- anti-abuse-wg - mailman.ripe.net

RBL Discussion Update
by Brian Nisbet 31 Jan '17

31 Jan '17

Ok folks... The RBL Policy discussion is interesting, but we've gone wildly off track and it has become focused, unfortunately, on one provider. I'm not going to tell anyone what to think of Spamhaus, but this conversation is not the right place to go on specifically about them. I think the relevant opinions have been aired and nobody is going to be convinced one way or the other. If there is more discussion of general RBL Policy and whether bans should be longer/shorter/whatever or the other points Andre raised, great. If you aren't talking about this, please don't post it here. There are lots of other lists and forums and things on the Internet where you can post away. Thanks, Brian -- Brian Nisbet, Network Operations Manager HEAnet CLG, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 31 Jan '17

31 Jan '17

Strafgesetzbuch (StGB) § 240 Nötigung (1) Wer einen Menschen rechtswidrig mit Gewalt oder durch Drohung mit einem empfindlichen Übel zu einer Handlung, Duldung oder Unterlassung nötigt, wird mit Freiheitsstrafe bis zu drei Jahren oder mit Geldstrafe bestraft. (2) Rechtswidrig ist die Tat, wenn die Anwendung der Gewalt oder die Androhung des Übels zu dem angestrebten Zweck als verwerflich anzusehen ist. (3) Der Versuch ist strafbar. (4) In besonders schweren Fällen ist die Strafe Freiheitsstrafe von sechs Monaten bis zu fünf Jahren. Ein besonders schwerer Fall liegt in der Regel vor, wenn der Täter 1. eine Schwangere zum Schwangerschaftsabbruch nötigt oder 2. seine Befugnisse oder seine Stellung als Amtsträger mißbraucht. being forced to spend manhours (= money) to 'delist' from 3rd party dns blacklists is 'empflindliche uebel', and yes you are forcing them into a 'handlung (delisting/acting AGAINST their paying customer), duldung (ignoring the fact that you call them and others affected by your block 'spammers') or 'unterlassung' (interfering with their provider immunity and right to sell services to anyone, anywhere, and keep doing so - as long as those don't break the law -there- and even if they do you can still sell them services as that's their problem -there- not yours. per-se. ;) now. that's just the blackmail part and just the BRD part... other eu memberstates usually have simular laws... if you knowingly and willingly insert ips into a blackmail infrastructure which you have advertised with the argument that you KNOW a listing has impact on 1/3rd of the worlds mail delivery, or worse, such as spamhaus DROP, where you KNOW a listing causes part of the internet to completely drop that traffic, as you advertise it just for -that- purpose and know how many nodes use it, that completely falls under pretty much any computer sabotage act out there -ever-. but... ofcourse... to you... some not-even-illegal use of 'smtp' or some wintendo virusses that could be out there, are of higher priority than keeping the internet working, and not breaking any laws yourself. keep in mind, we, the owners of the internet, isps and carriers, and yes we do OWN it, 'tolerate' blacklists... as long as they don't go around making silly demands, such as 'contacting' them, or gaining too much influence and starting to 'demand' to disconnect things without even bothering to get a court order. what's next... the RIAA setting up one as well? On 31 ينا, 2017 ص 04:17, ox wrote: > On Mon, 30 Jan 2017 13:21:54 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> smtp is just one of many protocols out there, a primitive, fairly >> unimportant and severely lacking in terms of security one at that, >> and it's protection cannot be a reason for any disconnection -ever-. >> > This thread is about DNSBL and not about the smtp protocol but the > replies helped us all understand why it is important to permanently list > entire IP ranges. (Even if the resources change hands) > > Personally, I think that block times should be increased or become more > permanent. > > Practically and right now, some of the block lists that I feed data > into is talking about discontinuing 24 hour blocks completely and > moving to much longer block times. > > Other lists are considering completely discontinuing auto de-listing. > > The effect of this will mean that abuse@ will have to become more responsive > in order to avoid being more permanently listed. > > Andre > > > > > > > > > > > >

