July 2012 - anti-abuse-wg - mailman.ripe.net

the mandatory abuse field
by Frank Gadegast 04 Aug '12

04 Aug '12

Hi all, I really have the feeling, that some in the community fear a mandatory abuse field, and try find any strange argument against it, but I really cannot see why. If somebody does not want to receive abuse reports or does not want to do something against abuse originating from his own resources or likes to receive them not via email or has whatever else reason, well, name it this-email-address-is-not-being-read(a)yourdomain.com or no-reply(a)example.com or send it to devnull ... Lots of resource holders are already doing the same, we keep a list of there email addresses, so we do not have to send them reports that will only fill our mail queue to bounce back. I can understand them and respect that others like to work things different and we do not send them reports anymore. On the other end, a mandatory abuse field will clean up everything in RIPEs database, remove the unparseble remarks, will help the abuse teams to receive reports only to ONE address, because sender can be educated, abuse tools can be simplified and integrated in webpages easily aso ... A mandatory abuse field has that much advantages for everybody who likes to work against abuse, that I cannot understand, why people, that do not want the same for there own reasons are against it. Let us optimize our procedures and if you do not want to participate, well set the email address to whatever or ignore every incoming mail ... Well, there is one reasons I can think of: Those people are not concerned, that they have to do something against abuse coming from there OWN resources, it must be the people that are causing the abuse problem in the first place, its there business, and so they are worried, that others find easier and better methods in preventing abuse. So, my personal summary is: --- Anybody, who is against a mandatory abuse field, is a professional spammer, abuser, maintains a bot net or sells open proxies or other services used for abusing others. They are criminals to my opinion. But thats only my impression ... --- Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

11 41

Manual vs automated reports
by Luis Muñoz 01 Aug '12

01 Aug '12

Hi there, I've been quickly going through the archives to try to catch up in the discussion after reading the current document. It struck me as odd that the role objects will have a single abuse-mailbox object which should be used to receive both automatic and manual reports. I'm aware of this (related) exchange (from the archives): From Tobias Knecht > > Is it for high volume automated report dissemination (trap or sensor initiated > > identification of "activity")? > > > For this to work it needs automated handling on the receiving side and it should > > be clearly opt-in, so that the receiving entity can prepare for proper processing. > > Disagree from my experience in the anti-abuse industry. First of all > reporting must be easy and receiving reports must be easy as well. [...] > > Second, if you do not want to receive reports from one party, block them > or directly delete them. That is best practice and widely adopted and > really not complicated to do. [...] While this matches my experience -- and I'm sure this will also match with the experience of anybody who has had to handle a large volume anti-abuse operation -- I remember there were times where I wished there was an easier way. The automated reports tend to vastly outnumber the manual reports, which also mix with the loads of spam that are (purposely?) pointed at the abuse contacts. This complicates the task of sifting through the mail flow to direct the complaints into their proper bins for processing. There's also the case of those that don't care about abuse originating from their resources. Those are likely to simply devnull their abuse complaint flow just as they have been doing up until now. I believe that having an optional "auto-abuse-mailbox" object (that is mandatory to use when present) dealing only with automated reports, could help anti-abuse operators (both in the report sending and receiving sides). The automated, high volume generators can decide not to waste resources with entities that do not have the right objects setup (ie, if there's not an auto-abuse-mailbox, do not generate the report) and the entities that are not prepared to deal with automated reports, could signal that to the community by not defining an auto-abuse-mailbox. Note that I still support the notion of a mandatory abuse-mailbox where manual complaints can be sent. At least that takes a way a lot of (guess)work out of figuring out where to send the complaint. Best regards -lem

