August 2016 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final
by Marilson 02 Sep '16

02 Sep '16

On Aug 31, 2016 02:22 AM Andre Coetzee wrote: > Just this very long thread and all the confusion about what is actually > Internet abuse and what is not - serves as plain and evident proof that > even this, an actual anti-abuse WG, desperately needs a definition of > Internet Abuse. Civil society is simply ignorant of their own > requirement(s). First I want to thank you for having changed your attitude and not have mocked. I do not know whether the members of the group desperately needs a definition of Internet Abuse. But as a member of civil society, non-technical in IT, end user of the Internet and real victim of abuse, I can guarantee you that we need desperately is an ethical and honest behavior on the part of ISPs. The rest has not the least importance. For me it is not clear your goal. But it is not of my business. And I congratulate you again. But if you intend to use the technical definition of Internet Abuse to decide whether the complaint of a victim of abuse should or should not put a domain on the blocklist, your group will not have credibility. You will be thwarting a real victim of abuse to have his case met due to a technicality. > 2. I am also ac(a)spamcop.net - SpamCop is also a community although > operated graciously and ethically by Cisco. We are all honorable, > ethical and honest people - I challenge you in public to tell me the > name or email address of one SpamCop member that is not that? You continue underestimating people. Sorry to disappoint you. I threw a bait - spamcop - and you bit. ;) Regarding your challenge I will make much more than you asked for. I will paste below the only two messages between me and a spamcop member. And these messages occurred only because I was forced to complain about the SpamCop by copying for Cisco's Privacy Mailer. All my messages addressed to support(a)spamcop.net correcting the source of spam identification were constantly ignored by these honorable and ethical people. I was throwing away my time because the reports, via spamcop, would never come to the sources of scam. To solve this I appealed to Cisco: (follow the dates - had to insult to be attended) From: SpamCop/Richard Sent: Monday, January 11, 2016 5:48 PM To: marilson.mapa(a)gmail.com Subject: Re: Fw: Spamcop error Thank you for the information. A cache refresh has changed the reporting addresses used for 212.47.224.0/19 Richard Please include previous correspondence with replies .:|:.:|:. ******************************************** From: Marilson Sent: Monday, January 11, 2016 6:34 AM To: privacy(a)cisco.com Subject: Fw: Spamcop error Thank you for nothing, arrogants of shit... ******************************************* From: Marilson Sent: Friday, December 11, 2015 12:11 PM To: privacy(a)cisco.com Subject: Spamcop error Gentlemen, your subsidiary Spamcop is incurring a mistake repeatedly. I can not find a way or formulary to contact spamcop and explain where the error is. I appeal to you to resolve this problem: I managed that a known Brazilian spammer, who uses spam to practice embezzlement, be put out of 2 or 3 ISPs. Now he is using a new provider - Tiscali.fr - with the IP 212.47.244.217. To this IP the address is abuse(a)proxad.net To tiscali.fr, a subsidiary of tiscali.it, is abuse(a)it.tiscali.com Spamcop insists on using abuse(a)tiscali.fr This address does not exist. If this is not corrected the criminal spammer will not be denounced. Thanks Marilson ******************************************* As requests for corrections continued to be ignored, I decided to check the send to the correctly identified sources. Now the disappointment was absolute. No complaint was sent. More than a year doing complaints and nothing was sent. I decided upending the tea table and treat them with the respect they deserved: From: Marilson Sent: Wednesday, August 17, 2016 1:55 PM To: SpamCop/Richard Cc: privacy(a)cisco.com ; guardian.readers(a)theguardian.com ; The Wall Street Journal ; spam(a)uce.gov ; gmail-abuse(a)google.com Subject: Re: [SpamCop (208.84.242.164) id:6470587522]=?UTF-8?B?Q09SUkVJT1MgLSBPYmpldG8gYWd1YXJkYW5kbyBy.. ...to help me identify the source of spam ?!? I don’t need help of anyone to identify the source of spam. Several times I corrected your wrong source. I do this better than your company. What I can not do is block a domain. Yes, I opted to send a copy of each of these reports to my own address AND FOR THOSE NETWORKS REFERENCED IN SCAN. > You then flipped out on Cisco's Privacy Mailer because we were sending you mail, mail you sent yourself. Are you crazy? A half-wit? Is that your excuse for your criminal behavior? I copied to Cisco’s Privacy Mailer because you never sent any of my complaints for those networks referenced. During an entire year, liar idiot. Countless hours were lost because of you, rascal. You must to learn to respect the people. (follow various insults that I can not repeat at this working group) Marilson ***************************************************************** From: SpamCop/Richard Sent: Wednesday, August 17, 2016 12:14 PM To: Marilson Subject: Re: Fw: [SpamCop (208.84.242.164) id:6470587522]=?UTF-8?B?Q09SUkVJT1MgLSBPYmpldG8gYWd1YXJkYW5kbyBy.. I think you missed the point of my first writing. SpamCop has been here for the last year to help you identify the source of spam you receive and help you send a complaint to the parties that are responsible for those networks sending the spam. As part of your settings, you opted to send a copy of each of these reports to your own address. This was an email from you (your SpamCop account) to you. You then flipped out on Cisco's Privacy Mailer because we were sending you mail, mail you sent yourself. SpamCop operates very independently of Cisco. The privacy office is in place to ensure we operate according to the privacy policy published by Cisco and to investigate where there is an accusation or suspicion the privacy policy may have been breached... *************************************************************** Well Andre, Richard is not a honorable, ethical and honest guy. You can use the argument you wish to explain these facts. But I will not discuss it, in this group, with you. My goal was to denounce spamcop here. Thank you. My disputes with SpamCop and Cisco will continue but in other forums. But if you want to discuss the tricks of Netcraft... I am all ears! Marilson

4 5

Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final
by Marilson 31 Aug '16

