- anti-abuse-wg - mailman.ripe.net

Fresh News from the Dark Continent
by Ronald F. Guilmette 16 Jan '20

16 Jan '20

This was to be expected, but it is good to know that it really did happen. https://mybroadband.co.za/news/security/335226-here-are-the-police-charges-… I have high hopes for the new AFRINIC CEO. Quite obviously, he is not at all tained by the sins of the past, which have been, rather unfortunately, replete. Regards, rfg

1 0

Re: [anti-abuse-wg] working in new version of 2019-04 (Validation of "abuse-mailbox")
by Leo Vegoda 15 Jan '20

15 Jan '20

On Wed, Jan 15, 2020 at 9:25 AM Jeffrey Race <jrace(a)post.harvard.edu> wrote: > > e-mail must be allowed because most victims > are not organizations but individual net users E-mail does not scale well. It was great in the 1990s, when the Internet was smaller and people knew each other. About half the world's population now has some sort of Internet connectivity. Expecting organizations to be able to understand reports from such a diverse group of people is unreasonable. Lots of organizations won't have specialized abuse handling teams. If they don't have a specialized abuse handling team then they are unlikely to have people who understand the reports or processes for acting on them. Forcing these organizations to pretend that they will read and understand and then act on a report will never make it so. So let's stop pretending and put energy into something more productive than asking people to set up an autoresponder for an e-mail address whose mailbox will never be checked by a human.

2 1

Re: [anti-abuse-wg] [routing-wg] An arrest in Russia
by Gert Doering 04 Jan '20

04 Jan '20

Hi, On Fri, Jan 03, 2020 at 04:14:07PM +0000, Suresh Ramasubramanian wrote: > So the RIR has absolutely no role in maintaining say IRR data? I agree validating LOAs and such for routing changes would be on providers. Though if the changes were to be made in IRR data who would validate it? IRR data is authenticated by registry data in RIPE land, if the resource holder chooses so. Short story. So, nobody can create routes for, say, my address space unless I authorize that. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

5 8

An arrest in Russia
by Ronald F. Guilmette 03 Jan '20

03 Jan '20

Anyone have more details about this? https://belsat.eu/en/news/runet-founder-under-house-arrest/ The Czech company that allagedly received the allegedly stolen 7.5 "B" blocks (/16) would seem to be this one: ORG-RCS23-RIPE AS15731 https://www.ripe.net/membership/indices/data/cz.relcom.html But I am not seeing that ORG as having quite that many IPv4 addresses assigned. Maybe the alleged perp in this case only stole IPv6 addresses (?) Regards, rfg

15 25

Re: [anti-abuse-wg] [routing-wg] 2019-08 New Policy Proposal (RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space) to be discussed on Routing Working Group Mailing List
by Randy Bush 24 Dec '19

24 Dec '19

> as Alexander Azimov pointed out: people can just announce a *less* > specific, which will be "Not Found" even if an AS0 ROA exists for more > specific. And because there is no competing (valid/not found) > announcement they will attract the traffic. this was brought up in the sidr wg when as0 was first proposed. but it is very hard to stop the bright idea train in sidr[ops] or the ietf in general. randy

4 5

2019-08 New Policy Proposal (RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space) to be discussed on Routing Working Group Mailing List
by Petrit Hasani 23 Dec '19

23 Dec '19

Dear colleagues, A new RIPE Policy proposal, 2019-08, "RPKI ROAs for Unallocated and Unassigned RIPE NCC Address Space", is now available for discussion in the Routing Working Group This proposal aims to instructs the RIPE NCC to create ROAs with origin AS0 for all unallocated and unassigned address space under its control. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-08 This proposed policy may be of interest to the Anti-Abuse working group as well. Therefore, we encourage you to review this proposal and send your comments to <routing-wg(a)ripe.net> before 29 November 2019. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

5 4

Update on 2019-04
by Brian Nisbet 19 Dec '19

19 Dec '19

Colleagues, As you may have noticed the Discussion Phase ended for 2019-04 on the 9th of December. Since then the Co-Chairs have been speaking to the proposer and the RIPE PDO about what to do next after the almost complete lack of discussion in the latest phase. The plan is that Jordi is going to work on text for a new version of the proposal, and may well solicit input here, and this new text will be brought to the list in January of 2020. If you have any questions or comments on this, please do let me know. Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

FW: [aa-wg-chair] Draft Anti-Abuse WG Minutes from RIPE 79
by Brian Nisbet 17 Dec '19

17 Dec '19

Folks, Please see the draft minutes from our WG Session in Rotterdam. If you have any corrections or objections, could you please let us know ASAP? Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 From: Aa-wg-chair <aa-wg-chair-bounces(a)ripe.net> On Behalf Of Alun Davies Sent: Monday 16 December 2019 09:52 To: aa-wg-chair(a)ripe.net Subject: [aa-wg-chair] Draft Anti-Abuse WG Minutes from RIPE 79 Hello Brian, Tobias, Alireza, Please find attached the draft minutes for the Anti-Abuse WG session at RIPE 79. Do take a look when you have a moment and let us know if you’d like any changes made. If we don’t hear back from you by the end of this week, we’ll go ahead and publish them as is to the website. Cheers, Alun Davies RIPE NCC

4 6

Massive prefix theft in AFRINIC - attributed to an insider
by Suresh Ramasubramanian 05 Dec '19

05 Dec '19

Congratulations, Ron Guilmette. You’ve been doing this for years and this is your biggest success yet. https://mybroadband.co.za/news/internet/330379-how-internet-resources-worth… tl;dr - The insider is apparently Ernest Byaruhanga, AFRINIC employee #2, and he has now separated from AFRINIC --srs

4 3

Non-ASCII characters in abuse-mailbox addresses
by Thomas Hungenberg 21 Nov '19

21 Nov '19

Hi, some abuse contacts registered with RIPE use non-ascii characters with the abuse-mailbox addresses, e.g. % Abuse contact for '195.78.76.0 - 195.78.77.255' is 'abuse(a)xn--zrich-kva.email' However, the corresponding MTA does not support SMTPUTF8: 7B579403C6: to=<abuse(a)xn--zrich-kva.email>, relay=mail.xn--zrich-kva.email[109.95.241.50]:25, delay=0.33, delays=0.01/0/0.32/0, dsn=5.6.7, status=bounced (SMTPUTF8 is required, but was not offered by host mail.xn--zrich-kva.email[109.95.241.50]) (In this particular case, sending email to the IDNA representation of the email address <abuse(a)xn--zrich-kva.email> works.) In our experience, using umlauts and other non-ascii characters in (the host part of) email addresses still cause a lot of problems in general. Even if the recipient's MX supports SMTPUTF8 correctly, MTAs on the transport way may fail to handle SMTPUTF8 messages. To prevent such problems and make sure all abuse mailboxes can be addressed, I wonder if the values of abuse-mailbox attributes should be restricted to ASCII characters only. What do you think? - Thomas

6 9