17 50

Re: [anti-abuse-wg] 2011-06 Review Phase Extension
by Jørgen Hovland 31 Jul '12

31 Jul '12

5 4

2011-06 Review Phase Extension
by Brian Nisbet 31 Jul '12

31 Jul '12

Colleagues, Thank you all for your discussion on 2011-06, however I will admit that the picture of how the Working Group stands in regards ton consensus is not clear. At various points in time different members of the WG have spoken up, voiced objections, agreed, asked questions or answered questions, but in several circumstances the opinions were still not clear after all the discussion. In order to try to get a clear idea of how to progress and after speaking to the NCC in regards to the PDP I have decided to extend the Review Phase by four weeks to see if that can produce some clarity. I would ask if members could raise any points that they are still uncertain about and state as clearly as possible, their current opinion on the proposal. I would encourage everyone to read the last mails from Tobias and the NCC (in the guise of Denis Walker) as they address a number of points. While I'm hoping we can get a clearer picture in less than four weeks given that we are now in mid-summer, a decent period of time seemed like a good idea. Thanks, Brian, AA-WG Co-Chair

4 5

Re: [anti-abuse-wg] the mandatory abuse field
by Frank Gadegast 29 Jul '12

29 Jul '12

Lu Heng wrote: >> region, where its legal to abuse computers and services) >> > > Every country has different legal definition about spam, or "abuse", Again, "every country" does not count. Its illegal in my country, and they are harming me personal as well as my business, so I can call them criminals. > spam and abuse are very broad term, without court judgement of the Thats right, but as for the RIPE region, it will only count, whats law in the RIPE region and most countries have very similar laws here, specially those in the EU. > activity, I will be very careful calling anybody criminal--as I don't > have the rights to identify them(I am not sure which country you came > from, ( that why I usally do not hide and add a sig) > at least the countries I ever heard of in my life, the rights of > identify someone as criminal are only hold by judges. not even police > has rights to call someone criminal--they can call "suspect"). So I can call those criminals, that are already in jail ? Well, happening every day in Germany. > Ripe region cross wide range of culture and countries, I don't believe > anybody in any specific region has rights to define what is "abuse" > for another very different country. and especially regarding the legal > terms like "criminal" is very serious term that I don't believe > anybody has rights to identify the entire ripe region's population, > not even EU, as Ripe covers wider area than EU does. Sad enough, what a stupid idea to set up an organization without common law ... > But again, Ripe is only a registration service, No RIPE is a community. RIPE NCC is offering the services. > Ripe NCC has no rights > either the entire community has no rights to identify any body in a > legal term, if a spammer need an IP range for a technical term, Ripe > NCC has to give to them--It is not Ripe NCC's position to judge Never said and sure not. The NCC can give the resources to any MEMBER ! They are not giving them to the community ! Only to members. So: why should the community decide about the format of the database ? > anybody's action if legal, seems to me so many times people forget > that Ripe NCC is only a registration service, they are not government > of the internet, either they need a police force to regulate the > internet. Well, the police IS regulating the internet, according to the laws of several countries and every day criminals are being send to jail for some computer crime. Worldwide. And if they are allowed to use an internet terminal in their cell, they could even post here, that a mandatory field is stupid, without any good reson against it. And the so-called "community" then does not have any consensus ... Oh, Im fantazising know ... Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

