- anti-abuse-wg - mailman.ripe.net

New on RIPE Labs: Abuse-c Validation: Update on Progress and Some Numbers
by Mirjam Kuehne 15 May '19

15 May '19

Dear colleagues, With RIPE 78 around the corner, we want to update you on our work to validate abuse contacts in the RIPE Database: https://labs.ripe.net/Members/angela_dallara/abuse-c-validation-update-on-p… Kind regards, Mirjam Kühne RIPE NCC

2 1

Re: [anti-abuse-wg] Email Spam & Spam Abuse Definitions
by Fi Shing 09 May '19

09 May '19

The twitter example is not advertising a product or service. It is conveying information about a product/service that the person has already hired. If twitter sends unsolicited emails to someone when they have not requested that service, or have indicated they no longer want the service, then it is spam. --------- Original Message --------- Subject: [anti-abuse-wg] Email Spam & Spam Abuse Definitions From: "ac" <ac(a)main.me> Date: 4/27/19 4:22 am To: anti-abuse-wg(a)ripe.net Hi, From a recent rant in the WG, something of interest was posted; > opinions on the proper definition of spam. Mr. Andre's preferred > definition appears to allow for "one time" invitations to be blasted > to everyone in the universe. Nonetheless, in Mr. Andre's considered > opinion, "Email Spam is not the same as Spam Abuse" and a "... one In my opinion, the sending of a confirmation email, from say Twitter, to confirm that the actual email address does indeed exist and that their further communications will be solicited - as well as including links to remove/stop further communications: Would be spam (it is still an unsolicited email) - but that single confirmation email is not abuse in itself. Even though Twitter may send 1000's of these to 1000's of different email addresses... I do not think that there is anyone, that works with actual spam abuse, in this WG that disagrees completely with my opinion above. Also, I wanted to add another useful resource link for anyone that is still learning about email abuse: https://www.ripe.net/publications/docs/ripe-409 What is frequently missed is that BULK EMAIL itself, is not the issue, but that the keyword is "unsolicited" - For example if you were to relay 1000 Invoices or 1000 status notifications or 1000 opted in mailing list recipients, this would/should not be considered spam or abuse. Then, of course, imnsho UBE itself is outdated as the spammers use 'drip' systems by spinning out 10000's of emails from 10000's of ip's Which various RBL cater for by speedily listing and de-listing resources and then there are all the shiny new tech things, which probably needs a new thread: Automated comment spam or AI based web form spam is a growing issue and is something that merits discussion and a watchful eye... Andre

5 6

Current List Behaviour/Discussion
by Brian Nisbet 27 Apr '19

27 Apr '19

Folks, We thought we had made ourselves very clear. Apparently not. The current conversation is not useful to the list. Please stop it now. Andre stays on the list. Ronald stays on the list. Both of you are welcome to unsubscribe. But further mails on this topic will cause the Co-Chairs to ask the NCC to put the senders into moderation. Talk about something else, or nothing at all. Enjoy your weekends. Thank you. Brian Co-Chair, AA-WG Brian Nisbet, Service Operations Manager, HEAnet

1 0

Email Spam & Spam Abuse Definitions
by ac 27 Apr '19

27 Apr '19

Hi, From a recent rant in the WG, something of interest was posted; > opinions on the proper definition of spam. Mr. Andre's preferred > definition appears to allow for "one time" invitations to be blasted > to everyone in the universe. Nonetheless, in Mr. Andre's considered > opinion, "Email Spam is not the same as Spam Abuse" and a "... one In my opinion, the sending of a confirmation email, from say Twitter, to confirm that the actual email address does indeed exist and that their further communications will be solicited - as well as including links to remove/stop further communications: Would be spam (it is still an unsolicited email) - but that single confirmation email is not abuse in itself. Even though Twitter may send 1000's of these to 1000's of different email addresses... I do not think that there is anyone, that works with actual spam abuse, in this WG that disagrees completely with my opinion above. Also, I wanted to add another useful resource link for anyone that is still learning about email abuse: https://www.ripe.net/publications/docs/ripe-409 What is frequently missed is that BULK EMAIL itself, is not the issue, but that the keyword is "unsolicited" - For example if you were to relay 1000 Invoices or 1000 status notifications or 1000 opted in mailing list recipients, this would/should not be considered spam or abuse. Then, of course, imnsho UBE itself is outdated as the spammers use 'drip' systems by spinning out 10000's of emails from 10000's of ip's Which various RBL cater for by speedily listing and de-listing resources and then there are all the shiny new tech things, which probably needs a new thread: Automated comment spam or AI based web form spam is a growing issue and is something that merits discussion and a watchful eye... Andre

1 0

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Gert Doering 27 Apr '19

27 Apr '19

Hi, On Sat, Apr 27, 2019 at 07:56:16AM +0200, ac wrote: > On Fri, 26 Apr 2019 22:41:50 -0700 > Randy Bush <randy(a)psg.com> wrote: > > > plonk > > so, we are now degraded to single slang derogatory terms... as you are > reply to me and the list, I am assuming that I am the 'plonker' "plonk" is the sound an e-mail address makes when it's landing on a blacklist. https://en.wikipedia.org/wiki/Plonk_(Usenet) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

