- anti-abuse-wg - mailman.ripe.net

2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Petrit Hasani 13 May '20

13 May '20

Dear colleagues, A new version of RIPE policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion. This proposal aims to have the RIPE NCC validate "abuse-c:" information more often and introduces a new validation process. Most of the text has been rewritten following the last round of discussion and the proposal is now at version 3.0. Some key points in this version: - The abuse-mailbox should not force the sender to use a form - The validation process must ensure that the abuse mailbox is able to receive messages - The validation should happen at least every six months You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04 As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, will decide how to proceed with the proposal. We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 27 May 2020. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

17 56

Re: [anti-abuse-wg] Spamming LIR accounts
by JORDI PALET MARTINEZ 12 May '20

12 May '20

Two quick points here: The money collected by Data Protection Agency fines aren’t for the ones claiming, but for the respective governments. If the abuse country don’t have an agreement with the EU to collect that fine, the EU can seize it later on, at any time, when there is a payment from the EU to that company or person, depending on the case. Meanwhile, this company, which has been fined, will not be able to continue business with EU companies. So even if procmail saves time, I feel more responsible, as citizen, to make sure that the law that protects me, is called upon when/if it comes the time for it. Further to that, at least in Spain, I guess is the same in other countries, if you receive spam or any other abuse towards your network, you have law recognized compensation for the damages. Of course this is not millions of euros, even not a few thousands, however a collective claim against a spammer, which my turn the cost for the spammer in something really bad for his/her pocket. Last, but not least, a quick google search shows that there is an agreement for GDPR related issues among the EU and Israel, and Israel has adapted to their equivalent law, which is understandable, because there is a lot of business among those region. Regards, Jordi @jordipalet El 12/5/20 21:49, "anti-abuse-wg en nombre de Sabri Berisha" <anti-abuse-wg-bounces(a)ripe.net en nombre de sabri(a)cluecentral.net> escribió: ----- On May 12, 2020, at 12:32 PM, Töma Gavrichenkov <ximaera(a)gmail.com> wrote: On Tue, May 12, 2020, 10:13 PM Sabri First of all, there is the requirement for the non-EU company to intentionally provide goods or services to the EU. That can be found in article 3(2)a. Well, virtually that's exactly our case: an employee of an Israeli company promotes their services (in multiple local EU languages such as Czech language) through an intentional mailing. Yes, you are absolutely correct in that. Second, and most important, for a law to protect it must be enforceable. For a law to be enforceable, a court must be able to issue a judgement, and that judgement must be executable. Still fine: AFAIK Israeli companies with a remote offering directed to the EU citizens are subject to extraterritorial reaches. At least, I've seen some of those working in GDPR compliance. What do I miss here? This is the part where I disagree. According to EU law, they are subject to what's called "universal jurisdiction", but unless there are treaties in place, or the local Israeli courts are willing to recognize foreign judgements, that EU law is nothing but a useless piece of paper. The EU cannot enforce their laws in a different country without the local courts granting jurisdiction. And that, in turn, means that EU laws cannot be applied to those outside of its reach. It would be different if said entity (whether that's a person or business) had any assets in the EU. In that case they could be seized upon a monetary judgement. Which is the case with Google, Facebook etc. In more simpler terms: EU courts can award you 100 million euros, but without a way to collect it you're still poor. Hence my recommendation to just plonk the guy into oblivion instead of pursuing a theoretical and practically impossible avenue (GDPR enforcement). Just procmail the guy's emails, and vote for the other candidates. Saves you a lot of headaches :) Thanks, Sabri ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