Re: [anti-abuse-wg] the mandatory abuse field
by Frank Gadegast 28 Jul '12

28 Jul '12

H.Lu wrote: > Hi > Hi, >> So, my personal summary is: >> --- >> Anybody, who is against a mandatory abuse field, >> is a professional spammer, abuser, maintains >> a bot net or sells open proxies or other services >> used for abusing others. >> They are criminals to my opinion. >> > > I think this is a bit too absolute... Not at all. There is only four types: 1 people that do like to do something against abuse originating from there resources 2 people that do like to do something against abuse reaching there networks 3 people that do not like to do anything against abuse originating from there networks Some of those interest could be combinated. (and all those will have no problem with the mandatory abuse field, they will either love it or they can ignore it) and: 4 people that dont want that others have it easier to work against spam THEY cause > > But even they are, identify them as criminal might not be true as in some country spam might not even consider as offense. Well, its illegal in my country, so I can call them criminals. (please do me a favor and name one country in the RIPE region, where its legal to abuse computers and services) The big question is: - should we stop any progress in spam reporting and the cleanup of the database because of people, that are criminals in most member countries ? - and that are not even located in the RIPE region ? - and that are no members ? The following always puzzled me anyway: how can people influence the regulations without being members or without bing located in the RIPE region ? The members pay the service and to my opinion, paying members should be the only ones, we should listen too. Its a weird situation, that anybody from whatever country with whatever background or regulations can influence everything. Lets take ICANN as an example: do you really think that I will have the chance to influence a vote at the ICANN members board without being a member ? Well, they might listen, what others have to say, but finally it will be a vote. Lets have a vote asking all RIPE members abuse this proposal instead of listening to every criminal from the world ... Kind regards, Frank >> But thats only my impression ... >> --- >> >> >> Kind regards, Frank >> -- >> PHADE Software - PowerWeb http://www.powerweb.de >> Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de >> Schinkelstrasse 17 fon: +49 33200 52920 >> 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 >> ====================================================================== >> > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

Re: [anti-abuse-wg] [policy-announce] 2011-06 Review Period extended until 13 August2013 (Abuse Contact Management in the RIPE NCC Database)
by Jamie Stallwood 27 Jul '12

27 Jul '12

Seems reasonable to me, I have no objections. Kind regards Jamie Stallwood Jamie Stallwood Security Specialist Imerja Limited Tel: 0844 225 2888 Mob: 07795 840385 Jamie.Stallwood(a)imerja.com NIC Handle: uk.imerja.JS7259-RIPE -----Original Message----- From: policy-announce-bounces(a)ripe.net [mailto:policy-announce-bounces@ripe.net] On Behalf Of Marco Schmidt Sent: 17 July 2012 14:26 To: policy-announce(a)ripe.net Cc: aa-wg-chairs(a)ripe.net; tk(a)abusix.com; anti-abuse-wg(a)ripe.net Subject: [policy-announce] 2011-06 Review Period extended until 13 August2013 (Abuse Contact Management in the RIPE NCC Database) Dear Colleagues, The Review Period for the proposal 2011-06 has been extended until 13 August 2012. You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2011-06 We encourage you to review this policy proposal and send your comments to <anti-abuse-wg(a)ripe.net>. Regards, Marco Schmidt on behalf of Policy Development Officer RIPE NCC -- Imerja Limited Tel: 0870 8611488 | Fax: 0870 8611489 | 24x7 ISOC: 0870 8611490 | Web: www.imerja.com Registered Office: Paragon House, Paragon Business Park, Chorley New Road, Horwich, Bolton BL6 6HG Registered in England and Wales No. 5180119 VAT Registered No. 845 0647 22 ISO Registered Firm No. GB2001527 This email is confidential and intended solely for the person or organisation to which it is addressed. It may contain privileged and confidential information. If you are not the intended recipient(s) you should not use, copy, distribute or take any action or reliance on it, since to do so is strictly prohibited and may be unlawful. If you have received this transmission in error please notify the sender immediately by email reply and delete it from your system. E-mail messages are not secure and attachments could contain software viruses which may damage your system. Whilst every reasonable precaution has been taken to minimise this risk, Imerja Limited cannot accept any liability for any damage sustained as a result of these factors. You are advised to carry out your own virus checks before opening any attachment. Any views or opinions expressed in this e-mail are solely those of the author and do not represent those of Imerja Limited unless otherwise stated.