31 Aug '16

On Aug 29, 2016 Andre Coetzee wrote: > 2. I do not understand Marilson's objections - apparently if someone > steals your pc it is Internet abuse, I eventually thought he meant that > the computer was stolen and used to send spam, --> but the definition > works for that, he agreed the definition stands..., > but then he seems to say that it does not? for an unknown and > non specific reason except that it may or may not include defining > "theft" Definitions Endless Andre, you continue making a mockery of me trying to hide a bad example of abuse chosen by you. The stolen computer was invented by you. To justify your concerns you said to Gunther that a stolen computer is not abuse. At first it was just an unfortunate choice of words. I tried to show that an infected computer and used without the owner's consent, is being stolen. You could have said - I used an inappropriate phrase - but your pride prevented you from doing so and preferred to ridicule my bad English saying that stolen computer is a physical act. What forced me to present several definitions in the use of the theft word. And continue distorting the facts to justify a stupid phrase. I think this group no one will give you the examples of abuse that you request. Do you know why? Because it's an affront to anyone's intelligence set the obvious. Maybe you need a technical definition of Internet Abuse for use on your server that receives spam complaint. But never dare say to a victim of abuse that he is wrong and it is not abuse. If you do you will bury your company. Nobody needs of technical definitions of Internet abuse. I'm hoping that your company becomes larger than SpamCop. SpamCop-Cisco is outdated and has acted partially protecting some companies. Its software is limited to search the records in Whois, which are often false or incomplete. My research to identify all those involved in abuse is better, bigger and more correct than the SpamCop. As a rule I even inform the owner's name of subdomain under protection service of DomainsByProxy-Godaddy, CloudFlare, Whois Privacy Protect-Rightside, etc. On Aug 29, 2016 Suresh wrote: > So far this subthread has been a case of the blind leading the blind, but Marilson is indeed correct here. Suresh, I am not blind yet. But as Diogenes of Sinope, in Ancient Greece, I try to find, with my lantern, an honest ISP. After hundreds of complaints I can tell you that I count on the fingers of one hand the ISPs that have acted correctly. It is noteworthy that there were many discussions, many fights, but never, I never had to discuss whether it was abuse or not. ;) Marilson

3 3

Re: [anti-abuse-wg] RIPE Charter
by Athina Fragkouli 30 Aug '16

30 Aug '16

Dear Ronald, We would like to provide some information in response to the questions you have raised. > The "Publication date" on the "RIPE NCC Articles of Association (2013)” as presented at the URL above is "20 Jan 2014", but RIPE NCC, as a formal association under Dutch law has existed for far longer than that, correct? On what date did RIPE NCC first obtain legal existance under Dutch law? The RIPE NCC was incorporated under Dutch Law on 12 November 1997, when the Articles of Association were deposited with the Amsterdam Chamber of Commerce. The original version of the Articles of Association can be found here: https://www.ripe.net/publications/docs/ripe-176 Since then, the Articles of Association have been updated several times — each time by a resolution that was approved by the General Meeting (GM). The RIPE NCC publishes the latest version of the Articles of Association and keeps a public archive of all previous versions. You can also find all relevant documents presented at each GM where amendments to the Articles of Association were discussed. > In the entire history of RIPE NCC, as a formal association under Dutch law, has there ever been any instance in which The Association has applied either Section 6.1(b) or Section 6.1(e) of the Articles of Association? If so, on how many separate occasions have such terminations occured? > With respect to each such instance, if any, has The Association obeyed in full the stipulation, as to its own behavior contained in Section 10.5 of the Articles of Association? In order for a natural or legal person to become member of the RIPE NCC, they need to sign the RIPE NCC Standard Service Agreement (Article 4). The Standard Service Agreement is a document approved by the GM that can be amended through further GM resolutions (Article 2.3). Accordingly, the termination of a membership is linked to the termination of a member's Standard Service Agreement (see Article 9.5). The Standard Service Agreement may be terminated in accordance with Article 9. This same article states that the particular reasons for termination and the procedures followed are defined in the RIPE NCC procedural document "Closure of Members, Deregistration of Internet Resources and Legacy Internet Resources”. You can find this here: https://www.ripe.net/publications/docs/ripe-640 The most common reason for termination of the Standard Service Agreement is due to non-payment of fees, liquidation or bankruptcy, or when a member ceases to exist for any reason. However, there is a smaller number of cases where the RIPE NCC has terminated Standard Service Agreement because the member: - Submitted fraudulent documents to the RIPE NCC - Did not comply with a RIPE NCC audit - Failed to submit recent proof of their existence (e.g. registration papers from the national authorities). As an association under Dutch Law, the RIPE NCC has to comply with sanctions imposed by the Netherlands and the EU that may restrict us from having a contractual relationship with a member. More information about this is available in the RIPE NCC procedural document "Due Diligence for the Quality of the RIPE NCC Registration Data”. The RIPE NCC has previously terminated the Standard Service Agreement of several parties that were listed in such sanctions. https://www.ripe.net/publications/docs/ripe-669 So far in 2016, around 300 memberships have been terminated for non-payment of fees, liquidation or bankruptcy, or because the member ceased to exist. Around four memberships have been terminated for one of these other reasons (submitting fraudulent documents, failure to comply with audits or failure to supply proof of existence). No memberships have been terminated this year due to sanctions. We would like to draw your attention to the RIPE NCC Report Form on our website. This provides a simple way to report fraudulent information supplied to the RIPE NCC or incorrect information in the RIPE Database, for example. We will investigate any reports we receive through the report form and take action if required. While we will don't report back the results of our investigations directly, we do provide some numbers in our Annual Report each year. In 2015, we received 319 reports through the form: - 131 were reported as incorrect data in the RIPE Database. 67 of these required further investigation by the RIPE NCC. - 180 cases were reported as policy violations, untruthful information or were related to bankruptcy. 143 of these cases turned out not to be policy violations, seven could not be followed up due to lack of information and five resulted in further inquiries. 25 did indeed concern policy violations, untruthful information, or bankruptcy. - Eight cases were not classified as abuse reports but were investigated nonetheless. You can find the report form here: https://www.ripe.net/report-form Kind regards, Athina Fragkouli Head of Legal RIPE NCC Date: Wed, 10 Aug 2016 12:27:04 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] RIPE Charter In message <57AB1227.1070100(a)iszt.hu>, Janos Zsako <zsako(a)iszt.hu> wrote: > No, but you can find the RIPE NCC's Articles of Association at > https://www.ripe.net/publications/docs/ripe-602 Thank you! That document is most helpful. > RIPE does not have "authority" over RIPE NCC, it is the members. In many > cases the RIPE community and the RIPE NCC membership overlap, but not > always. I have many questions. I hope nobody will mind. I will try to be brief. I'm still trying to understand. RIPE is *not* RIPE NCC and vise versa, correct? I mean they are two different things, legally speaking, yes? A person or legal entity could be a member of "RIPE" and yet not be a member of "RIPE NCC", correct? Conversely, could a person or legal entity be a member of "RIPE NCC" and yet _not_ be a member of "RIPE"? Is it correct also that only those persons and legal entities that are actually paying dues to RIPE NCC are members of RIPE NCC? The "Publication date" on the "RIPE NCC Articles of Association (2013)" as presented at the URL above is "20 Jan 2014", but RIPE NCC, as a formal association under Dutch law has existed for far longer than that, correct? On what date did RIPE NCC first obtain legal existance under Dutch law? In the entire history of RIPE NCC, as a formal association under Dutch law, has there ever been any instance in which The Association has applied either Section 6.1(b) or Section 6.1(e) of the Articles of Association? If so, on how many separate occasions have such terminations occured? With respect to each such instance, if any, has The Association obeyed in full the stipulation, as to its own behavior contained in Section 10.5 of the Articles of Association? Regards, rfg

