April 2012 - anti-abuse-wg - mailman.ripe.net

2011-06 Discussion Period extended until 7 May 2012 (Abuse Contact Management in the RIPE NCC Database)
by Marco Schmidt 16 Apr '12

16 Apr '12

Dear colleagues, The text of RIPE Policy Proposal 2011-06, "Abuse Contact Management in the RIPE NCC Database", has been revised based on community feedback received on the mailing list. We published the new version (version 2.0) today, 16 April. As a result, a new Discussion Phase is set for the proposal. Changes in version 2.0 include: - Overall rewording - Description of the use of "abuse-c:" and "abuse-mailbox:" on differing RIPE Database objects - Removal of references to a transition period You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 We encourage you to review this RIPE Policy Proposal and send your comments to <anti-abuse-wg(a)ripe.net> by 7 May 2012. Regards Marco Schmidt on behalf of the Policy Development Office RIPE NCC

1 0

Re: [anti-abuse-wg] abuse email address validation - VOTE
by Jørgen Hovland 14 Apr '12

14 Apr '12

1 0

Introducing the RIPE NCC Report Form
by Laura Cobley 14 Apr '12

14 Apr '12

[Apologies for duplicate emails] Dear colleagues, We would like to introduce the RIPE NCC Report Form. Using this form, you can now easily report various issues, including abnormalities in Internet number resource registrations, to us for further investigation. By making it easy to report these issues to us and by putting a clear process in place, we aim to work together with you to further improve the quality of the data in the Internet number resource registry. The first release of the form offers basic functionality. We will review the form, its usage and your feedback before deciding whether further development is needed in the future. You can find more details at: https://labs.ripe.net/Members/andrea/ripe-ncc-report-form If you have any questions or feedback, please contact <ncc(a)ripe.net>. Best regards, Laura Cobley RIPE NCC

12 22

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 8, Issue 9
by Wout de Natris 13 Apr '12