About "consensus" and "voting"...
by Carlos Friaças 12 May '20

12 May '20

Hi Suresh, Gert, All, "member organizations represented by" -- this only happens at the RIPE NCC GM, twice a year. The PDP doesn't happen at the RIPE NCC GM, afaik, whether we like it or not. When polarisation is obvious, "consensus" is impossible and everything tend to remain as is... Cheers, Carlos On Sat, 9 May 2020, Suresh Ramasubramanian wrote: > > In a case where the community is polarised to this extent it would be better to break with procedure and call a vote for once. With member organizations represented by their abuse team heads, rather than IP / routing people, so that > the organisation?s stance on this is clear. > > > > From: Gert Doering <gert(a)space.net> > Date: Saturday, 9 May 2020 at 3:57 PM > To: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Cc: Randy Bush <randy(a)psg.com>, Nick Hilliard <nick(a)foobar.org>, anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox") > > Hi, > > On Sat, May 09, 2020 at 01:12:32AM +0000, Suresh Ramasubramanian wrote: > > Has this even been put to a vote or is it the same group of extremely vocal RIPE regulars against it and the same group of extremely vocal security types for it? Rough consensus has its limitations in such cases. > > There is no voting. > > It's either "there is sufficient support and counterarguments have been > adequately addressed" or "no consensus, rewrite or withdraw". > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 > > >

4 6

Re: [anti-abuse-wg] About "consensus" and "voting"...
by Sérgio Rocha 12 May '20

12 May '20

Hi everyoneOtherwise we change the way the working Groups works it will remain unchanged for ever. I agree that we must get a way to vote or another democratic way to get decisions.If we don't change something in the process it better close this mailing lists that only exist to give the fake image that the community it's workingSREnviado a partir do meu smartphone Samsung Galaxy.<div> </div><div> </div><div>-------- Mensagem original --------</div><div>De : Carlos Friaças via anti-abuse-wg <anti-abuse-wg(a)ripe.net> </div><div>Data: 09/05/20 13:41 (GMT+00:00) </div><div>Para: Suresh Ramasubramanian <ops.lists(a)gmail.com> </div><div>Cc: Gert Doering <gert(a)space.net>, anti-abuse-wg(a)ripe.net </div><div>Assunto: [anti-abuse-wg] About "consensus" and "voting"... </div><div> </div> Hi Suresh, Gert, All, "member organizations represented by" -- this only happens at the RIPE NCC GM, twice a year. The PDP doesn't happen at the RIPE NCC GM, afaik, whether we like it or not. When polarisation is obvious, "consensus" is impossible and everything tend to remain as is... Cheers, Carlos On Sat, 9 May 2020, Suresh Ramasubramanian wrote: > > In a case where the community is polarised to this extent it would be better to break with procedure and call a vote for once.? With member organizations represented by their abuse team heads, rather than IP / routing people, so that > the organisation?s stance on this is clear. > > ? > > From: Gert Doering <gert(a)space.net> > Date: Saturday, 9 May 2020 at 3:57 PM > To: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Cc: Randy Bush <randy(a)psg.com>, Nick Hilliard <nick(a)foobar.org>, anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox") > > Hi, > > On Sat, May 09, 2020 at 01:12:32AM +0000, Suresh Ramasubramanian wrote: > > Has this even been put to a vote or is it the same group of extremely vocal RIPE regulars against it and the same group of extremely vocal security types for it??? Rough consensus has its limitations in such cases. > > There is no voting. > > It's either "there is sufficient support and counterarguments have been > adequately addressed" or "no consensus, rewrite or withdraw". > > Gert Doering > ??????? -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG????????????????????? Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14??????? Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen???????????????? HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444???????? USt-IdNr.: DE813185279 > > >

