- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 24 Aug '16

24 Aug '16

Hi, On 08/24/2016 10:05 AM, Andre Coetzee wrote: > > ================= > Definition of abuse > ================= > > "The non sanctioned use of a resource to infringe upon the usage rights > of another resource" > > ----------------------------------------------- > another? In the meaning of "a different" or at least "an additional" resource? If I use (abuse) a resource which directly infringes your usage rights, this behaviour would not fall in this definition because there is not "another" resource involved..? example .. aehh.. like... I use your cpu-time for calculating bitcoins..? I use your mailserver for spamming? Maybe I just don't get the english words right :) best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Definition of Abuse - preamble
by Andre Coetzee 24 Aug '16

24 Aug '16

Hello Everyone, Now that everyone has had enough time to comment, it seems that the definition of abuse now works for all types of Internet abuse. So, there is not a technical definition of what abuse actually is, which is very helpful to have, as this is an ABUSE WG, so knowing what abuse means is crucial to the group itself. (As well as to RIPE) Someone said something which caused me to think that the definition, as a technical definition, and not a contractual definition or a definition that intends to regulate, control or subjugate - It may be specifically useful to add a preamble (and possibly other sections?) Here is my proposal for the preamble, it is a very rough first draft sucked from my thumb in less than 3 minutes..., so if you see something that needs refinement, please pitch in. Of course, if it looks good, this is great also! ============ Internet Abuse ============ Understanding what constitutes Internet Abuse is not an easy undertaking as the topic is very technical. The Internet consists of resources and the understanding of Internet abuse relates to also understanding the use and interaction between these resources. Examples of Internet resources include also processes, protocols,credentials as well as other types of resources. More practical examples could be Internet Protocol numbers, Domain names or even Email addresses. This technical definition of abuse does not include identifying the authority for any specific resource as it is not intended to define any rights to resources but simply to define what technically constitutes Internet abuse as it relates to all Internet resources. ================= Definition of abuse ================= "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ----------------------------------------------- Terminology used in the definition ----------------------------------------------- (1) Resource Any Internet Resource (2) Use and Usage Any direct or indirect action involving a resource (3) Rights The correct assignment or allocation of a resource by he authoritative holder of such a resource which results in the entitlement or reasonable expectation to use, or ability to use, such an allocated or assigned resource (4) Sanctioned An action, event or situation originating from the authoritative holder of rights to a resource that gives permission, or permission is granted by direct implication, which authorises that situation, event or action. (5) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource

1 0

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by Ronald F. Guilmette 19 Aug '16

19 Aug '16

ox <andre(a)ox.co.za> wrote: >(4) Sanctioned >An action, event or situation originating from the authoritative holder >of rights to a resource that gives permission, or permission is granted >by direct implication, which authorises that situation, event or action. OK, Andre, I give up. Congratulations. You've succeded in wearing me down until I just give up. That fact that you still clearly either can't or won't comprehend that the "authority" you speak of has to come from somewhere convinces me that you are now -deliberately- failing to understand. Authority for Internet number resources begins at IANA, and then devolves down to the Regional Internet Registries. The fact that you can go on attempting to define "sanctioned" without ever even menioning any of these official bodies, or their authority, has persuaded me that you actually do not -want- to understand this simple but overridingly critical point. I already asked, multiple times, and in multiple ways, "Sanctioned by who? Sanctioned by what?" But you continue to carry on as if this is just an unimportant, annoying, and irrelevant detail. When push comes to shove and someone asks "Who decides who the authoritative holder of rights to a resource is?" you can just tell them "Judge Judy."

2 1

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by Ronald F. Guilmette 19 Aug '16