7 13

Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final
by ox 29 Aug '16

29 Aug '16

On Mon, 29 Aug 2016 07:32:57 +0200 ox <andre(a)ox.co.za> wrote: > > I think this now works... any comments? > Also, just to add the outstanding non specific objections that I know of, from other threads: 1. Gunther says that a single resource can abuse, I presume itself? (as in for example you send yourself spam, I guess, as he did not reply to requests for a real world example of such a single resource abuse on a network / Internet, abuse) 2. I do not understand Marilson's objections - apparently if someone steals your pc it is Internet abuse, I eventually thought he meant that the computer was stolen and used to send spam, --> but the definition works for that, he agreed the definition stands..., but then he seems to say that it does not? for an unknown and non specific reason except that it may or may not include defining "theft" 3. Suresh says the proposed definition is too "narrow" and I need to consult with "abuse policy enforcement and network security" experts to know or understand why. He also says: "Your definition of abuse will not stand." and abuse discussions about defining Internet Abuse is the "blind leading the blind" My comments to the all the above objections are: I do not understand any of them, they make no sense and they are mysterious, secret or something? If any of these are in any way valid or contributes to understanding Internet Abuse, please supply any real world examples Even just a single, as in ONE real world example. If the objectors do not even have or cannot even supply, a single real world example, it simply means that they are objecting for the simple sake of objecting and have no valid contribution to make. As an abuse WG discussing many forms of Internet Abuse, much of which is also criminal activity, cyber crime and criminal syndicates, one has to question the motives of simply objecting to something without being able to supply a practical and real example of that which you are stating as a fact. If they do not provide any real world examples of course their objections means nothing - as it is just "noise", interference or obstruction... If any of the objectors provide actual real world examples, of network (Internet) abuse that the definition does not include, this may advance the understanding of Internet Abuse and could serve to improve, change or further define the definition of what Internet Abuse is as well as what it is not. If there are any additional objections that I may have missed, please let me know and let us move forward in our understanding of what Internet Abuse is, so that when we talk about Internet Abuse, we all understand what we are talking about the same thing and not about "we will know it when we see it", because maybe we will not see or know it and very probably we may be all talking about different things and using the same words to do that. It is not in the Interest of many organisations that there should exist a common definition of Internet Abuse, as this is the first step towards effectively educating civil society about exactly what it is and what it is not. At the very least, a technical definition of Internet Abuse should be the work product of this group, as it is supposedly our rai·son d'ê·tre André > ============ > Internet Abuse > ============ > > Understanding what constitutes Internet Abuse is not an easy > undertaking as the topic is sometimes very technical. The Internet > consists of resources and the understanding of Internet abuse relates > to also understanding the use and interaction between these resources. > > Examples of Internet resources include also processes, protocols, > credentials as well as other types of resources. More practical > examples could be Internet Protocol numbers, Domain names or even > Email addresses. > > This technical definition of Internet abuse does not include > identifying the authority for any specific resource as it is not > intended to define any rights to resources but simply to define what > technically constitutes Internet abuse as it relates to all Internet > resources. > > > ====================== > Definition of Internet abuse > ====================== > > "The non sanctioned use of a resource to infringe upon the usage > rights of another resource" > > -------------------------------------------------------- > Terminology used in the above definition > -------------------------------------------------------- > > (1) Resource > Any Internet Resource > > (2) Use and Usage > Any direct or indirect action involving a resource > > (3) Rights > The correct assignment or allocation of a resource by the > authoritative holder of such a resource which results in the > entitlement or reasonable > expectation to use, or ability to use, such an allocated or assigned > resource > > (4) Infringe > An action, event or situation which limits, reduces, undermines or > encroaches upon the fair use of a resource > > (5) Sanctioned > Infringement upon the use of a resource by the assignor or > administrative holder of rights to a resource > > > > On Mon, 29 Aug 2016 07:05:59 +0200 > ox <andre(a)ox.co.za> wrote: > > > On Mon, 29 Aug 2016 06:13:28 +0200 > > Andre Coetzee <andre(a)ox.co.za> wrote: > > > > > The definition of Internet Abuse seems to be done, can everyone > > > please have a look and see if there are any final issues? > > > > > After another off list comment, the description of 'sanctioned' may > > require a change. > > (Big thank you to everyone that has helped me, on and off list) > > > > > > There is still a problem with 'sanctioned' (as originally identified > > by Gert Doering - as complicated :) ) > > > > I do not have any solution or suggestion myself, yet, and will need > > to think about the problem more... > > > > as, what happens when the registrant of an entire TLD authorises the > > use of that TLD to send spam.... > > > > ++++++++++++++ > > "The non sanctioned use of a resource to infringe upon the usage > > rights of another resource" > > > > (4) Sanctioned > > An action, event or situation originating from the authoritative > > holder of rights to a resource that gives permission, or permission > > is granted by direct implication, which authorises that situation, > > event or action. > > +++++++++++++++ > > > > Andre > > > >