8 10

Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Elad Cohen 12 May '20

12 May '20

What is this ? "However, the community should report any situation to the RIPE NCC, which can provide (anonymous) periodical statistics to the community, which can take further decisions about that." Ripe members are informers? "divide and conquer" strategy ? Abuse email addresses (just like any other email address) are being spammed, not only by non-relevant spammers but also by automatic useless services that are installed at servers that don't take themselves any measure of proper configuration to avoid the automatic useless services. To my opinion, Ripe should create its own anti-abuse system, each LIR will have login access to it (LIR will be able to choose to receive notifications through sms / email) and to mark each abuse complaint as resolved or not (that system can also have an API so LIR's will be able to pull their abuse complaints), the main issue is that complaints to that system will not be able to be done automatically or by email - only manually by form filling with captcha. (after the LIR will mark an abuse complain as resolved - the complainer will receive an email address also to confirm with him if issue is resolved or not, non-detailed statistics will be able to be displayed to the whole community - to see the percentage of how many manual complaints weren't handled by each LIR) --- Besides the above, I also believe that we as a community should not accept complainers which are not taking the most basic configuration actions to protect their systems, and would consider these complaints as spam. In order for abuse complaints not to be abused. Respectfully, Elad ________________________________ From: anti-abuse-wg on behalf of Serge Droz via anti-abuse-wg Sent: Wednesday, April 29, 2020 11:22 AM To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox") Hi All I think this is a good policy. We can always find use cases where it fails, but it will help in some cases. And if some one is not able to answer an e-mail every six month, there are probably underlying issues. Also the argument, that the bad guys flood the mailbox is not really acceptable. It just means you can't filter spam. The proposal does not check how the reports are used. But it helps us to enumerate organizations, that don't act, coming up with various excuses, along the lines the best problems are some one else's problems, so let's make it some on else's problem. The fact is: Most mature organizations are perfectly capable of handling such mail boxes, even if they have a high load. Coming from the incident response side, I'm tiered of people constantly telling me, that issues are not their problem Best Serge On 28.04.20 16:01, Petrit Hasani wrote: > Dear colleagues, > > A new version of RIPE policy proposal, 2019-04, "Validation of > "abuse-mailbox"", is now available for discussion. > > This proposal aims to have the RIPE NCC validate "abuse-c:" information > more often and introduces a new validation process. > > Most of the text has been rewritten following the last round of > discussion and the proposal is now at version 3.0. Some key points in > this version: > > - The abuse-mailbox should not force the sender to use a form > - The validation process must ensure that the abuse mailbox is able to > receive messages > - The validation should happen at least every six months > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2019-04 > > As per the RIPE Policy Development Process (PDP), the purpose of this > four-week Discussion Phase is to discuss the proposal and provide > feedback to the proposer. > > At the end of the Discussion Phase, the proposer, with the agreement of > the Anti-Abuse Working Group Chairs, will decide how to proceed with the > proposal. > > We encourage you to review this proposal and send your comments to > <anti-abuse-wg(a)ripe.net> before 27 May 2020. > > Kind regards, > -- > Petrit Hasani > Policy Officer > RIPE NCC > > > > > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://www.first.org

8 10

Re: [anti-abuse-wg] About "consensus" and "voting"...
by Randy Bush 11 May '20

11 May '20

> Suresh keeps attacking me without a single slightest proof, and hence > I must respond. a tale Told by an idiot, full of sound and fury, Signifying nothing. -- bill

1 0

FW: About "consensus" and "voting"...
by Suresh Ramasubramanian 11 May '20

11 May '20

Weird. Forwarding a (redacted) offlist email that pointed out that the archive URL I’d posted – which was dug out of my mailbox – is missing from the aawg archive, along with the rest of the email from Jan 2011. From: Suresh Ramasubramanian <ops.lists(a)gmail.com> Date: Monday, 11 May 2020 at 9:04 PM That was from an old email I’d sent to the list – searched my archives. The entire month’s email seems missing from the ripe mailman archives though. https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/ February 2011: [ Thread ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/thread.…> [ Subject ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/subject…> [ Author ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/author.…> [ Date ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/date.ht…> [ Gzip'd Text 34 KB ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February.txt.gz> December 2010: [ Thread ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/thread.…> [ Subject ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/subject…> [ Author ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/author.…> [ Date ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/date.ht…> [ Gzip'd Text 47 KB ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December.txt.gz> From: removed Date: Monday, 11 May 2020 at 5:55 PM To: Suresh Ramasubramanian <ops.lists(a)gmail.com> Subject: Re: [anti-abuse-wg] About "consensus" and "voting"... > On 11 May 2020, at 08:20, Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > https://ripe.net/ripe/maillists/archives/anti-abuse-wg/2011/msg00000.html > Gets a Not found error page

1 0

Elad Cohen: Moderation & Responses
by Brian Nisbet 11 May '20

11 May '20

Colleagues, We would greatly prefer not to be writing this email, but it felt more wrong not to. You will have noticed that Elad Cohen has continued to successfully send emails to the list by creating new email addresses. This is, of course, easy, especially if you are determined. It is also against certainly the spirit of being placed in moderation and shows an unwillingness to abide by the Community code of conduct. While the Co-Chairs, with the invaluable support of the NCC staff, will continue to try to moderate the list when needed, and guided by that code of conduct, we would ask simply that people do not interact with Elad Cohen on list. What you do elsewhere is outside of our remit, as it should be, but we do not see any merit to these conversations on the AA-WG mailing list. Thank you all, Alireza, Brian, Tobias Co-Chairs, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Spamming LIR accounts
by Töma Gavrichenkov 10 May '20

