- anti-abuse-wg - mailman.ripe.net

Co-Chair selection
by Markus de Brün 08 May '24

08 May '24

Dear colleagues, the deadline for nominations has ended and we received one nomination. It is our current and long-standing co-chair Brian. In case you do not know Brian, there is a short biography at the end of this email. Brian is willing to accept his nomination. Tobias and I are happy to continue to work with him. It would be great to hear from you if you support Brian as well. Kind regards, Markus Brian's bio taken from https://www.ripe.net/community/wg/active-wg/anti-abuse/wg-chair-biographies… - snip - Brian Nisbet is Co-chair of the RIPE Anti-Abuse Working Group. He's been an active member of the RIPE community and the Anti-Abuse Working Group since RIPE 49. He's passionate about the Internet being an accessible and enjoyable experience for everyone, and network abuse is completely antithetical to that goal. Brian’s day job is as Network Operations Manager for HEAnet, the Irish National Research and Education Network, and he is the Chair of the NOC Special Interest Group (SIG-NOC) for the European academic networking community. He is also the Working Group Chairs representative to the RIPE PC. - snap -

10 9

Draft Agenda - AA-WG Session @ RIPE88
by Brian Nisbet 22 Apr '24

22 Apr '24

Colleagues, The RIPE Anti-Abuse WG will meet at RIPE88 in Krakow. Our session is planned for 16:00 - 17:30 CEST on Tuesday 21st May and participation will be possible both in person and online. Here is the (very full!) draft agenda for our WG session. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * MeetEcho Mic & Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 87 * Working Group Chair Selection * Finalise agenda * Code of Conduct B. Update * B.1. Recent List Discussion * B.2. AA-WG Future & Possible Recharter Discussion C. Policies - *C.1. D. Interactions - *D.1. "Illegal content online: What is our role as a Regional Internet Registry" - Maria Stafyla, RIPE NCC E. Presentation - *E.1. Change the narrative: How to successfully get consent on Internet standards deployment - Wout De Natris, De Natris Consult *E.2. Peering into the Darkness - The Use of UTRS in Combating DDoS Attacks - Yury Zhauniarovich, TU Delft X. A.O.B. Z. Agenda for RIPE 89 We look forward to seeing you at the meeting! Brian, Markus & Tobias Co-Chairs, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

LEA Transparency Report 2023
by Theodoros Fyllaridis 18 Apr '24

18 Apr '24

Dear colleagues, We have published a transparency report that details the nature and number of requests we received from Law Enforcement Agencies in 2023. You can find the report at: https://www.ripe.net/publications/docs/ripe-819/ . Kind regards, Theodoros Fyllaridis Legal Counsel RIPE NCC

7 15

On "very" fast IPv6-growing entities
by Natale Maria Bianchi 12 Apr '24

12 Apr '24

This specific case is not involved with observed abuse, but it elicited my curiosity. It is not the first time that I see such things, and I'd like to see what other people think. A GB entity with a ukrainian director, incorporated on 23 March 2024, gets an ASN (AS215158) assigned by RIPE NCC on 05 April 2024, and now, just a week later, they are announcing no less than ten /29 IPv6 networks regularly assigned to them: 2a11:e8c0::/29 2a11:ea80::/29 2a11:ff40::/29 2a12:1040::/29 2a12:2e80::/29 2a12:3c00::/29 2a12:8580::/29 2a12:8a00::/29 2a12:9300::/29 2a12:d080::/29 That is quite a bit of space, indicating the entrance in the field of a large communication company making a large investment on infrastructure in preparation for a sizable number of users. So you look for their website, but in vain. They do not even expose their domain in the RIPE database, just a mailbox on a freemail. So my curiosities are: - what will this huge IPv6 space be used for? - what is the business area of this company? - can any individual easily grab ten /29's just for the fun of it, since there are plenty of them (2^29) before we need to think about 512-bit IPv8? - shouldn't the intended usage be made publicly visible somehow, so that the community can see how and why the space is used, and statistics can be made? (if it is already, I apologize and will appreciate pointers). Natale M Bianchi Spamhaus Project

3 4

Call for Nominations: Co-Chair of the Anti-Abuse Working Group
by Markus de Brün 11 Apr '24