1 0

Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final
by ox 29 Aug '16

29 Aug '16

I think this now works... any comments? ============ Internet Abuse ============ Understanding what constitutes Internet Abuse is not an easy undertaking as the topic is sometimes very technical. The Internet consists of resources and the understanding of Internet abuse relates to also understanding the use and interaction between these resources. Examples of Internet resources include also processes, protocols, credentials as well as other types of resources. More practical examples could be Internet Protocol numbers, Domain names or even Email addresses. This technical definition of Internet abuse does not include identifying the authority for any specific resource as it is not intended to define any rights to resources but simply to define what technically constitutes Internet abuse as it relates to all Internet resources. ====================== Definition of Internet abuse ====================== "The non sanctioned use of a resource to infringe upon the usage rights of another resource" -------------------------------------------------------- Terminology used in the above definition -------------------------------------------------------- (1) Resource Any Internet Resource (2) Use and Usage Any direct or indirect action involving a resource (3) Rights The correct assignment or allocation of a resource by the authoritative holder of such a resource which results in the entitlement or reasonable expectation to use, or ability to use, such an allocated or assigned resource (4) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource (5) Sanctioned Infringement upon the use of a resource by the assignor or administrative holder of rights to a resource On Mon, 29 Aug 2016 07:05:59 +0200 ox <andre(a)ox.co.za> wrote: > On Mon, 29 Aug 2016 06:13:28 +0200 > Andre Coetzee <andre(a)ox.co.za> wrote: > > > The definition of Internet Abuse seems to be done, can everyone > > please have a look and see if there are any final issues? > > > After another off list comment, the description of 'sanctioned' may > require a change. > (Big thank you to everyone that has helped me, on and off list) > > > There is still a problem with 'sanctioned' (as originally identified > by Gert Doering - as complicated :) ) > > I do not have any solution or suggestion myself, yet, and will need to > think about the problem more... > > as, what happens when the registrant of an entire TLD authorises the > use of that TLD to send spam.... > > ++++++++++++++ > "The non sanctioned use of a resource to infringe upon the usage > rights of another resource" > > (4) Sanctioned > An action, event or situation originating from the authoritative > holder of rights to a resource that gives permission, or permission > is granted by direct implication, which authorises that situation, > event or action. > +++++++++++++++ > > Andre >

1 0

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Suresh Ramasubramanian 29 Aug '16

29 Aug '16

On 29/08/16, 9:52 AM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > We are discussing Internet Abuse - and, to be clear – I > still have no idea what you are talking about. Your diatribe > makes no sense and I am giving up trying to figure out what > it means as it is simply too much effort. So far this subthread has been a case of the blind leading the blind, but Marilson is indeed correct here. Your definition of abuse (for all that it can be defined in the overly narrow sense you are trying to bog the discussion down into) will not stand. If you have any colleagues that actually do abuse policy enforcement and network security, feel free to talk to them. --srs

2 1

Re: [anti-abuse-wg] Definition of Internet Abuse * pre-final
by ox 29 Aug '16

29 Aug '16

On Mon, 29 Aug 2016 06:13:28 +0200 Andre Coetzee <andre(a)ox.co.za> wrote: > The definition of Internet Abuse seems to be done, can everyone > please have a look and see if there are any final issues? > After another off list comment, the description of 'sanctioned' may require a change. (Big thank you to everyone that has helped me, on and off list) There is still a problem with 'sanctioned' (as originally identified by Gert Doering - as complicated :) ) I do not have any solution or suggestion myself, yet, and will need to think about the problem more... as, what happens when the registrant of an entire TLD authorises the use of that TLD to send spam.... ++++++++++++++ "The non sanctioned use of a resource to infringe upon the usage rights of another resource" (4) Sanctioned An action, event or situation originating from the authoritative holder of rights to a resource that gives permission, or permission is granted by direct implication, which authorises that situation, event or action. +++++++++++++++ Andre

1 0

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 29 Aug '16

29 Aug '16

> On Aug 28, 2016 Andre Ox wrote: > When you say: My Computer was stolen > It means that - Someone physically took your computer away from you Now I understand your obsession to define abuse. Abuse has several definitions as well as the word steal that you defined as being the physical act of taking something that does not belong to you. Shakespeare must be moving in his tomb. Once you think use my computer for illicit purposes and without my consent is not theft, I prepared for you some of the many possible ways to use the word theft. See below, learn and try not to disturb the sleep of Shakespeare. > Your take away should be to learn better English :) > And, this is exactly why we need a good definition of abuse. It is all about words. We need??? Certainly YOU need! After your definition of steal... Why I should be to learn better English?!? For what? What will I do with it? It is strange to hear that from people who not succeed in define abuse and theft. And abuse and theft is a specialty of IT in the email marketing sector. I suggest you read more. Start by great thinkers. And without prejudice start by Nietzsche in On the Genealogy of Morality. > And, Marilson, telling me that I am an example of a single abuse > resource, when all I am doing is simply trying to understand what the > heck you are talking about (as you are using the wrong English words) > is not cool. I did not once call you any names or say anything > personally rude about you, I know exactly how fast things can be in a > third or fourth or even fifth+ language :( Your comments are full of arrogance and veiled insults. And you are being a hypocrite in saying that is not rude. End an offense with a smiley does not improve your attitude. And you need to understand that does not own the truth and must learn to live with contradictory. :) STEAL As verb (used with object): to appropriate (ideas, credit, words, etc.) without right or acknowledgment. to take, get, or win insidiously, surreptitiously, subtly, or by chance. to move, bring, convey, or put secretly or quietly; smuggle. Baseball - (of a base runner) to gain (a base) without the help of a walk or batted ball. Games - to gain (a point, advantage, etc.) by strategy, chance, or luck. to gain or seize more than one's share of attention in, as by giving a superior performance: The comedian stole the show. As verb (used without object): to move, go, or come secretly, quietly, or unobserved: She stole out of the house at midnight. to pass, happen, etc., imperceptibly, gently, or gradually: The years steal by. As noun: Informal - an act of stealing. Informal - the thing stolen. Informal - something acquired at a cost far below its real value; bargain: This dress is a steal at $40. As Idioms: steal someone's thunder, to appropriate or use another's idea, plan,words, etc. Examples from the Web for steal: to steal music without paying a dime for it. to steal and pass off (the ideas or words of another) as one's own. "We steal our own happiness for no apparent reason," says Danziger. “Sometimes they are said to steal only the heart—like Lancashire witches.” John Gibson Lockhart. to steal a glance at to steal a march upon someone to steal a marriage to steal away to steal out to steal upon someone to steal someone’s heart to steal someone’s thunder to steal the show I STOLE this... sorry Andre, I PICKED UP this using Internet. I will tell you when it is forbidden to use the word stole: Great nations never stole, simply took in order to make themselves great. (Solon) Marilson _____________________________________________ Date: Sat, 27 Aug 2016 16:06:20 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: "ox" <andre(a)ox.co.za> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse - preamble Message-ID: <FEF0ACC9459247D986724B37A65789E4@xPC> Content-Type: text/plain; charset="utf-8" Please, Andre. I'm sorry if I'm forcing you to be so so vulgar that I can understand your extraordinary knowledge about abuse on the Internet. Do not worry, your technical colleagues will understand you. Sorry my low intellectual capacity, but you used the following expressions to explain what is not Internet Abuse: > No, it is not an abuse group for people whose pc's has been stolen or abused in their homes. Now, it is clear that you could also have said: the cat crushed by that car is not of account of this abuse group. I'm sorry but I thought you was talking about internet. When I wrote: > If someone had their home PC infected or abused, it's because someone used the means and tools provided by RIRs, Registrars and ISPs. You reply: > Just stealing a pc - Is called theft... > I hope this helps you understand? > If not, maybe you can provide a lot more specifics of how stealing a pc is Internet Abuse? > Thank you so much! Disregarding the excess of arrogance in your words I explained how stealing a pc is Internet Abuse: > If a computer was infected for sending spam or malicious files, it was stolen. After all we are talking about Internet, right? And you wrote in your second reply: > If someone steals your PC or breaks into your home to steal your pc It is NOT Internet Abuse... (emphasis added) Wow! Now we are talking about breaking and entering to steal objects, that is, we are talking about the cat crushed by that car is not of account of that abuse group. Compare with the original sentence: ?No, it is not an abuse group for people whose pc's has been stolen or abused in their homes.? You were talking about potatoes and I was talking about orange. The difference is that my orange was synonymous of Internet and their potato was ... potatoes. Just to be technically clear :) Pall, you are a real world example of a single resource abuse. But your definition still holds up... Good lucky Marilson