2 3

Re: [anti-abuse-wg] Fwd: Re: Fwd: Re: RBL policy
by ox 31 Jan '17

31 Jan '17

On Tue, 31 Jan 2017 10:09:57 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > your ethics argument is funny as that applies equally well to > boko-haram and al-quida. lol. > You are exactly correct! You, yourself, also said that people can decide if or which DNSBL they want to or do not want to use... Nobody is forcing anyone to use any list. So, in fact even if example.com is listing your ipv4/6 on null route border drop, this means only as much as whatever society attaches whatever value to We do not all have the same ethics at all. Just a little while ago I had to point out that we all, in general (or overwhelmingly like in 99% of us) may share some basic ethics (like 99.9% of all people believe it is not cool to eat people) So the various lists have different ethics, some have business cases that over rule their ethics, some may even be criminals themselves, etc etc Andre

1 0

Re: [anti-abuse-wg] Language on List
by Lu Heng 31 Jan '17

31 Jan '17

Hi I agree that personal attack should not happen. As for the language usage, I believe casual language should be ok for the list, as we are not lawyers but geeks. And, as many of us are not native speaker, mistake on grammer as well as wording should be accepted. Just my 2 cents:) With regards. Lu On 31 January 2017 at 17:34, ox <andre(a)ox.co.za> wrote: > On Tue, 31 Jan 2017 09:21:37 +0000 > Brian Nisbet <brian.nisbet(a)heanet.ie> wrote: > > I shall be more clear, in that case. I have little or no problem with > > generalised swearing. It's a part of modern language and while I > > generally would not use it in professional written communications > > myself, I'm not going to attempt to censor anyone else for it. > > > > What I do not believe is acceptable is ad hominem attacks. There were > > what I believe were implied anti-Semetic comments made during the > > recent thread and that is not something that is allowed. Simple as > > that. > > > +1 > > and thank you so much for being direct, it needed to be said so that > there is no confusion about the problem that exists. > > Andre > > -- -- Kind regards. Lu

1 0

Language on List
by Brian Nisbet 31 Jan '17

31 Jan '17

Colleagues, While the Anti-Abuse WG welcomes a free exchange of ideas and opinions, it does not welcome personal abuse of any kind. This includes, but is absolutely not limited to, their ethnicity or religion. Please remember this as we all continue to work together to make the Internet a better place. Brian Co-Chair, RIPE AA WG -- Brian Nisbet, Network Operations Manager HEAnet CLG, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

