- anti-abuse-wg - mailman.ripe.net

RIPE DBTF Feedback
by Boris Duval 14 Apr '21

14 Apr '21

Dear colleagues, I am writing to inform you that the RIPE Database Requirements Task Force (DBTF), is soliciting feedback on recommendations for; PERSON Objects Historical Data Legal Address If you are interested or have any feedback on these topics, then please join the conversation on the RIPE Database WG mailing list so that we can keep all feedback and discussions in one place. Kind regards, Boris on behalf of the DBTF Boris Duval Communications Officer RIPE NCC

1 0

RIPE NCC Report: Law Enforcement Agency Requests 2020
by Ciaran Byrne 31 Mar '21

31 Mar '21

Dear colleagues, We have published a transparency report that details the nature of the requests we received from Law Enforcement Agencies in 2020. You can find the report at: https://www.ripe.net/publications/docs/ripe-754/ <https://www.ripe.net/publications/docs/ripe-754/> Kind regards, Ciaran Byrne Legal Counsel RIPE NCC

1 0

New on RIPE Labs: Trusted Assurance Simplified
by Alun Davies 31 Mar '21

31 Mar '21

Dear colleagues, In the third in a series of guest posts, Kathleen Moriarty talks about the importance of posture assessment - the process of evaluating organisation or system security - and looks at solutions for simplifying the process that could help organisations achieve higher levels of trusted assurance. Read more on RIPE Labs: https://labs.ripe.net/Members/kathleen_moriarty/trusted-assurance-simplified Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Call For Agenda Items - RIPE82
by Brian Nisbet 30 Mar '21

30 Mar '21

Colleagues, RIPE 82 will be taking place somewhere on the Internet from the 17th - 21st May 2021. https://ripe82.ripe.net<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe81.ri…> The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session is currently scheduled for Wednesday 19th, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 3

AFRINIC -- The Saga Continues
by Ronald F. Guilmette 29 Mar '21

29 Mar '21

Just published. https://mybroadband.co.za/news/internet/390378-afrinic-hired-a-convicted-cr…

1 0

What is YAHOONET?
by Alessandro Vesely 18 Mar '21

18 Mar '21

Hi all, I'm aware of the various pages that Wikipedia dedicate to Yahoo! and related services. I'm unsure how to treat YAHOONET as an ISP. The abuse contact they registered at RIPE in 2007 is abuse(a)yahoo-inc.com. It bounces. I wrote to network-abuse(a)cc.yahoo-inc.com asking what address should I use for complaints. I got an automated reply telling me to go to: https://io.help.yahoo.com/contact/index?page=contact&locale=en_US&y=PROD_MA… That link ultimately redirects to the same host/path with the query string replaced by "page=oops". I had tried to contact someone at Yahoo! before. I don't think it's worth trying again. So I think I'm going to put YAHOONET in the heavily firewalled list of ISPs with no abuse team. I hesitated because I used to consider Yahoo! something big, with possibly many worthy customers. Is it still so? I mean, would any savvy netizen face the Internet through such an ISP? Best Ale --

2 3

Proposed Training on Anti-Abuse
by alireza vaziri 17 Mar '21

17 Mar '21

Hi friends, As we have got several requests and inputs on Anti-Abuse training for LIRs on RIPE 80, we have decided to put up useful information for small and/or new LIRs on abuse handling, in a short webinar format with the help of the RIPE NCC training department. I have attached the draft proposal of the training and it would be great to provide us with your feedback and input as long as it has to help you by reducing the number of unwanted abuses from small and/or new LIRs. Cheers, Alireza -- Alireza Vaziri RIPE AA-WG Co-Chair

2 1

New on RIPE Labs: Where Does Zero Trust Begin and Why is it Important?
by Alun Davies 15 Mar '21