2 1

Definition of Internet Abuse * pre-final
by Andre Coetzee 29 Aug '16

29 Aug '16

The definition of Internet Abuse seems to be done, can everyone please have a look and see if there are any final issues? ============ Internet Abuse ============ Understanding what constitutes Internet Abuse is not an easy undertaking as the topic is sometimes very technical. The Internet consists of resources and the understanding of Internet abuse relates to also understanding the use and interaction between these resources. Examples of Internet resources include also processes, protocols, credentials as well as other types of resources. More practical examples could be Internet Protocol numbers, Domain names or even Email addresses. This technical definition of Internet abuse does not include identifying the authority for any specific resource as it is not intended to define any rights to resources but simply to define what technically constitutes Internet abuse as it relates to all Internet resources. ====================== Definition of Internet abuse ====================== "The non sanctioned use of a resource to infringe upon the usage rights of another resource" -------------------------------------------------------- Terminology used in the above definition -------------------------------------------------------- (1) Resource Any Internet Resource (2) Use and Usage Any direct or indirect action involving a resource (3) Rights The correct assignment or allocation of a resource by the authoritative holder of such a resource which results in the entitlement or reasonable expectation to use, or ability to use, such an allocated or assigned resource (4) Sanctioned An action, event or situation originating from the authoritative holder of rights to a resource that gives permission, or permission is granted by direct implication, which authorises that situation, event or action. (5) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource

1 0

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 28 Aug '16

28 Aug '16

Please, Andre. I'm sorry if I'm forcing you to be so so vulgar that I can understand your extraordinary knowledge about abuse on the Internet. Do not worry, your technical colleagues will understand you. Sorry my low intellectual capacity, but you used the following expressions to explain what is not Internet Abuse: > No, it is not an abuse group for people whose pc's has been stolen or abused in their homes. Now, it is clear that you could also have said: the cat crushed by that car is not of account of this abuse group. I'm sorry but I thought you was talking about internet. When I wrote: > If someone had their home PC infected or abused, it's because someone used the means and tools provided by RIRs, Registrars and ISPs. You reply: > Just stealing a pc - Is called theft... > I hope this helps you understand? > If not, maybe you can provide a lot more specifics of how stealing a pc is Internet Abuse? > Thank you so much! Disregarding the excess of arrogance in your words I explained how stealing a pc is Internet Abuse: > If a computer was infected for sending spam or malicious files, it was stolen. After all we are talking about Internet, right? And you wrote in your second reply: > If someone steals your PC or breaks into your home to steal your pc It is NOT Internet Abuse... (emphasis added) Wow! Now we are talking about breaking and entering to steal objects, that is, we are talking about the cat crushed by that car is not of account of that abuse group. Compare with the original sentence: “No, it is not an abuse group for people whose pc's has been stolen or abused in their homes.” You were talking about potatoes and I was talking about orange. The difference is that my orange was synonymous of Internet and their potato was ... potatoes. Just to be technically clear :) Pall, you are a real world example of a single resource abuse. But your definition still holds up... Good lucky Marilson From: ox Sent: Saturday, August 27, 2016 11:42 AM To: Marilson Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse - preamble On Sat, 27 Aug 2016 16:16:09 +0200 > "Marilson" <marilson.mapa(a)gmail.com> wrote: > > If a computer was infected for sending spam or malicious files, it > > was stolen. After all we are talking about Internet, right? Are you > > talking about what? Home invasion? Theft of objects? > Just read what you, yourself are typing above: > "If a computer was infected" - this means that: > Someone or something did something > Someone or Something (or a program or whatever) DID infect > So, the definition of Internet Abuse, As I have stated it - Works > perfectly fine. > Maybe If you read the definition again, it can help you? > > "The non sanctioned use of a resource to infringe upon the usage > rights of another resource" > > This means: Someone (or something) USED you resource (Your PC) > to send spam or do something or use it for... > Just in case someone technical now wants to tell me that a "pc" is not an Internet Resource, PLEASE note: I am simply making it VERY simple so that Marilson can understand it also... In the example - the internet resource would of course NOT be Marilson's PC - BUT his PC's resource (IP number, etc) or the resource that Marilson's PC uses, on the Internet, - to abuse ANOTHER resource... Just to be technically clear :) And then, there is still no real world example of a single resource abuse. So, I guess that means that the definition still holds up... Andre > See? > > - If someone steals your PC or breaks into your home to steal your pc > It is NOT Internet Abuse... > > If they break in and USE your PC to send spam - Then of course it is > Internet Abuse - and the definition holds up. > > BUT > > You are changing the point... You were siding with Gunther, and what > Gunther said was: > > a Single resource can do Internet Abuse... > > You are involving multiple resources and then claiming that it > addresses the first problem... > > Not cool, so either you are arguing for the simple sake of arguing or > you do not understand the problem. > > Which is it? > > Andre >