2 3

Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 31 Jan '17

31 Jan '17

-------- Forwarded Message -------- Subject: Re: [anti-abuse-wg] RBL policy Date: Mon, 30 Jan 2017 10:51:40 +0000 From: HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> Organization: Republic CyberBunker To: Simon Forster <simon-lists(a)ldml.com> On 30 ينا, 2017 ص 09:39, Simon Forster wrote: >> On 30 Jan 2017, at 06:13, ox <andre(a)ox.co.za> wrote: >> >> Hello All, >> >> May I please solicit some comments about Abuse Block lists >> (Without detracting from RFC 5782 and RFC 6471 or : >> https://www.ripe.net/publications/docs/ripe-409 ) >> >> Firstly, the background for the start of this thread is simply: As the >> use of machine learning technology is now also applied and adapted for >> the use of cyber criminals (including spammers, scammers, etc) the >> rules and what is socially acceptable is and has changed. Global >> politics, protectionism, nationalism and the other 'isms' are also >> causing change. >> >> Considering that DNSBL tech is "reactive" (after he abuse) > This statement appears to be exclusionary — and is one often levelled against DNSBLs. All DNSBLs are not wholly reactive. > > Firstly, one needs to acknowledge that all DNSBLs are not they same. > > Secondly, some listings in some DNSBLs are proactive. i.e. Made before abuse is seen. As I work for the commercial arm of Spamhaus, I know their offerings quite well and can confidently state that some of the Spamhaus block lists contain proactive and/or precautionary listings. > > to be exact: the criminal organisation spamhaus their illegal blacklists effected some 20 million ips on our last scan of their entire database contents. (although that's a bit hard to do, as named kept crashing running 24 cores of gethostbyname() on 10ge , so we may have missed a few million here and there) at a simultanious portscan of the entire ipv4 internet, it turned out there were only some 200000 smtp servers left however. > that leads to the conclusion that 99% of the listings is purely there for blackmail purposes, and has nothing to do with your silly old SMTP protocol AT ALL. the only reason to list those others is to put pressure on people to 1: spend manhours on interacting with the (non-sollicited) spamhaus 'organisation' and 2: illegally force people into breach of contract with their clients. listing sales department networks of transit carriers to breach national carriers and connected hosting farms into breach of contract with a customer, of which steve linford does not like the CONTENT on the website, kinda, fucks up statistics ay. face it: smtp is dead, and needs no 'protection' at all.. also ip addresses identify nodes in a network, not people. also: forcing people to contact spamhaus, causes manhours to be spent on communication, which is extortion, as we have no contractual relation with spamhaus whatsoever, so trying to force carriers and isps into communication with them, is a crime. (although only punishable by 3 months in .nl ;) the 'we don't block anything' argument doesn't go. spamhaus advertises the fact that they have influence on roughly 1/3rd of mail delivery so they know damn well that by entering an ip on their list, of a sales department of a transit carrier, like they did with at least: tata and tiscali, that they are deliberately obstructing data communications and therefore violating any and all computer sabotage acts. as for the way in which they advertise their BGP feed. let's just say that we have BGP feeds as well. and we will use them AGAINST spamhaus again. (it's called an internet exchange you dummy ;) "we advise our peers to nullroute traffic to spamhaus or give a preferred route to one of our dns servers which always returns 127.0.0.2" :P we still kinda had it with their fuckery. they simply should roll over and die. if not they should get some help. fun fact: with all the 110 competing 'auto list / auto-de-list' dnsbls in the world, there never was -any- issue whatsoever... having cghq jew linford crying in the jew press that we would be 'spammers' may have worked to spread slander... however fact of the matter is that smtp is loong dead and we usually don't even read it, sometimes don't have servers for it, and in any case, blocked port 25 on all our networks by default ever since 2004. lolol. (who the FUCK still uses smtp anyway, and why the hell would 'abuse' of it be an excuse to disconnect paying customers - if any - as we certainly never could FIND any "spammers" that could afford our fees ;) what we see here is a CGHQ JTRIG operation (Spamhaus) trying to enforce UK laws and trade policy upon the rest of the internet, it has nothing to do with 'abuse' spamhaus is a political operation run by the jews at CGHQ. stophaus is a colation of cyberdivisions of armies fighting them. china, russia, and the republic cyberbunker have every right in the world to just nuke linford off the surface of this planet. and that's probably just what we should have done in the first fucking place. > I imagine SURBL does likewise. Other block lists probably have similar policies / inputs. > Simon > > >> The block time policies of RBLs >> *********************************** >> There are two main types of block lists: No automatic removal and >> automatic removal >> >> Is the policy to auto de-list after a period of time, still accurate? >> >> Considering the change in abuse patterns and technology, should the >> block times be increased or de-creased? >> >> Does society require more specialist non auto de-list DNSBLs? >> (Would it be helpful to law enforcement to have a "child pornography" >> dnsbl? or a phish dnsbl? - or is the reactive time to high in order >> for dynamic ipv4? - but on ipv6 allocations to devices could be more >> 'permanent'? etc) >> >> Andre >> >