15 Mar '21

Dear colleagues, In the second of a series of guests posts on information security, Kathleen Moriarty from the Center for Internet Security (CIS) takes a close look at the benefits of zero trust architectures and what their increased adoption means for the industry. Read more on RIPE Labs: https://labs.ripe.net/Members/kathleen_moriarty/where-does-zero-trust-begin… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Question about spam to abuse inbox
by Cynthia Revström 28 Feb '21

28 Feb '21

Hi aa-wg, For some context, today and yesterday I have been receiving spam in the form of fake abuse notices to my abuse contact email address. Is there a generally accepted standard for when it's okay to block an address or a prefix from emailing your abuse contact? I consider being able to contact the abuse email address of a network a rather important function, so I prefer not to block it. But also as I have more relaxed spam filters for the abuse contact to make sure nothing gets lost, it feels like blocking the address/prefix is my only option other than manually filtering through these emails (10 so far in total, today and yesterday). So back to the question, is there a generally accepted point at which blocking an address/prefix is fine? Thanks, -Cynthia

17 42

Re: [anti-abuse-wg] Question about spam to abuse inbox
by Alex de Joode 25 Feb '21

25 Feb '21

I've been responsible for the abuse handling of a large dedicated hoster for approx 8 years and I learnt: * not all complainers are honest, * not all complainers share an understanding of what is allowed/legal etc, * not all complainers share an understanding of what a hoster is and can do, * not all complaints are 'crisp and clear', * not all complaints provide all data needed to be actionable, * not all complaints 'make sense' * not all complaints are directed to the proper ISP. A webform is a way to ensure some of these issues are addressed. Most ISP's want their networks to be clean. Most ISP's are responsive to complaints (if not please check if your complaints touch on issue #1-7) Most ISP's will work with you if you take time to adapt your complaint to their procedure. Most ISP's do not like to work with Don Qioxote type of ppl. Most ISP's do not like to be told their system sucks because your fringe procedure does not work. So all the armchair anti abuse handling specialists here can come up with nice procedures that check all imaginary boxes they feel are needed, make proposals that have no anti-abuse effect in practise and complaints if their proposals are rejected, however in the end it's the companies that process the abuse that need to deal with all this. And if you ensure #1-7 are not in your complaint you have contributed more than sending emails as the armchair specialist. -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 On Thu, 25-02-2021 14h 41min, Cynthia Revström via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > I think you have misunderstood my point. > > Would they send such report using their customer's own web form? > No? I don't know what implied that? > > Yes, doing so requires some work too, but heck aren't we paying for that already? > The person sending the abuse report is rarely a paying customer. > > The right thing to do would be to arrange for the abuse mailbox address to point (in)directly to the actual user of the IP address. > I am assuming you are referring to having a separate abuse contact for each customer, so like abuse.cust123@domain and registering it in the RIPE Registry/DB? In some cases with large customers maybe but if you are a hosting provider where each customer might only have one or two IPv4 addresses, that can get to an insane amount of handles and make the database really messy. Also the customer in question is not the only info that is relevant, like is it DoS, spam, or port scanning, etc? > But in general I think there are pros and cons to web forms and email templates just as there are pros and cons to arbitrarily structured emails. > -Cynthia > > On Thu, Feb 25, 2021 at 10:05 AM Alessandro Vesely <vesely(a)tana.it> wrote: > > Sorry for being late to the party... > > On Sun 21/Feb/2021 03:44:07 +0100 Cynthia Revström via anti-abuse-wg wrote: > > If the hosting company provides a web form, they can have a field where they > > explicitly ask for the offending IP address. > > This report could then automatically also be sent to the customer in question, > > because we shouldn't assume the customer is malicious, they might just have a > > bad config that made them a relay for example. > > > Would they send such report using their customer's own web form? > > The right thing to do would be to arrange for the abuse mailbox address to > point (in)directly to the actual user of the IP address. Yes, doing so > requires some work too, but heck aren't we paying for that already? > > > Best > Ale > -- > > > > > > > >

1 0