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 27 Aug '16

27 Aug '16

On Aug 27, 2016 09:42 AM Andre wrote: > Just stealing a pc - Is called theft... > I hope this helps you understand? > If not, maybe you can provide a lot more specifics of how stealing a pc is Internet Abuse? Of course I do. In my explanatory statement I explained how stealing a pc is Internet Abuse. I wrote: >> If someone had their home PC infected or abused, it's because someone... If a computer was infected for sending spam or malicious files, it was stolen. After all we are talking about Internet, right? Are you talking about what? Home invasion? Theft of objects? I hope this help you understand. And Gunther was also right when he cited the problem of non-native language. If you want punch knife tip, be my guest. Marilson From: ox Sent: Saturday, August 27, 2016 9:42 AM To: Marilson Cc: gnitzsche(a)netcologne.de ; anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse - preamble On Sat, 27 Aug 2016 09:20:21 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > Hi Andre, > I have a real world example of Internet abuse: > When people whose pc's has been stolen or abused in their homes. > Not Internet Abuse. Someone still has to "use" that PC and do something with it - to something else... Just stealing a pc - Is called theft... I hope this helps you understand? If not, maybe you can provide a lot more specifics of how stealing a pc is Internet Abuse? Thank you so much! Andre

2 2

Re: [anti-abuse-wg] Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

You might find "I know it when I see it" as reasonable a definition as this group is ever going to arrive at --srs > On 27-Aug-2016, at 6:17 PM, ox <andre(a)ox.co.za> wrote: > > On Sat, 27 Aug 2016 18:04:53 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> The one takeaway i get from this seems to be that the bad guys are >> perfectly aware of just where they can find loose or poorly >> implemented security and abuse policies - who is incompetent, who is >> malicious, who to abuse, who not to abuse >> >> And action if any gets taken only after significant pressure is >> applied. >> > true... as per the convo - easy to find a .ru upstream, etc. > > But, it is becoming more obvious that before we can deal with anything > properly anyway, we need to be able to properly define what it is. > > How can anyone expect anyone to implement proper abuse policies if > open society cannot even agree, openly, about what internet abuse even is? > > Andre >

2 1

Re: [anti-abuse-wg] Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

The one takeaway i get from this seems to be that the bad guys are perfectly aware of just where they can find loose or poorly implemented security and abuse policies - who is incompetent, who is malicious, who to abuse, who not to abuse And action if any gets taken only after significant pressure is applied. --srs > On 27-Aug-2016, at 2:39 PM, ox <andre(a)ox.co.za> wrote: > > On Sat, 27 Aug 2016 14:05:38 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> Curious - what factors would these be that you identified? >> > But, at least two or more of the five factors are so very clear? > > imho the most obvious is: > Effectively managing abuse depends on the interaction and relationship > between two main and different techs of the Internet > > Those engineers that route and those that are system engineers > > The second most obvious thing, in my opinion, may be that if you ask > ten of either of these what constitutes Internet abuse, you will > receive at least two and as much as five (or more), different answers. > > and then there are so many other factors, what do you think the factors > are? > > > Andre > >> >>> On 27-Aug-2016, at 2:00 PM, ox <andre(a)ox.co.za> wrote: >>> >>> On Sat, 27 Aug 2016 13:41:28 +0530 >>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>>> Worth a read >>>> http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… >>>> >>> Yes, the actual logs that Brian Krebs publishes, of the >>> conversations, underlines and serves as clear proof of those >>> factors which serves to obtuse anti abuse efforts. >>> >>> Until this is resolved, Internet abuse will continue to be >>> difficult to manage. This makes it difficult for anyone one the >>> Internet, including the Cyber Criminals themselves, to deal with >>> Internet abuse effectively anyway. >>> >>> 2c >>> >>> Andre >>> >>> > >

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 27 Aug '16

27 Aug '16

Hi Andre, I wrote that the group was one step closer to doing what Friedrich Nietzsche did in the century XIX discussing On the Genealogy of Morality... my mistake. With my professional and cultural background, I tend to believe that in communities like this, the objectives may be altruistic. But reading this discussion get the impression of not declarable goals. Excuse me if I'm wrong. On 25 Aug 2016 05:40 PM, Gunther wrote to Andre: > My intent is to have a most broad definition of abuse as possible. > You seem to intentionally want to restrict this definition. I just don't know why. I do not know why too. >> It is the RIPE Anti Abuse WG --- We discuss network abuse.... (Andre) > Well, I do not see very much discussing here - just a very "blocking" attitude. (Gunther) I agree with “just a very blocking attitude”. On 25 Aug 2016 06:14 PM, Andre wrote: > So, if you could please just provide a real world example of Internet abuse where there is a single resource, that would be very helpful. I have a real world example of Internet abuse: When people whose pc's has been stolen or abused in their homes. Exactly the example you used to explain what is not internet abuse. If someone had their home PC infected or abused, it's because someone used the means and tools provided by RIRs, Registrars and ISPs. And the ISP, owner of this domain, has to take the measures stated in the contract and AUP. And for both, identifying who committed the offense must be available on the Whois for the owner of the invaded PC. Otherwise it will not be abuse, will be crime - conspiracy. So, Andre, do not complicate. It's all so obvious... All abuse committed via the Internet is Internet abuse and abuse occurs when you do not respect the rights of someone, company or institution. And no matter in what hole of the world is the victim. Thank you Marilson

2 1

Re: [anti-abuse-wg] Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

Curious - what factors would these be that you identified? --srs > On 27-Aug-2016, at 2:00 PM, ox <andre(a)ox.co.za> wrote: > > On Sat, 27 Aug 2016 13:41:28 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Worth a read >> http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… >> > Yes, the actual logs that Brian Krebs publishes, of the conversations, > underlines and serves as clear proof of those factors which serves to > obtuse anti abuse efforts. > > Until this is resolved, Internet abuse will continue to be difficult to > manage. This makes it difficult for anyone one the Internet, > including the Cyber Criminals themselves, to deal with Internet abuse > effectively anyway. > > 2c > > Andre > >