11 Apr '24

Dear colleagues, Brian's term as co-chair of the Anti-Abuse Working Group will conclude at RIPE 88. As such, we are initiating the selection process for a new co-chair. You can find detailed information about the selection process at [1]. We encourage you to submit nominations, whether self-nominations or nominations of others, before 17:00 CET on 5th May 2024. For those interested in understanding the responsibilities and expectations of a working group co-chair, please refer to RIPE-692 [2] and RIPE-765 [3]. If you have any further questions or would like to submit a nomination, please do not hesitate to contact us at aa-wg-chair(a)ripe.net. Kind regards, Markus Co-chair, Anti-Abuse Working Group [1] https://www.ripe.net/community/wg/active-wg/anti-abuse/anti-abuse-wg-chair-… [2] https://www.ripe.net/publications/docs/ripe-692 [3] https://www.ripe.net/publications/docs/ripe-765/

2 3

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 146, Issue 10
by Wout de Natris 10 Apr '24

10 Apr '24

It has been a while that I was in LEA, but I remember this same complaint from the 00s. A LEA-RIPE NCC working group was started circa 2008 and that led to a lot better understanding of each others competences and information that could be shared. Like myself, all these people are now in other positions. So, without me knowing what is asked by whom, a renewed effort could be the answer. @Michele @Serge. Yes, at times I hear exasperation from law makers as well. The fact that this very WG is discussing its future remit, if there is one at all, may well be one of the causes of this exasperation. Self-regulation does mean just that. It should not equate inactivity. The alternative is regulation. In more and more stages of society in general, this is becoming the case. The Internet already is and will not be an exception. There's still a chance to self-regulate. Kind regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of anti-abuse-wg-request(a)ripe.net <anti-abuse-wg-request(a)ripe.net> Sent: Wednesday, April 10, 2024 12:07 PM To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: anti-abuse-wg Digest, Vol 146, Issue 10 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: LEA Transparency Report 2023 (Michele Neylon - Blacknight) 2. Re: LEA Transparency Report 2023 (Michele Neylon - Blacknight) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Apr 2024 10:03:36 +0000 From: Michele Neylon - Blacknight <michele(a)blacknight.com> To: Suresh Ramasubramanian <ops.lists(a)gmail.com>, Serge Droz <serge.droz(a)first.org>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] LEA Transparency Report 2023 Message-ID: <DB8PR09MB3324C8ED9C46B8F36AE42BC7CD062(a)DB8PR09MB3324.eurprd09.prod.outlook.com> Content-Type: text/plain; charset="windows-1252" Suresh The devil is in the details?. Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours. From: Suresh Ramasubramanian <ops.lists(a)gmail.com> Date: Wednesday, 10 April 2024 at 10:38 To: Michele Neylon - Blacknight <michele(a)blacknight.com>, Serge Droz <serge.droz(a)first.org>, anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] LEA Transparency Report 2023 [EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources. LEA especially the computer crime part of LEA has been dealing with RIRs for some decades now? The specifics of this case would be interesting. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Michele Neylon - Blacknight via anti-abuse-wg <anti-abuse-wg(a)ripe.net> Sent: Wednesday, April 10, 2024 3:02:51 PM To: Serge Droz <serge.droz(a)first.org>; anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] LEA Transparency Report 2023 Serge The report speaks about French LEA asking RIPE for data that RIPE does not have. You then go off on some complete tangent about governments not being satisfied with tech companies. How are the two related? What purpose does asking RIPE (or anyone else) for data they simply do not have serve? A much more rational explanation is that LEA simply do not understand what data RIPE (or others) have and that maybe the solution is to educate them. I have heard from some in LEA that the amount of engagement from RIPE, ICANN etc., in the past couple of years has reduced, though that?s purely anecdotal. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours.