13 Apr '12

"Re: Contents of anti-abuse-wg digest..." Why does this discussion take so many words and arguments? 1. Primarily RIPE NCC needs or at least should need a proper overview of who its members are for several reasons that all have to do with internal processes like reaching out, billing and maintaining correct records, in short common business practice. 2. There is an abuse function for well ... abuse, so members can reach out to each other and amend whatever goes wrong. All this isn't strange or weird, but normal practice for any company, club, association, etc. As soon as an address isn't correct the company, club, association, university, etc. reaches out to the customer, member, student concerned in order to get new relevant data, so it can do billing, maintenance of records, send news, etc. If the customer, member, et al, does not respond, steps are taken to terminate the relation. This is common practice to any company, club, association, etc. and has, primarily, nothing to do with law enforcement of any kind, but with customer/member relations, correct records, due payment, etc. So how come that as soon as this discussion is about the Internet, whether domain name registrations or in this case IP addresses, this totally normal form of doing business is denied as being standard practice? If data is not correct and there is no way the, in this case RIPE NCC, member can be found, it is not so strange that, after a published notice with a due time frame, a relation is terminated. Certainly in a period of scarcity in IPv4 addresses, this should be common practice. (And if it happens to concern a criminal organisation, they won't show up any way. All others will within about 2 seconds of termination.) So if correct data is standard practice and law enforcement needs them for whatever reason, they can access this data either through Whois of through correct proceedings in the Dutch law. Like it should be. Correct data saves money in the end, for all concerned, and makes becoming a member less attractive for individuals or organisations that most of us agree don't need a place on the internet. I don't think LEAs ask for more than that, but as a RIPE member I would look at my own organisation first. LEAs need to deal with LIRs more than an RIR, I'd guess, so assist them in finding these LIRs. Wout > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 8, Issue 9 > To: anti-abuse-wg(a)ripe.net > Date: Wed, 11 Apr 2012 16:13:31 +0200 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: Introducing the RIPE NCC Report Form (julien tayon) > 2. Re: current business practices (Frank Gadegast) > 3. Re: Introducing the RIPE NCC Report Form (Chris Heinze) > 4. Re: current business practices (Gert Doering) > 5. Re: current business practices (Michele Neylon :: Blacknight) > 6. Re: current business practices (Suresh Ramasubramanian) > 7. Re: current business practices (Frank Gadegast) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 11 Apr 2012 15:49:01 +0200 > From: julien tayon <julien(a)tayon.net> > Subject: Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form > To: Brian Nisbet <brian.nisbet(a)heanet.ie> > Cc: anti-abuse-wg(a)ripe.net > Message-ID: > <CAFpLVkyZQb0W3iCTMuq_uK3fBysQf8gHt8sP23MLypu3P4hriw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > 2012/4/11 Brian Nisbet <brian.nisbet(a)heanet.ie>: > > Chris, > > > > "Chris" wrote the following on 11/04/2012 11:03: > >> > >> On 04/10/2012 05:18 PM, Joe St Sauver wrote: > >>> > >>> Maintenance of the database documenting who's been allocated/assigned > >>> space is *core* to RIPE's mission. > >> > >> > >> simply wrong. > >> ripe's core is allocation. that's what they do. your mission is your > >> private error. > > > > > Ripe's core is at least to provide **change management** over > contact on allocation of internet resources (IP, AS) so that > stakeholder's can cooperate, since internet protocols relies on swift > cooperation between entities. Imagine a world in which you cannot > reach a LIR or RIR having wrong BGP rules ? > > Furthermore, RIPE NCC is bound by its contract with ICANN in its > mission of allocating resources. I think reading the actual contract > might settle the topic pretty fast. > > Since I don't have the contract under my eyes right now, I will make a > simple reasoning based on public informations and personnal > experience. > > Let's stick to the common sense of database first : > *Data accuracy is the most important property of a database.* Ripe NCC > is entitled to manage the whois database, therefore it is in their > mission to ensure DB integrity. > > If it is not convincing enough, let's remember data accuracy is > considered by ICANN as a **MUST DO** for delegated entities (both for > gTLD and resources). > Just search ICANN web sites and you'll have extended papers explaining > why accuracy matters, and how this responsability is also delegated. > http://www.icann.org/en/gsearch/accuracy > > In a world without accurate whois contact it will be the the > strongest's rule that shall prevail. > > What tickles me is how can RIPE NCC bill instances they don't have the > **accurate** contacts ? Are there 2 DBs one for billing (with accurate > data) and another one for public access with inaccurate data ? > > RIPE NCC cant choose the parts it likes in its delegated mission from > ICANN. A contract is a contract and RIPE NCC is bound by its duties > regarding ICANN. If ICANN states RIPE NCC MUST have accurates data, > and MUST enforce internet policies I cannot see how RIPE NCC or RIPE > can decide it is does not fall into their responsabilities. > > Now, all everybody needs to know : > * what level of accuracy ICANN can realistcly expect from its delegates ? > * what are the