19 Aug '16

ox <andre(a)ox.co.za> wrote: >================= >Definition of abuse >================= > >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" > >----------------------------------------------- >Terminology used in the definition >----------------------------------------------- > >(1) Sanctioned >An action, event or situation that specifically or expressly gives >permission, or permission is granted by direct implication, which >authorises that situation, event or action So, if, for example, I, Ron Guilmette, give my friend Joe Hacker, my permission to DDoS your corporate web site, that's OK then, yes? Because he has my permission. Yes? Before responding, in heat or otherwise, please read and consider: To any who may think that I'm just quibbling and/or being pedantic about the definition of the terms of reference here, I'd like to just mention a short and rather famous phrase from another document where the terms of reference were also not adequately or precisely defined, at the outset, and where that lack of specificity, in the end, gave rise to what may perhaps have been the greatest single tragedy to have ever befallen my own great nation: "... that all men are created equal..." At the time that was written and signed, there was an *implicit* understanding among some of those who signed it that the term "all men" in this context was quite obviously intended to mean "all white men". Some of the signers believed that's what it meant. Some others did not. That simple lack of specificity festered, like an open gangrenous wound, in the American body politic until some four score and some odd years later when the differing interpretations finally broke out into armed conflict... The American Civil War, in which brother killed brother, and over 600,000 Americans lost their lives. And of course, I haven't even mentioned the civil strife and hardships of the early 20th Century, as the original term of reference, "all men", slowly started to become redefined, yet again, to mean "all human persons, both male and female"... a redefinition that is still a work-in-progress as of this writing, a full century after it began. So before anybody *else* tells me... like Andre... that I'm just nitpicking or being pedantic, I refer you again to the phrase "... that all men are created equal..." and ask you to consider that the final and total costs of your ambiguities may, in the end, perhaps be borne not just by you, but perhaps also by your children as well. Words matter. Regards, rfg P.S. I have no real feeling, one way or the other, about Andre's general _formulation_ of the definition of abuse. It may perhaps be great. It may perhaps be the absolutely best and most concise way of stating our common beliefs on this subject. It's not the general formulation I have issues with. It's only the lack of clarity with respect to the terms of reference. Once those are adequately and crisply clarified, I might actually like what Andre proposes.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Dave Crocker 19 Aug '16

19 Aug '16

On 8/16/2016 6:08 AM, ox wrote: > unfortunately, I do not know what abuse is, yet. An exercise that might help, but which is certain to have a poor signal-to-noice, is to ask everyone to post examples of what they think is abuse, or rather to post every example they think /might/ be abuse. The group then looks at the resulting compendium of examples and formulates an agreement of what examples are, and what examples are not, abuse. Then there is an attempt to formulate a concise description of what is in. It's likely that the examples will be pretty diverse, so that some sub-categorization might produce a more coherent labeling. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net

9 15

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

On Thu, 18 Aug 2016 13:14:53 +0200 ox <andre(a)ox.co.za> wrote: > ================= > Definition of abuse > ================= > > "The non sanctioned use of a resource to infringe upon the usage > rights of another resource" > > ----------------------------------------------- > Terminology used in the definition > ----------------------------------------------- > > (1) Sanctioned > An action, event or situation that specifically or expressly gives > permission, or permission is granted by direct implication, which > authorises that situation, event or action > > (2) Resource > Any Internet Resource > > (3) Use and Usage > Any direct or indirect action involving a resource > > (4) Infringe > An action, event or situation which limits, reduces, undermines or > encroaches upon the fair use of a resource > > (5) Rights > All sanctioned allocation or assignment of any resource > Maybe rather : The sanctioned entitlement to use an allocated or assigned resource > > Andre > >

1 0

Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

================= Definition of abuse ================= "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ----------------------------------------------- Terminology used in the definition ----------------------------------------------- (1) Sanctioned An action, event or situation that specifically or expressly gives permission, or permission is granted by direct implication, which authorises that situation, event or action (2) Resource Any Internet Resource (3) Use and Usage Any direct or indirect action involving a resource (4) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource (5) Rights All sanctioned allocation or assignment of any resource Andre