2 1

Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

Worth a read http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… --srs

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 04:38 PM, ox wrote: > ... > I did not reply to this, as it will involve me being somewhat direct but, > > I have a serious problem with people when they disagree just to argue > or for no real reason. Hmm.. I still do not see any arguments against my abuse definitions except: no, I want mine. You are getting somewhat emotional here - no good. > > This means that they have a different intent - or agenda - or something > and it serves only to disrupt > My intent is to have a most broad definition of abuse as possible. You seem to intentionally want to restrict this definition. I just don't know why. But if other members of this list tend more to your definition, it will be fine for me. >>>> I even doubt that the anti-abuse-working-group is limited to >>>> network based abuse. Entering wrong registration data (let's say by >>>> FAX) could also be covered by this group though it is not a network >>>> based abuse. >>>> > This is not an abuse group for battered men or battered women or abused > animals. What are you talking about? Yes, this group is not about animals, I agree .. but what the heck..? > > It is a network abuse group. > > No, it is not an abuse group for people whose pc's has been stolen or > abused in their homes. > > No, it is not an abuse group for old fax machines or faxing of fake > documents to anyone or even for that matter faxing of documents to > commit fraud. Says who? You are, as I do, a member of this mailing list and therefore a standard member of the anti-abuse-working-group. As far as I know you are no chair nor co-chair of this group and you are not in the position to define what to discuss in this group or not. (neither am I) I don't care if abuse is commited by old or new fax machines; if it somehow involves our/any abuse-department I do care. And if I (or i.e. legal authorities) cannot identify a fraudster because of a fake registration (DNS, IP-Allocation, whatsoever..) than I do see a direct relation to this group, regardless of the used technique. So yes, it *might* be the case that a fax triggers an abuse case. I don't want to talk about fax machines all the time - I just want a definition of abuse and of the goals of this group which *allows* me and others to discuss abuse incidents regardless of the terms "internet abuse" or "a second resource". I don't think, that this wish is that abstruse.. >It is the RIPE Anti Abuse WG --- We discuss network abuse.... Well, I do not see very much discussing here - just a very "blocking" attitude. tl;dr: I prefer a very broad definition of abuse not restricted to "internet abuse" best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 03:36 PM, ox wrote: > On Thu, 25 Aug 2016 15:28:58 +0200 > Gunther Nitzsche <gnitzsche(a)netcologne.de> wrote: >> On 08/25/2016 02:38 PM, ox wrote: >>> Get it yet? >>> >> No. Sorry. :-( > okay, I will try to explain it better :) > > > Normal bitcoin mining abuse = You --> CPU > > Anyway, Internet abuse same principle One resource --> another resource > > Get it now? I know what you mean, but I don't follow you here. I do not want this restriction and cannot see one reason why you insist on this. >> "If you use my server to do something. " Stop. >> I do not need "another resource". I wonder what arguments >> you have against my suggestion of wording. >> >> I even doubt that the anti-abuse-working-group is limited to >> network based abuse. Entering wrong registration data (let's say by >> FAX) could also be covered by this group though it is not a network >> based abuse. >> > wrong registration data by fax - is not Internet abuse (doubtful if it > even normal or just abuse...) First: I do not know why you also insist on "internet abuse" - I did not see any mention of this restriction in the existing charter of this group Second: It might very well turn into "Internet abuse" i.e. when it comes to find out sources of (other) abuse related actions. If the whois-record is wrong, one could identify this registration fake as abuse. (the severity might vary) So it might be a good idea to have this issue on topic right from the beginning. In your definition a registration fake is no abuse because only one resource is involved *and* because it did not happen via the internet; in my definition it is and it belongs to the topics of this group. We can setup a doodle for this :) As long as we don't hear other opinions on this I step back again .. best greetings, Gunther >> No artificial restrictions please; they might hurt us later on. >> >> NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 02:38 PM, ox wrote: > Hello Gunther, > > Okay, I have read through your reply and it seems you do not understand > that a single resource is not a network. > > Internet Abuse - Needs two resources - otherwise it is not a network > and by default - not Internet Abuse. > > If you are on my server: > unauthorized - is abuse > authorized - is not abuse > > If you use my server to do something to another resource... > > Get it yet? > No. Sorry. :-( "If you use my server to do something. " Stop. I do not need "another resource". I wonder what arguments you have against my suggestion of wording. I even doubt that the anti-abuse-working-group is limited to network based abuse. Entering wrong registration data (let's say by FAX) could also be covered by this group though it is not a network based abuse. No artificial restrictions please; they might hurt us later on. best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/24/2016 12:21 PM, ox wrote: > yes at least 2 different resources always has to be involved for it to > be Internet Abuse Thanks for pointing this out, but I don't get it .. why do you want ro restrict the definition in this way? There might be the case that next year someone brings up a topic of abuse not covered by this restriction and people involved start to argue. I prefer to be as general as possible when defining such a word. ... > if you use the same resource it is not Internet Abuse - as in your own > example using someone's CPU to mine bitcoin and doing so on the CPU > directly, is not Internet Abuse (it is very abusive, though!) Of course it is - I remotely (via the internet) control your server, doing abusive things. If someone would complain at abuse@ about such an incident I would expect the source provider to act accordingly. The remote control can be a security breach, but that is not the point. > if you have broken in/compromised security etc - it is Internet abuse, > in terms of the current definition In the example of directly using my > email server to send spam it falls within the definition of Internet > abuse as defined above :) I do not see the second resource involved in this case. So therefore I would like to change the sentence to: "The infringement of usage rights by the non sanctioned use of resources" along with your additional definitions.. (This includes >=1 resources..) (Someone might correct my english) (instead of: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ") and btw .. I would also like to see Ronald's valid questions answered. If there are no actions, sanctions whatsoever following the definition of abuse and the ongoing discussions here than this Group has officially turned into a Debate Club of old nerds (including me:), beeing probably kind of ... how do I say...inefficient? (at least as a RIPE working group) ...But.. On the other hand: https://www.ripe.net/support/abuse : "The RIPE community has an Anti-Abuse Working Group <https://www.ripe.net/ripe/groups/wg/anti-abuse> that discusses topics relating to Internet abuse and ways to prevent it. If you are interested in abuse topics, you may want to join the Anti-Abuse Working Group Mailing List <http://www.ripe.net/mailman/listinfo/anti-abuse-wg/>." and: https://www.ripe.net/participate/ripe/wg/anti-abuse : (as Brian said in 2013: "The main text of that page is the WG Charter. It may be useful to be more explicit on this, but that is the charter. " "...The working group considers both technical and non-technical aspects of abuse, with the following goals: * Produce and continue to update a BCP (Best Common Practice) document for ISPs similar in nature to RIPE-409 <https://www.ripe.net/publications/docs/ripe-409> but covering a wider range of possible abusive behaviours. * Provide advice (beyond that of the BCP) to relevant parties within the RIPE region such as ISPs, governments and law enforcement agencies on strategic and operational matters. * Discuss and disseminate information on technical and non-technical methods of preventing or reducing network abuse." That could mean we should just focus on the configuration of spamassassin and force the use of dmarc and x-arf and talk about "to block or not to block a failed DKIM E-Mail" like other anti-abuse groups do instead of e.g. trying to force RIPE NCC to terminate LIR contracts based on abusive behaviour. (no irony) So instead of searching a definition of abuse (which will be really helpful I believe) we also could start to (re-)define the goals of this group. If there would be consensus that it is not the task of this group to discuss also anti-abuse behaviour of RIPE/RIPE NCC or how to treat LIRs, then we can happily focus on other things. (In that case: sorry Ronald..) But that would not be my opinion.. >Andre (searching for cover:) best greetings, Gunther NetCologne Systemadministration -- (The opinions expressed here represent my own and not those of my employer.) NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