internet policies ICANN mentions ? > > Cheers. > > -- > Jul > Experienced freelance for years (having worked for ISP). > > > > ------------------------------ > > Message: 2 > Date: Wed, 11 Apr 2012 16:08:11 +0200 > From: Frank Gadegast <ripe-anti-spam-wg(a)powerweb.de> > Subject: Re: [anti-abuse-wg] current business practices > To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Message-ID: <4F85904B.8090203(a)powerweb.de> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > V > > >> > subpoena by deleting the wrong AS object from the database > > > >> ;o) > > > > > > > > Heh. ACK on the role. But I was thinking towards urging the ISP itself to take action (once you HAVE contacted them) on the abuse complaints. That's where the pressure of a lea agency can come in handy, if such a regulator is available. > > > > > > Well, the only possibility would be the police. > They do care here in Germany are kind of > technical disadvanced :o( > > There is some organizations this ISP is a member of > (like the ECO), and they have also a abuse clearing > board, but that one isnt really useful because > it never did anything against their members ... > > And why should they do something, they are not > responsible for the resources ... > > > Kind regards, Frank > > > > > Pepijn > > > > +++++++++++++++++++++++++++++++++++++++++++++ > > > > Disclaimer > > > > Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. > > > > Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging > > > > of ander gebruik ervan niet is toegestaan. > > > > Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan > > > > direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. > > > > Dit e-mailbericht is uitsluitend gecontroleerd op virussen. > > > > OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen > > > > geen rechten aan worden ontleend. > > > > > > > > > > > > This e-mail message may contain confidential information or information protected by professional privilege. > > > > If it is not intended for you, you should be aware that any distribution, copying or other form of use of > > > > this message is not permitted. > > > > If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 > > > > or e-mail mailto:mail@opta.nl and destroy the message immediately. > > > > This e-mail message has only been checked for viruses. > > > > The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. > > > > OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. > > > > No rights can be derived from this message. > > > > > > > > > > > > > -- > > Mit freundlichen Gruessen, > -- > MOTD: "have you enabled SSL on a website or mailbox today ?" > -- > PHADE Software - PowerWeb http://www.powerweb.de > Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de > Schinkelstrasse 17 fon: +49 33200 52920 > 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 > ====================================================================== > > > > > ------------------------------ > > Message: 3 > Date: Wed, 11 Apr 2012 14:49:13 +0200 > From: Chris Heinze <Chris.Heinze(a)consol.de> > Subject: Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form > To: anti-abuse-wg(a)ripe.net > Message-ID: <4F857DC9.8060905(a)consol.de> > Content-Type: text/plain; charset=UTF-8 > > On 04/11/2012 02:13 PM, Brian Nisbet wrote: > >> ripe's core is allocation. that's what they do. your mission is your private error. > > > > http://www.ripe.net/lir-services/ncc/functions > > right, that sums it up nicely, thanks. > > > Once all of v4 space is allocated (soon now, soon), the primary job of the NCC and the other four RIRs will be keeping a good registry. > > ripe's job isn't defined by and doesn't depend on whether or not v4 space is completely allocated (which it btw probably never will). > keeping a good registry is as explained a service kindly provided by ripe to help - and it did that since the beginning. > > regards, > > Chris > > > > ------------------------------ > > Message: 4 > Date: Wed, 11 Apr 2012 15:29:17 +0200 > From: Gert Doering <gert(a)space.net> > Subject: Re: [anti-abuse-wg] current business practices > To: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Cc: shane(a)time-travellers.org, Brian Nisbet <brian.nisbet(a)heanet.ie>, > anti-abuse-wg(a)ripe.net, Tobias Knecht <tk(a)abusix.com>, "Michele Neylon > :: Blacknight" <michele(a)blacknight.ie>, Laura Cobley <laura(a)ripe.net>, > Florian Weimer <fw(a)deneb.enyo.de>, Frank Gadegast > <ripe-anti-spam-wg(a)powerweb.de>, Gert Doering <gert(a)space.net> > Message-ID: <20120411132917.GN84425(a)Space.Net> > Content-Type: text/plain; charset="us-ascii" > > hi, > > On Wed, Apr 11, 2012 at 06:50:02PM +0530, Suresh Ramasubramanian wrote: > > On Wed, Apr 11, 2012 at 6:32 PM, Frank Gadegast > > <ripe-anti-spam-wg(a)powerweb.de> wrote: > > > will receives this could please make a > > > telnet mamba.ripe.net 25 > > > from some IPs he own (best would be not using his or her usual IP, > > > if he or she likes, lets see how big that problem really > > > is, thats why I have to mail the most active people directly). > > > > suresh@frodo 03:54:25 :~$ telnet mamba.ripe.net smtp > > Trying 2001:67c:2e8:11::c100:1328... > > Trying 193.0.19.40... > > telnet: Unable to connect to remote host: Connection refused > > > > Things seem to be RIPE for a change eh? > > So, what exactly causes the assumption that mamba is supposed to be > reachable from the outside, on Port 25? > > $ host -t mx ripe.net > ripe.net mail is handled by 250 postlady.ripe.net. > ripe.net mail is handled by 200 postgirl.ripe.net. > > Now, obviously, expecting anti-spammers to understand about MX records > and how to read Received: lines might be asking for a bit much... > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279 >