2 1

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Brian Nisbet 27 Apr '19

27 Apr '19

Colleagues, This is an open mailing list for the RIPE Anti-Abuse Working Group where a variety of matters, including policy, are discussed. It is not, nor hopefully will it ever be, a closed list with vetting etc. There are lists like that out there, they serve a very useful purpose, but this list is not them. Like all RIPE mailing lists it is as open as possible and will remain so. The Code of Conduct is not there to be used as a stick. It is there to welcome, to set certain norms of behaviour and, hopefully, to support useful discussion across RIPE mailing lists and meetings. To be very clear, we do not believe anyone in this conversation has been misleading or impersonating anyone. We believe there are differences of opinion, possibly even very deep ones, but, barring the uncivil modes of discourse, nothing to trouble the Code of Conduct. We would ask both of you, and all members of this list, to treat each other with civility, to discuss the technical or policy merits of any discussion and to assume good intent from others in all things. What any member of the list does in direct mail between the themselves is up to them, of course. However we would hope for a world in which there is as much civility as possible. All of the Co-Chairs serve at the pleasure of the Working Group. If anyone here feels that one or more of us are not chairing it in an appropriate fashion then the procedure for the removal of a Co-Chair is here: https://www.ripe.net/participate/ripe/wg/anti-abuse/anti-abuse-wg-chair-sel… We consider both Andre & Ronald to be members of this list and, barring future events, have no intention of removing either of you. We consider this matter to be closed at this point and we hope the list can return to the ongoing discussions. In a civil manner. If anyone wishes to discuss this with the WG Chairs directly, please email aa-wg-chair(a)ripe.net Thanks, Alireza, Brian & Tobias Co-Chairs, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ac > Sent: Friday 26 April 2019 05:51 > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted > > On Thu, 25 Apr 2019 17:41:20 -0700 > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > <snip senseless rant around here> > > > > Mr. Chairman, I ask you to summarily eject the member in question from > > the mailing list with clear instructions not to return and not to try > > to do so via the ruse of yet additional sock puppet fradulent > > identities. I ask you to do so in accordance with your clear > > authority and responsibility under the RIPE Code of Conduct, which is, > > I think, not at all ambiguous on this point. You cannot, I think, > > merely stand by and allow arbitrary actors with hidden agendas and > > fradulent identities to infiltrate and repeatedly disrupt and thwart > > this Working Group, or this mailing list, whether via repeated > > off-topic rantings or via other artificial means. To do so would be a > > serious abrogation of your responsibilities as Chair of this WG, and > > one which I and others might reasonably feel duty bound to bring to > > the attention of other and higher RIPE authorities. > > > > I await the Chair's response and the Chair's appropriate action. > > > > So, if you do not get your way, me being ejected, then you are threatening > the Chair? > > All in the same post. > > You are indeed an arrogant and ignorant bully. > > And, you are the disruption. You have carefully crafted an identity over a > decade or more, yet, even after looking carefully, I cannot see that you are > pushing packets in RIPE. I also cannot see you anywhere among my own > colleagues and I therefore do not understand what you are doing in this WG, > except to cause disruption, division and spread FUD. > > Your behavior even in this thread: > > 1. You post on a website (links included in your original post) clearly states > that Hetzner cannot investigate without you agreeing that they send the > email headers to the service provider > > You claim that this idea is the worst idea since "This is probably the best > European idea since the one about invading Russia in Winter." > > 2. When I point out that you are technically incorrect or ignorant - as the > Hetzner response is completely true, ethical and correct and YOU are wrong > > You start attacking me, with us now here where you are threatening that if I > am not ejected from this WG you " I and others might reasonably feel duty > bound to bring to the attention of other and higher RIPE authorities." > > Your disruptive, arrogant and bully behavior is cause for you to be ejected > from this WG > > Andre > > > > >