1 0

Re: [anti-abuse-wg] Manual vs automated reports
by Reza Farzan 26 Jul '12

26 Jul '12

Hi Tobias, Thank you for you comments. Storing abuse contact details in one location makes perfect sense and satisfies many who are concerned about Abuse/Spam activities. Further simplifying this often confusing aspect of Abuse reporting channel in Whois directory should be one of the goals for RIPE's Anti-Abuse WG. Without any reservations, I support this practical proposal. Thank you, Reza Farzan +++++++++ -----Original Message----- >From: Tobias Knecht <tk(a)abusix.com> >Sent: Jul 26, 2012 10:57 AM >To: anti-abuse-wg(a)ripe.net >Cc: Denis Walker <denis(a)ripe.net>, rezaf(a)mindspring.com >Subject: Re: [anti-abuse-wg] Manual vs automated reports > >Hi everybody, > >> If the policy proposal 2011-06 is approved by the community we can work >> towards storing abuse contact details in one location, referenced in one >> way and easily readable by humans and scripts. Of course it won't solve >> all problems, as some people were hoping for. But it is the first step >> of what can be a journey towards a more complete solution. > >That is absolutely true, there are some other important things that'll >need coverage step by step. > >Never the less this proposal is imho an important step into the right >direction, so please let Brian and me know if you are on the same page >or have any concerns. In both cases please let us know if you support >the proposal or if you have concerns. > >Thanks, > >Tobias >

1 0

Re: [anti-abuse-wg] Manual vs automated reports
by Reza Farzan 25 Jul '12

25 Jul '12

To complement what Alessandro said, it is good that RFC 6650 splits abuse complaints between "solicited" and "unsolicited" ones, even though it may confuse common users. The "solicited" should be reserved for Spam Cop, and other administrators who are trying to report Abuse/Spam activities to a network. The "unsolicited" channel could be like a web form that encourages users to report Abuse/Spam activities to a network like the one that GoDaddy has: https://supportcenter.godaddy.com/Abuse/SpamReport.aspx?ci=22420. This way, the "solicited" channel (abuse(a)domain-name.com) would remain free of unsolicited inquiries, and network administrators could mange it more efficiently and process legitimate reports promptly. Thank you, Reza Farzan =========== -----Original Message----- >From: Alessandro Vesely <vesely(a)tana.it> >Sent: Jul 24, 2012 2:22 PM >To: anti-abuse-wg(a)ripe.net >Subject: Re: [anti-abuse-wg] Manual vs automated reports > >On Tue 24/Jul/2012 17:34:01 +0200 Luis Muñoz wrote: >> I believe that having an optional "auto-abuse-mailbox" object (that >> is mandatory to use when present) dealing only with automated >> reports, could help anti-abuse operators (both in the report >> sending and receiving sides). > >Let me add one consideration to what Tobias wrote: > >RFC 6650 splits abuse complaints between "solicited" and "unsolicited" >ones. Also known as feedback loops, the former can be automated >according to the underlying agreement. One can use a different >reporting addresses for each subscription. > >Unsolicited complaints deserve a bit of thought: Who is sending them? > Why? When such questions are cleared, the stream of reports from >that operator can be directed to the appropriate bin, possibly by >negotiating a different address with the report generator. In fact, >that is the same as establishing a feedback loop, and it cannot be >automated fully for the same reasons why subscriptions to the early >kind of feedback loops cannot. > >See http://tools.ietf.org/html/rfc6650#section-5.5

2 1

Due Diligence for the Quality of the RIPE NCC Registration Data
by Axel Pawlik 25 Jul '12

25 Jul '12

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC procedural document, "Due Diligence for the Quality of the RIPE NCC Registration Data", has been published. The document is available at: https://www.ripe.net/ripe/docs/due-diligence The RIPE NCC has a mandate from the RIPE community to keep an up-to-date and correct Internet number resource registry. In order to comply with this mandate, the RIPE NCC performs due diligence on organisations the RIPE NCC registers Internet number resource for. This document outlines the minimum information and documentation the RIPE NCC requires to make sure that the registration data is valid and up-to-date. Regards, Axel Pawlik Managing Director RIPE NCC

2 1