6 6

Re: [anti-abuse-wg] Analysis of the Legal Framework and Procedures Proposed by the Data Protection Task Force
by lists＠help.org 13 Apr '12

13 Apr '12

There are companies now that download the various whois databases and repackage and resell the data. One company DomainTools.com has their parent company in the EU in Luxembourg. How is it that they download all this data and resell it apparently without a problem. If it was illegal why they don't get prosecuted? This "legal framework" doesn't address any of that. DomainTool.com has filed a lawsuit in the US federal courts asking them to rule that downloading and selling whois data is illegal. the lawsuit in question involves data from Tucows in Canada so it is unclear how a US court can rule on that. In any case none of this stuff in discussed in the legal framework paper. Are there plans to take legal action against DomainTools.com for selling this data? If not, why not? Why are there restrictions on others if some companies are downloading and selling this data anyway? Just like you can't force people to answer their abuse mailboxes I don't see how you can force people to use (or not to use) data in a certain way after it is made public. http://domainnamewire.com/2012/04/06/domain-tools-files-preemptive-lawsuit/

3 6

Analysis of the Legal Framework and Procedures Proposed by the Data Protection Task Force
by Athina Fragkouli 12 Apr '12

12 Apr '12

Dear colleagues, Current rules regarding bulk access to the data held in the RIPE Database were set based on the work of the Data Protection Task Force, which concluded its work in 2011. At that time, the DPTF published a report on it's activities and outcomes, which was published here: https://www.ripe.net/ripe/groups/tf/dp/report-of-the-ripe-data-protection-t… Recent discussion on this list has suggested that a clear overview of the legal background to the framework and procedures proposed by the DPTF may help foster better community understanding of the RIPE Database rules and the justification behind them. In the interests of transparency and understanding, the RIPE NCC has produced a report that provides the legal analysis and background of all proposals made by the DPTF. This report, which is intended to complement the original DPTF report, is available now at: https://www.ripe.net/data-tools/support/documentation/legal-framework-and-p… Kind regards, Athina Fragkouli Legal Counsel RIPE NCC

2 1

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Joe St Sauver 12 Apr '12

12 Apr '12

Chris commented: #1) if you have a legal problem, go to a legal organisation ("police"), not #ripe. clarify your legal issues there. ripe isn't the place for this. Errors in registration details are not a police matter. Errors in registration details ARE directly germane to RIPE's remit as administrator of number resources, a function it provides for those in its region on behalf of the worldwide Internet community. #2) i generally appreciate ripe ncc's efforts to provide adequate aid in case of #any problems - nevertheless it has it's functions and tasks to stick to, #letting sbdy use it to mess with ripe-external stuff Maintenance of the database documenting who's been allocated/assigned space is *core* to RIPE's mission. #non-ripe-charged 'ripe-extraterritorials' creating lengthy flamey #threats as to what kind of services they "demand" from ripe, i btw #find - err - "curious"... Note that by RIPE policy, participation in RIPE Working Groups (including the Anti-Abuse Working Group) is open to all, which is, I believe, an appropriate reflection of the fact that RIPE-allocated resources can and do have an impact on users worldwide. Of course, if you take issue with that policy, you're free to propose a new policy that would change that. #3) if the complainant isn't prepared, able, or willing to express his complaint #against the alleged suspect, this probably already says it all... (ok so much: #then ncc shouldn't play bully for some troll) The question on the table was a simple one: what should be required of a party notifying RIPE of a data inaccuracy in the existing database. Should the notifying party be required to demonstrate exhaustion of all possible self-notification channels before referring the matter to RIPE as a "last resort?" No. A good Samaritan volunteer reporters has no obligation to do RIPE's work for them, and any attempt to impose arbitrary additional obligations on voluntary reporters is misplaced and inappropriate, and shows a lack of respect for the community member making that report. I see nothing wrong or inappropriate about expecting a RIR to maintain accurate records concerning the resouces it oversees, nor do I see how that makes anyone a "troll." Regards, Joe