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Okay, just to be clear and precise: You agree that the definition of >abuse is: > >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" You're not hearing me. The answer is "No, I neither agree nor disagree with your formulation for the simple reason that it is amost entirely ambiguous, and thus meaningless, because you haven't defined _any_ of the terms used. Thus, your formulation could mean almost anything that either the writer or the reader wishes it to mean, and thus, it has no real meaning at all." Examples: If by "sanctioned" you mean "agreed to, explicity, and in writing, by Ronald F. Guilmette, regardless of the sentiments or opinions of others" then yea! That will work great for me! I'll accept that! I have a funny feeling however that when and if we were to make this simple and innocuous "clarification" to the definition of "abuse" you are proposing, some other people might possibly object however. Similarly, if by "another resource" you mean "only the Bratsk Hydroelectric Power Station in Irkutsk and no other resources" then no, that isn't quite broad enough for me, nor is it likely to be for anybody else. You're trying to get everyone to agree to a set of words strung together to form a sentence, even though nobody, including you, even has a clear notion of what any of the individual words mean, or are intended to mean. It is a silly and pointless exercise, absent definitions of the terms on reference. Anybody can vote in favor of the proposition that "All God's children should be happy." The devil is in the details. Ask any lawyer. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Making a fraudulent representation to RIPE in order to obtain >resource(s) - is/are abuse Yes. >and then, that five other definitions may be required for those >people that are not as technical. No. Five other definitions are required for your general statement of general principal to have any meaning *at all* to *anyone*. >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" This is swell, as a general statement of general principal, but in the utter absence of definitions of the terms of reference, it is functionally equivalent to the following statement of general principal: All God's childern should be happy. That's an admirable sentiment, and one which most folks would be happy to agree with, but absent a clear statement of who the writer means to include in the term "God's children" and/or a specification of what any of us are being asked or expected to do in order to achieve this general outcome, it is a statement devoid of actual meaning, and is thus just a political slogan. >My position is as follows regarding fake WHOIS information: > >It is clearly fraud to submit fake information in order to obtain a resource > >Fraud is clearly a criminal act > >Either way, using a resource to infringe upon the usage rights of >another resource, which was obtained by fake information, would fit into >the above definition as the use of that resource would not be sanctioned. > >It is important to mention though, that the resource would have had to >be used though, for there to have been abuse in the first place. Defined "use". If I announce a route to an IP block, e.g. one that isn't actually assigned to me, but then I never put anything in that block, have I "used" it? Some what say "yes". Others would say "no". >I think in the further definitions this could be fleshed out for the >non technical or not as technical people You've missed the point entirely. The additional definitions are not simply necessary to satisfy pointy-headed geeks. The additional definitions are necessary for your general statement of general principal to have any actual meaning AT ALL to anybody. Who are "God's children"? Do you mean only the children of His Chosen People? It makes a difference. You need to define terms.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >The above definition DOES include spamming - You say it does not, etc >etc etc. etc. That is a complete misreading of what I wrote. My only comment what was to say that I disagree with your formulation of the definition (of "abuse"). I did not specifically pick out or mention what thing or things I disagreed with. (However since you made an issue of it, now I will. See my P.S. below.) What I did do instead was to formulate, from scratch, my own definition of "internet abuse", then presented it, and the rationale for it, totally without any reference of any kind, either positive or negative, to anybody else's preferred definition. Regards, rfg P.S. If specifically asked however, I would critique your current working definition as follows: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" This does not cover AT ALL cases where fradulent data has been deliberately entered into the WHOIS data base. You attempt to ignore this entire problem area... to just sweep the whole thing under the rug as if it doesn't exist... kinda makes me wonder if you are just shilling for Sasha Luck, who doesn't want to see there be a WHOIS data base AT ALL because, you know, god forbid that anybody or any company should ever actually be held, you know, accountable. No no no! We can't have THAT now can we? So? Are you shilling for the "pro-privacy" and "anti-transparency" lobby, or what? It's not like you could have missed the fact that bogus WHOIS data has been a topic here recently. Further critique: Your "definition" will require five additional definitions of its own before it will even mean a blasted thing, actually, to anybody: Define "sanctioned". (Sanction by whom? Sanctioned by what? The law?) Define "use". (If I send a packet to you, did I just "use" you?) Define "resource". (Do resources include WHOIS records? If not, why not?) Define "infringe". (If I make a copy of your webpage, have I infringed?) Define "rights". (Which rights, in particular? Who or what grants these "rights" you speak of? God? IANA? RIPE? My local city council?) Until you define those additional five things, your definition doesn't even MEAN anything. Not in any real, meaningful, or concrete sense at least. That's why I didn't even think the whole thing was even worth commenting on, quite frankly, i.e. because it seems so tenuous and incomplete. So I just got out a fresh blank sheet of paper and started writing my own version, which I posted, explained, and provided necessary definitions for, so that readers would have a prayer in hell of being able to at least understand what it means.

2 1