4 4

Re: [anti-abuse-wg] VoIP
by JORDI PALET MARTINEZ 26 Apr '19

26 Apr '19

I will rather prefer an IETF standard for abuse reporting ... already thought about starting it several times ... sooner or later I will write down something, so may be some other people interested to co-author? Regards, Jordi El 25/4/19 16:14, "anti-abuse-wg en nombre de ac" <anti-abuse-wg-bounces(a)ripe.net en nombre de ac(a)main.me> escribió: On Thu, 25 Apr 2019 14:06:39 +0200 JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > Reading the article in a minute ! > However, as an information pointer I've some data ... > I've an VM with asterisk at home, and every day I've to ban (I use > fail2ban to do it automatically after 3 failed attempts from the same > IP), average about 20 IPs attempting to use my SIP service to my > provider. This turns into 100 per day in the office (average). > Of course, if they succeed, they can make "free" calls that I need to > pay from my pocket ... So, I report automatically those attempts > (once banned), including the logs, to the abuse contacts of the IP > holder. > Some of them just don't care, unfortunately, as many abuse contacts, > just don't work, or the mailboxes aren't being read, or they respond > that you must fill in a form. > Regards, > Jordi > this is something very worthy of discussion, listing services has always existed for dynamic blocks, email abuse, bad neighborhood etc etc - and these lists are reflected/delivered/offered as rbl, dnsbl, wrbl, text, sql, etc etc - imho, the latest trends are weird as the generic lists are becoming too generic and specific or specialisation is the "next big thingTM" - as in not unicorny big but tech useful (mostly free) big... As an example of this, an combined email rbl (which also contains certain dynamic ranges known for not filtering egress, would be completely (or mostly) useless for filtering IP on SIP (or even brute) and a comment form rbl would be well suited for iptables on a web server... My latest new and shiny big idea is: I have an idea and a plan to dev a dynamic ip use dnsl which will return a flag on query... The idea is that any device would receive a code when query a RR The result on query would be multi digit and reflect the known data for that resource (examples: User Dynamic/Static - Abuse Reported Y/N - Port of abuse (all(dul)/21/22/25/53/80/443/etc) - Resource holder responsive Y/N - etc etc etc The further idea is to have exchangeable data streams so that the query (as well as the IPv4/6 of the query) becomes a data provider and then the reporting can be automated (or not) depending on the resource holder itself... What do you think? Kind Regards Andre ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

3 3

Policy Proposal 2019-03 Update
by Brian Nisbet 26 Apr '19

26 Apr '19

Colleagues, The four week discussion phase for 2019-03 officially ended just over a week ago. Since then, while there has been further welcome discussion on list, the WG Co-Chairs have been discussing the next steps with the proposers and the NCC Policy Officer. We have reached the following conclusions. 2019-03 will now move into the Review Phase, with a new version of the policy coming to the list in the next couple of days. Along with this the NCC will start their Impact Analysis which they will share as soon as possible. This does not imply any judgement regarding consensus or lack of consensus for 2019-03, but the Co-Chairs feel it is the best way to both bring the new draft of the proposed policy to you all *and* obtain the vital information from the NCC their understanding of the policy and likely impact. It is at the end of the Review Phase that a decision regarding consensus will be made. As always, please let me know if you have any questions. Thanks, Brian Co-Chair, AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 4

@EXT: RE: Policy Proposal 2019-03 Update
by Marcolla, Sara Veronica 26 Apr '19

26 Apr '19

Hi all, Thanks Randy for bringing this up, I second with a +1! :) I also add one small request. The mailing list has gone left and right and up and down in this period, with some frankly off-centred side discussions, so much so that I feel I am a bit lost and I would really appreciate from the Chairs and Marco a bit of a recap, status quo, changes proposed for the new version against the old, and main contentious points in this whole confusion. Kind regards, Sara Marcolla Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu -----Original Message----- > As always, please let me know if you have any questions. one. can we assume that the co-chairs and marco have memory, or do we all need to restate our views, maybe even after reading a new version? randy ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted
by Brian Nisbet 26 Apr '19

26 Apr '19

All, This conversation is not in any way useful to the community at this point and it is definitely not in the spirit of the Code of Conduct. The request was made in regards to a contact. The initial discussion was about whether Hetzner's processes were valid or not, that is fine. However we've gone well past that and I would ask both of you to please step away from the conversation. This is not a question of who said what or the relative merits of same, it's a case of a thread that should please cease. And I would caution everyone on the list to please, as always, consider their responses and whether they *need* to respond to any post here. And if you do need to respond, which you may well, that's great, but if you do, do so in a respectful manner. Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ac > Sent: Thursday 25 April 2019 11:08 > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] AS24940 Hetzner -- non-role contact wanted > > On Thu, 25 Apr 2019 02:42:35 -0700 > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > > I have just been reviewing the RIPE Code of Conduct for mailing lists, > > and specifically these sections: > > > > > > https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-cod > > e-of-conduct > > > > RIPE community members should not spam mailing lists, post > > others' personal information, register multiple accounts to avoid > > moderation or mislead participants, impersonate others, or make > > threats. Overt marketing or promotional activities are discouraged. > > > > Chairs are responsible for facilitating and moderating the RIPE > > community's discussions. At times they may direct an individual > > to cease a certain type of behaviour. Chairs have the authority to > > moderate or ban disruptive community members if they decide this > > is necessary. > > > > I'd just like to ask you if you are in agreement with the above quoted > > Yes, I am in complete agreement with the above. > > That said, you, on the other hand are clearly not. > > Whether I am wearing underwear or not hardly has anything to do with this > abuse list and your discussing my underwear is also hardly proper. > > And, you, requesting a non-role contact at Hetzner, is clearly an indication of > the bully you are. > > That you are also an ignorant bully is now common cause. > > Andre >

4 3