1 0

Reverse DNS delegations
by Alessandro Vesely 08 Apr '24

08 Apr '24

Hi all, what's the policy for reverse delegation? My provider assigned me a 2a02:29e1:500:6c00::/56. Great. However they didn't delegate reverse DNS. Indeed, their own 2a02:29e1::/32 has no delegations: ; <<>> DiG 9.18.24-1-Debian <<>> 1.e.9.2.2.0.a.2.ip6.arpa ns ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19800 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: cad8ae482b0e559c01000000660fe49763aa815e05fda159 (good) ;; QUESTION SECTION: ;1.e.9.2.2.0.a.2.ip6.arpa. IN NS ;; AUTHORITY SECTION: 0.a.2.ip6.arpa. 3600 IN SOA pri.authdns.ripe.net. dns.ripe.net. 1712314758 3600 600 864000 3600 Now there are mail servers which reject mail if they don't find a matching PTR: <<< 554 resimta-c2p-559421.sys.comcast.net resimta-c2p-559421.sys.comcast.net 2a02:29e1:500:6c00::4 Comcast requires that all mail servers must have a PTR record with a valid Reverse DNS entry. Currently your mail server does not fill that requirement. For more information, refer to: https://postmaster.comcast.net/smtp-error-codes.php#554 Why isn't it possible to gain a delegation by proving number assignment? Best Ale --

6 16

Seeking Input on the Future of the Anti-Abuse Working Group
by Markus de Brün 03 Apr '24

03 Apr '24

* Dear Anti-Abuse Working Group Members, As Co-Chairs, we have been carefully monitoring the discussions on the mailing list and are concerned about the current state of stagnation and lack of progress. After consideration and discussion among the Co-Chairs, we believe it is necessary to initiate a dialogue regarding the future direction of our working group. Some action is needed to revitalise our efforts. The Co-Chairs have discussed a number of options, both between ourselves and with the RIPE Chair Team. However, due to the lack of general engagement, and the circular conversations on the list, we see three viable options at this point:: 1. Re-charteringthe working group, possibly transitioning it into a Security Working Group to broaden our scope and address related concerns comprehensively. (The current charter can be found here: https://www.ripe.net/community/wg/active-wg/anti-abuse/ <https://www.ripe.net/community/wg/active-wg/anti-abuse/>) 2. It is possible we are simply the wrong Co-Chairs at the wrong time, so we can step-downand allow the working group to select new Co-Chairs. 3. Closing the working groupif consensus cannot be reached on a viable path forward. It may be that there are people in the Working Group who are eager to propose new policies, or embark on a project to systematically examine the abuse ecosystem, but over the last year or so, there has been no evidence this is the case. However, we firmly believe that the best course of action is to engage all members of the Anti-Abuse Working Group in an open and transparent discussion about the challenges we face and the opportunities for positive change. Your input and perspectives are invaluable in shaping the future of our community. Therefore, we are inviting you to participate actively in this crucial conversation. We encourage you to share your thoughts, suggestions, and concerns regarding the current state of the working group and your vision for its future direction. Your input will help inform our next steps and guide the evolution of the Anti-Abuse Working Group. We encourage you to share your feedback openly on the mailing list so that all members can participate in the conversation. We hope to discuss the status at RIPE88. Thank you for reading this far. We look forward to your active participation in shaping the future of the Anti-Abuse Working Group. Best regards, Brian, Tobias, Markus *

11 10

IS3C public consultation on an alternative narrative to deploy Internet standards
by Wout de Natris 12 Mar '24

12 Mar '24

Dear colleagues, IGF DC IS3C invites you to participate in the consultation on positively enhancing the deployment of two Internet standards: DNSSEC and RPKI. You are invited to answer either of these questions: Do the arguments used to favor a positive decision, convince you to order deployment within your organisation or from your service provider? / Do they assist you to convince decision takers in your organisation to invest in security by design? You are invited to share your views and arguments with IS3C’s expert team and have been granted commenting rights in this document to do so. The consultation runs from 11 March to 12PM UTC, Friday 5 April 2024. Your contribution will be taken into consideration when finalising the text before publication this spring. Here is the link to the Google Doc: https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9x… [https://lh7-us.googleusercontent.com/docs/AHkbwyKX2Kk3Ln5vVsuCkXG99FKVph_OJ…]<https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9x…> IS3C WG 8 work document<https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9x…> docs.google.com We hope to receive your views so we can present the most convincing arguments to deploy DNSSEC, RPKI and all other security-related Internet standards and ICT best practices. (FYI, this project is sponsored by ICANN and RIPE NCC.) Kind regards, Wout de Natris IS3C: Making the Internet more secure and safer

