jan '20

On Wed, Jan 15, 2020 at 9:25 AM Jeffrey Race <jrace(a)post.harvard.edu> wrote: > > e-mail must be allowed because most victims > are not organizations but individual net users E-mail does not scale well. It was great in the 1990s, when the Internet was smaller and people knew each other. About half the world's population now has some sort of Internet connectivity. Expecting organizations to be able to understand reports from such a diverse group of people is unreasonable. Lots of organizations won't have specialized abuse handling teams. If they don't have a specialized abuse handling team then they are unlikely to have people who understand the reports or processes for acting on them. Forcing these organizations to pretend that they will read and understand and then act on a report will never make it so. So let's stop pretending and put energy into something more productive than asking people to set up an autoresponder for an e-mail address whose mailbox will never be checked by a human.

2 1

Re: [anti-abuse-wg] [routing-wg] An arrest in Russia
by Gert Doering 04 Jan '20

04 Jan '20

Hi, On Fri, Jan 03, 2020 at 04:14:07PM +0000, Suresh Ramasubramanian wrote: > So the RIR has absolutely no role in maintaining say IRR data? I agree validating LOAs and such for routing changes would be on providers. Though if the changes were to be made in IRR data who would validate it? IRR data is authenticated by registry data in RIPE land, if the resource holder chooses so. Short story. So, nobody can create routes for, say, my address space unless I authorize that. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

5 8

An arrest in Russia
by Ronald F. Guilmette 03 Jan '20

03 Jan '20

Anyone have more details about this? https://belsat.eu/en/news/runet-founder-under-house-arrest/ The Czech company that allagedly received the allegedly stolen 7.5 "B" blocks (/16) would seem to be this one: ORG-RCS23-RIPE AS15731 https://www.ripe.net/membership/indices/data/cz.relcom.html But I am not seeing that ORG as having quite that many IPv4 addresses assigned. Maybe the alleged perp in this case only stole IPv6 addresses (?) Regards, rfg

15 25