11 18

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Leo Vegoda 12 Apr '12

12 Apr '12

Hi Frank, This message is copied to the list, as requested. Frank Gadegast wrote: [...] > Lets ask me one thing (simply because you have an iconn email address): > is ICANN forcing the RIRs to have a public whois database by CONTRACT > and are the registries forced to have up-to-date and validated data in it ? > > Could you please point that out on the list ? I do not believe there is currently a contract between ICANN and the NRO or individual RIRs. In 2007, ICANN and the NRO agreed an exchange of letters. In ICANN's letter to the NRO it stated that it seeks "to further enhance our relationship for the mutual benefit of our organizations and respective communities. For that matter we wish and will seek to establish an appropriate legal arrangement within one (1) year from the date of this letter." I do not believe that arrangement has been established. You can find the announcement about the exchange of letters on the ICANN web site, here: http://www.icann.org/en/news/announcements/announcement-09nov07-en.htm The letters themselves are published on the correspondence pages but that announcement places them in a single page, which is more convenient to read. I expect the "Review of the ASO" document, which is currently in the second half of the public comment period, will have a fuller description of the relationship between the NRO and ICANN: http://www.icann.org/en/news/public-comment/aso-review-16mar12-en.htm Kind regards, Leo Vegoda

1 0

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Joe St Sauver 11 Apr '12

11 Apr '12

Florian commented: #I looked at "Incorrect contact information in the RIPE Database", and #"I confirm that I have reported the incorrect information to all of #the contacts listed in the relevant object" is a required checkbox. # #This seems to require that complainants try postal addresses, phone #and fax numbers before reporting errors in email addresses. Is this #really your goal? Isn't this a step backwards? I agree. >From my POV, each data element should be treated independently. The existence of a valid FAX number, for example, should not offset or eliminate the importance (or the reportability) of working to correct an invalid/non-deliverable email address. Similarly, having found an invalid field in the whois, the reporter's "responsibility" should be considered discharged upon their identifying and reporting that data to RIPE. They should not be expected to exhaust all potential contact methods, or to make multiple attempts to the broken contact channel, or to hypothetically attempt to visit the listed address in person, :-), just in order to be eligible to report a problem with data of record. The goal should be correcting potentially bad data, not making it hard to report bad data or shifting work back upon public spirited community volunteers. Regards, Joe

5 6

Re: [anti-abuse-wg] current business practices
by Frank Gadegast 11 Apr '12

11 Apr '12

V >> subpoena by deleting the wrong AS object from the database > >> ;o) > > > > Heh. ACK on the role. But I was thinking towards urging the ISP itself to take action (once you HAVE contacted them) on the abuse complaints. That's where the pressure of a lea agency can come in handy, if such a regulator is available. > > Well, the only possibility would be the police. They do care here in Germany are kind of technical disadvanced :o( There is some organizations this ISP is a member of (like the ECO), and they have also a abuse clearing board, but that one isnt really useful because it never did anything against their members ... And why should they do something, they are not responsible for the resources ... Kind regards, Frank > > Pepijn > > +++++++++++++++++++++++++++++++++++++++++++++ > > Disclaimer > > Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. > > Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging > > of ander gebruik ervan niet is toegestaan. > > Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan > > direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. > > Dit e-mailbericht is uitsluitend gecontroleerd op virussen. > > OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen > > geen rechten aan worden ontleend. > > > > > > This e-mail message may contain confidential information or information protected by professional privilege. > > If it is not intended for you, you should be aware that any distribution, copying or other form of use of > > this message is not permitted. > > If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 > > or e-mail mailto:mail@opta.nl and destroy the message immediately. > > This e-mail message has only been checked for viruses. > > The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. > > OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. > > No rights can be derived from this message. > > > > > -- Mit freundlichen Gruessen, -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0