7 9

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 145, Issue 7
by Wout de Natris 12 Mar '24

12 Mar '24

Dear colleagues, Thank you all very much for your constructive comments. Please make sure you contribute in the document itself, so our experts can take your views into account when finalising the document. As an explanation. IS3C focuses on the deployment of all security-related Internet standards and ICT best practices. See e.g. the list of 23 Internet standards (of which one is a best practice) we developed recently that all organisation can use when procuring ICTs. The alternative narrative we are working on now, can be used for all standards and best practices (for more information, see is3coaltion.org). Also, we make a clear distinction between organisations that need to take action themselves and organisations that need to demand this level of security to be built in by design when procuring ICTs, by adding them to their procurement demands. The arguments most likely will vary between the two. Please keep this in mind. Why DNSSEC and RPKI? Among IS3C's members the desire arose to have one Working Group focus on two standards only. Consensus led to DNSSEC and RPKI, which led to natural partners. Where your concerns on DNSSEC are concerned, please add them in the doc so that they can be added into the final document. Also, please add the solution, so it can be taken into account as well. Should you be interested to participate in our work in the future, please let me know and I will guide you to our membership list. Finally, I am reaching out to you as the Dynamic Coalition's coordinator. Thank you again, as your comments are very valuable to us. Kind regards, Wout de Natris IS3C: Making the Internet more secure and safer ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of anti-abuse-wg-request(a)ripe.net <anti-abuse-wg-request(a)ripe.net> Sent: Tuesday, March 12, 2024 9:57 AM To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: anti-abuse-wg Digest, Vol 145, Issue 7 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: IS3C public consultation on an alternative narrative to deploy Internet standards (David Conrad) 2. Re: IS3C public consultation on an alternative narrative to deploy Internet standards (John Levine) 3. Re: IS3C public consultation on an alternative narrative to deploy Internet standards (Alessandro Vesely) ---------------------------------------------------------------------- Message: 1 Date: Mon, 11 Mar 2024 19:55:17 +0000 From: David Conrad <drc(a)virtualized.org> To: Wout de Natris <denatrisconsult(a)hotmail.nl> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] IS3C public consultation on an alternative narrative to deploy Internet standards Message-ID: <3D269691-628C-49B5-B173-B01518B92EB9(a)virtualized.org> Content-Type: text/plain; charset="utf-8" Hi, I've focused my comments specifically on the section entitled "The Alternative Narrative, a Call To Action for Leaders?. While I understand the desire to encourage DNSSEC and RPKI deployment at the leadership level, however if you??re targeting policy makers and C-levels, I would strongly encourage a balanced, honest approach, one that highlights both the benefits as well as risks. From experience, I believe focusing only on (alleged) benefits and stretching applicability (almost beyond recognition) can be quite counter-productive when the inevitable failures (e.g., https://ianix.com/pub/dnssec-outages.html, https://packetvis.com/blog/rpki-trust-anchor-malfunctions/) occur. FWIW. Regards, -drc Partner/CTO, Layer 9 Technologies (layer9.tech <http://layer9.tech/>) > On Mar 11, 2024, at 2:58?AM, Wout de Natris <denatrisconsult(a)hotmail.nl> wrote: > > Dear colleagues, > > IGF DC IS3C invites you to participate in the consultation on positively enhancing the deployment of two Internet standards: DNSSEC and RPKI. You are invited to answer either of these questions: Do the arguments used to favor a positive decision, convince you to order deployment within your organisation or from your service provider? / Do they assist you to convince decision takers in your organisation to invest in security by design? You are invited to share your views and arguments with IS3C?s expert team and have been granted commenting rights in this document to do so. The consultation runs from 11 March to 12PM UTC, Friday 5 April 2024. Your contribution will be taken into consideration when finalising the text before publication this spring. Here is the link to the Google Doc: > > https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9x… > <https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9x…> > IS3C WG 8 work document <https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9x…> > docs.google.com <http://docs.google.com/> > We hope to receive your views so we can present the most convincing arguments to deploy DNSSEC, RPKI and all other security-related Internet standards and ICT best practices. (FYI, this project is sponsored by ICANN and RIPE NCC.) > > Kind regards, > > Wout de Natris > > IS3C: Making the Internet more secure and safer

1 0