5 22

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

although i can't see how you managed to obtain statistics on the number of emails being sent each day... unless spamhaus would like to admit that they also spy on dns requests to their dnsbl... which would lead to entirely different diplomatic issues... as quite a few government entities also send them queries every time a mail is received... perl -e "print ((510000+293000)*60*24)" 1156320000.. not considering that each of those posts (just photos and posts, not comments, chat, etc) reaches -multiple people- at the same time within a closed user group (friends, friends of friends) etc. and that's just facebook alone. maybe you included messages sent by your wrongly configured crond to root@ in your statistics haha. also: trying to push 250B messages through the fairly limited number of smtpds (Feel free to scan port 25 and count them for yourself) could turn out a bit hard... lol... postfix and sendmail are not exactly optimized for such things lolol. in the 1990s you would have had a point, in the 1990s we used smtp for every little shit from. "orders for the snackbar anyone" to "there is this guy here that wants this or that" - in as far as that wasn't done over irc. but those days are looong over. and smtp has been deliberately broken not to be reliable (graylisting) in terms of near-instant delivery. also i would like to see some statistics as to 'how much spam' all of those dnsbls, and spamhaus seperately did manage to stop, as scaring customers to the next isp won't stop them from what they're doing anyway. lolol.. also statistics on how many people after all that shit caused by spamhaus now have stopped using smtp alltogether because it never actually works anyway... 'you ahve sent a mail to the government of berlin but you are on spamhaus, goodbye'... fuck it, where is the fax machine. On 30 ينا, 2017 م 01:37, ox wrote: > On Mon, 30 Jan 2017 13:19:32 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> as for smtp being alive.. out of 4 billion ips some 200k run an smtp >> server... still a lot more than ftp (including badly configured >> printers and security cameras).. but considering it's a protocol that >> was supposed to run on each and every workstation. it's dead. >> >> facebook has more users per second than smtp has mails per year. lol. >> > https://zephoria.com/top-15-valuable-facebook-statistics/ > statistics, facts (after they happened) are so crazy, lol > > In 2015, the number of emails sent and received per day total over 205 > billion... > > in 2016 email/smtp = +8% lol > > and 2017 - looks to be even more hectic. - smtp maybe closer to 300 > billion (per day) or 109 Trillion emails per year...lol > > by 2020 we may be at 1000 trillion emails... > > how many users does facebook have per day. lol > >> On 30 ينا, 2017 م 01:13, ox wrote: >>> On Mon, 30 Jan 2017 13:01:46 +0000 >>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >>>> no not all dnsbls are a problem. none of the other ones block >>>> non-directly related prefixes as a means of extortion into complete >>>> breach of contract. there are some 110 of them last time we >>>> checked. we only were on the 2 operated by spamhaus. :P >>>> so by far... pretty much all dnsbl's list the ips that originate >>>> the 'undesired' traffic, which stops it from >>>> reaching those that use their service, and that's where it ends for >>>> them... that's perfectly acceptable. >>>> (as long as it's the actual end user making the decision to use >>>> their 'filtering' or not) >>>> >>> Okay, got it, thank you for that >>> >>>> howeverrrrr... then there is spamhaus... >>>> >>> yeah, but it will show good manners if you make a new thread about >>> that? >>> >>>> as for the ripe mailinglist being smtp... yes. it unfortunately >>>> still is.. and it's about the ONLY thing that still needs smtp, >>>> next to signing up to habbo hotel. lol. i haven't started the mail >>>> client for anything else in years. lol. face it: smtp is dead, the >>>> reason it is dead: is spamhaus itself. making it unreliable. >>>> mainly. >>>> >>> we will have to agree to disagree (or not agree - with the same >>> result :) ) >>> >>> smtp - 2017 my pov (and own stats) There has never been so much >>> legit traffic sent ever... >>> >>> Easy to check though as everyone on here has their own stats and to >>> quickly analize 25 vs say 80 (wow - and 443 is just as crazy in >>> terms of growth as 25!) in 2015 as compared to 2016 - smtp is >>> alive and kicking (so is 443!) >>> >>> Andre >>> >>

2 1

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

we currently have 5-6 lirs in active operation... basically just because of spamshit constantly trying to blackmail us into 'compliance' to their silly and illegal demands... do the math on ipv4 space going to waste. lol On 30 ينا, 2017 م 01:37, ox wrote: > On Mon, 30 Jan 2017 13:19:32 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> as for smtp being alive.. out of 4 billion ips some 200k run an smtp >> server... still a lot more than ftp (including badly configured >> printers and security cameras).. but considering it's a protocol that >> was supposed to run on each and every workstation. it's dead. >> >> facebook has more users per second than smtp has mails per year. lol. >> > https://zephoria.com/top-15-valuable-facebook-statistics/ > statistics, facts (after they happened) are so crazy, lol > > In 2015, the number of emails sent and received per day total over 205 > billion... > > in 2016 email/smtp = +8% lol > > and 2017 - looks to be even more hectic. - smtp maybe closer to 300 > billion (per day) or 109 Trillion emails per year...lol > > by 2020 we may be at 1000 trillion emails... > > how many users does facebook have per day. lol > >> On 30 ينا, 2017 م 01:13, ox wrote: >>> On Mon, 30 Jan 2017 13:01:46 +0000 >>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >>>> no not all dnsbls are a problem. none of the other ones block >>>> non-directly related prefixes as a means of extortion into complete >>>> breach of contract. there are some 110 of them last time we >>>> checked. we only were on the 2 operated by spamhaus. :P >>>> so by far... pretty much all dnsbl's list the ips that originate >>>> the 'undesired' traffic, which stops it from >>>> reaching those that use their service, and that's where it ends for >>>> them... that's perfectly acceptable. >>>> (as long as it's the actual end user making the decision to use >>>> their 'filtering' or not) >>>> >>> Okay, got it, thank you for that >>> >>>> howeverrrrr... then there is spamhaus... >>>> >>> yeah, but it will show good manners if you make a new thread about >>> that? >>> >>>> as for the ripe mailinglist being smtp... yes. it unfortunately >>>> still is.. and it's about the ONLY thing that still needs smtp, >>>> next to signing up to habbo hotel. lol. i haven't started the mail >>>> client for anything else in years. lol. face it: smtp is dead, the >>>> reason it is dead: is spamhaus itself. making it unreliable. >>>> mainly. >>>> >>> we will have to agree to disagree (or not agree - with the same >>> result :) ) >>> >>> smtp - 2017 my pov (and own stats) There has never been so much >>> legit traffic sent ever... >>> >>> Easy to check though as everyone on here has their own stats and to >>> quickly analize 25 vs say 80 (wow - and 443 is just as crazy in >>> terms of growth as 25!) in 2015 as compared to 2016 - smtp is >>> alive and kicking (so is 443!) >>> >>> Andre >>> >>