10 May '20

Peace, Okay, should I be the first to step in and say that spamming all the LIR accounts with one's mind-boggingly stupid "technical solutions" that have no, 0, zero chances to be implemented on the Internet is completely irresponsible and grossly unacceptable behaviour? What does GDPR have to say about this? -- Töma

10 14

Response to ipabuseresearch@gmail.com
by bigpiggyyyyyyyyyyyyyyyyyyyy＠protonmail.com 10 May '20

10 May '20

Hello IP Abuse Research, Response to your questions, misunderstanding and false information at: https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2020-May/005747.html ---- "Please refrain from attacking mods or claiming censorship w/o proof, provide logs or transparency into the issue or just state your case w/o personal attacks." ---- Please refrain from writing false information to the readers, do you want a proof of a censorship ? it sounds reasonable to you ? I need too use a different email address in order to reply to you. ---- "Do you have a draft RFC or any buy in from the IETF for your tracking packet proposal? Or is part of harnessing the power of the RIPE part of a larger campaign to alter the current process? When soliciting feedback, did any of the NIRs have pushback on this?" ---- The draft is in my head and will be implemented through a roundtable if I will be elected. ---- "Do Cisco, Juniper, Huawei and others have an estimate on how long it will take to develop the controls mentioned and integrate them / back port them? Are they willing to subsidize this upgrade or will this require public and private institutions around the world to update their BGP routers at their own expense?" ---- No commercial company wil subsidize anything, the goal is that only firmware updates will be needed without any hardware upgrade and that through community pressure - through the roundtable - the routing equipment manufaturers in the roundtable will do what they need to do (implementation of their firmware according to the specfiications). ---- "If this works you might should follow up with Bert Hubert to see if this solution can help fix the DNS Camel problem. I don't think he has explored this specific means of control." ---- Bert is a member of the illegal anonymous organization "The Spamhaus Project" (such as you are) and he is taking active actions for me not to be elected. He is against this solution because it came from me only because of his ego. ---- "Both of your plans mention a large centralized infrastructure run by the 5 RIRs which is managed "by regulated supervised Law Enforcement Agency (for example: Interpol) and not by an internet organization such as the RIRs or ccTLD registries." Is your proposal that we will create The Internet Police? Will they be overseen by the UN or the ITU?" ---- This is incorrect, it is a "centralized" infrastructure exactly as the root DNS servers are a "centralized" infrastructure - exactly the same and everyone are happy with the root DNS servers spread over the world. Regarding: "which is managed "by regulated supervised Law Enforcement Agency (for example: Interpol) and not by an internet organization such as the RIRs or ccTLD registries." This is a completele lie and you are intentioanlly taking sentences out of their context! In the email spam solution, the only part of Interpol is to be in charge only for setting which domains are criminal domains (phishing/malware/virus/etc), remotely through an API, without any access to the system - the reason that Interpol should set it and not the 5 RIR's is because Interpol is regulated and supervised according to law and in Interpol all the countries of the world is/should exist so Interpol will not act as a political organization against any non-member country. The reason Interpol is written and not Europol is also the same - so there will not be any case of few countries in Europol against another country not in the region of Europol (and capability of censorship, digital warfare, etc) - so no politics will be involved here. And this criminals domains list will not be used for agenda / politics / hidden interests (just like "The Spamhaus Project" are doing anonymously). In the anti-abuse methods solutions, the only part of Interpol is regarding creating the signed honeypot templates, that's it, without any access to the system. The reason is that honeypot hacking will cause criminal implications - so the honeypot template must be 100% reliable and created by an organization which is supervised and is regulated according to law - so there will not be false positives. ---- "When it comes to the body of the 5 RIRs, are the NIRs represented independently or do they maintain their own infrastructure?" ---- The two solutions will be managed only by the 5 RIR's, the bgp anycasted infrastructure can be spread over internet organizations worldwide which are not controlled by governments (and that these internet organizations are in countries with strict privacy laws, without experience of violating privacy laws and with democracies). Respectfully, Elad

2 2