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

their entire concept of thinking is deliberately wrong... ip addresses do NOT identify people. so blacklists, will never work, especially not if you list half hte rest of the internet with that, to extort into disconnection, after which, the client simply moves elsewhere. doh. On 30 ينا, 2017 م 01:37, ox wrote: > On Mon, 30 Jan 2017 13:19:32 +0000 > HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >> as for smtp being alive.. out of 4 billion ips some 200k run an smtp >> server... still a lot more than ftp (including badly configured >> printers and security cameras).. but considering it's a protocol that >> was supposed to run on each and every workstation. it's dead. >> >> facebook has more users per second than smtp has mails per year. lol. >> > https://zephoria.com/top-15-valuable-facebook-statistics/ > statistics, facts (after they happened) are so crazy, lol > > In 2015, the number of emails sent and received per day total over 205 > billion... > > in 2016 email/smtp = +8% lol > > and 2017 - looks to be even more hectic. - smtp maybe closer to 300 > billion (per day) or 109 Trillion emails per year...lol > > by 2020 we may be at 1000 trillion emails... > > how many users does facebook have per day. lol > >> On 30 ينا, 2017 م 01:13, ox wrote: >>> On Mon, 30 Jan 2017 13:01:46 +0000 >>> HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: >>>> no not all dnsbls are a problem. none of the other ones block >>>> non-directly related prefixes as a means of extortion into complete >>>> breach of contract. there are some 110 of them last time we >>>> checked. we only were on the 2 operated by spamhaus. :P >>>> so by far... pretty much all dnsbl's list the ips that originate >>>> the 'undesired' traffic, which stops it from >>>> reaching those that use their service, and that's where it ends for >>>> them... that's perfectly acceptable. >>>> (as long as it's the actual end user making the decision to use >>>> their 'filtering' or not) >>>> >>> Okay, got it, thank you for that >>> >>>> howeverrrrr... then there is spamhaus... >>>> >>> yeah, but it will show good manners if you make a new thread about >>> that? >>> >>>> as for the ripe mailinglist being smtp... yes. it unfortunately >>>> still is.. and it's about the ONLY thing that still needs smtp, >>>> next to signing up to habbo hotel. lol. i haven't started the mail >>>> client for anything else in years. lol. face it: smtp is dead, the >>>> reason it is dead: is spamhaus itself. making it unreliable. >>>> mainly. >>>> >>> we will have to agree to disagree (or not agree - with the same >>> result :) ) >>> >>> smtp - 2017 my pov (and own stats) There has never been so much >>> legit traffic sent ever... >>> >>> Easy to check though as everyone on here has their own stats and to >>> quickly analize 25 vs say 80 (wow - and 443 is just as crazy in >>> terms of growth as 25!) in 2015 as compared to 2016 - smtp is >>> alive and kicking (so is 443!) >>> >>> Andre >>> >>

1 0

Re: [anti-abuse-wg] Fwd: Re: RBL policy
by HRH Prince Sven Olaf von CyberBunker 30 Jan '17

30 Jan '17

as smtp also leaks ip addresses which are nobody's fucking business on the application/user layer anyway all over the place, and we don't want spamhaus to 'connect some dots'... we simply obtain services ELSEWHERE. lol. which we can do over and over and over again should the need be there, as well as simply getting more BV/LTD/GMBH/IBCs and starting more lirs causing more 'burned ip space' thanks to spamhaus. yay. ay. lol. On 30 ينا, 2017 م 01:37, ox wrote:

1 0