3 3

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 25 Aug '16

25 Aug '16

Andre, Is praiseworthy your efforts as was the effort by Denis in this group. Sometimes I have the impression that you guys are giving punch in knife tip or barking up the wrong tree. The current discussion seems to seek answers at the semantic. And the idealization of the concepts and definitions begin to collide with the use of a language that is not native to all, as well remembered by Gunther Nitzsche in his last intervention. You are one step closer to doing what Gunther's ancestor did in the century XIX discussing On the Genealogy of Morality (F. Nietzsche) beginning to investigate the root of a single word: the word abuse. What is its genesis? And more importantly, what are the conditions of its genesis? Will discuss in the light of the uses and customs of the present age but there will no consensus. Anyway, I'll put the ball on the ground and try to give my definition of abuse in the most practical way possible, with my English. CAUSE AND EFFECT First remember that I am not an IT professional and I have no concern with possible abuses that ISPs, Registrars and RIRs may suffer. They have professionals and tools to care for themselves. What matters are the billion people on the planet victims of abuse as never before happened. Today the barbarian hordes do not invade the villages with their horses. They remain comfortable and cowardly sitting in front their keyboards stealing and angering millions of people every day - and properly protected and hidden under the cloak of pernicious "protect service". Today barbarians have a new name: coward psychopaths. DEFINITION AND SOLUTION There is nothing more dispensable than the definition of abuse. It is explicit in all AUPs, TOSs and ASPs that govern all contracts between these companies and their customers. Nothing is easier to implement than a solution to end the abuse. I have the perfect recipe: a dose of shame, a dose of honesty, a drop of ethics and a spray jet in the nose with Syntocinon to replace the Oxytocin that the hypothalamus of psychopaths do not produce - empathy. In other words, providers just need to put into practice what their AUPs, TOSs and ASPs, abundantly displayed on their websites, contractually determines. Losses and damage from such abuse are solely the responsibility of those companies. REGULATION AND MODUS OPERANDI If a victim denounces, with evidence, a customer of an ISP, the ISP must contact and warn his customer. If this victim denounce for a second time the same client, the ISP is obliged to penalize his client. In the third complaint ceases to be abuse to be a crime. Here it is characterized conspiracy to the practice of crime. And that is the psychotic posture, dishonest and greedy of most ISPs. No matter if we are denouncing a spammer or scammer. And by insisting on the complaint, copying to various institutions and to the media, the retaliation will be inexorable. Every crime is an abuse but neither all abuse is a crime. PROGNOSIS Nothing will be done. The status quo shall prevail. Marilson

1 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 24 Aug '16

24 Aug '16

Hi, On 08/24/2016 10:05 AM, Andre Coetzee wrote: > > ================= > Definition of abuse > ================= > > "The non sanctioned use of a resource to infringe upon the usage rights > of another resource" > > ----------------------------------------------- > another? In the meaning of "a different" or at least "an additional" resource? If I use (abuse) a resource which directly infringes your usage rights, this behaviour would not fall in this definition because there is not "another" resource involved..? example .. aehh.. like... I use your cpu-time for calculating bitcoins..? I use your mailserver for spamming? Maybe I just don't get the english words right :) best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Definition of Abuse - preamble
by Andre Coetzee 24 Aug '16

24 Aug '16

Hello Everyone, Now that everyone has had enough time to comment, it seems that the definition of abuse now works for all types of Internet abuse. So, there is not a technical definition of what abuse actually is, which is very helpful to have, as this is an ABUSE WG, so knowing what abuse means is crucial to the group itself. (As well as to RIPE) Someone said something which caused me to think that the definition, as a technical definition, and not a contractual definition or a definition that intends to regulate, control or subjugate - It may be specifically useful to add a preamble (and possibly other sections?) Here is my proposal for the preamble, it is a very rough first draft sucked from my thumb in less than 3 minutes..., so if you see something that needs refinement, please pitch in. Of course, if it looks good, this is great also! ============ Internet Abuse ============ Understanding what constitutes Internet Abuse is not an easy undertaking as the topic is very technical. The Internet consists of resources and the understanding of Internet abuse relates to also understanding the use and interaction between these resources. Examples of Internet resources include also processes, protocols,credentials as well as other types of resources. More practical examples could be Internet Protocol numbers, Domain names or even Email addresses. This technical definition of abuse does not include identifying the authority for any specific resource as it is not intended to define any rights to resources but simply to define what technically constitutes Internet abuse as it relates to all Internet resources. ================= Definition of abuse ================= "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ----------------------------------------------- Terminology used in the definition ----------------------------------------------- (1) Resource Any Internet Resource (2) Use and Usage Any direct or indirect action involving a resource (3) Rights The correct assignment or allocation of a resource by he authoritative holder of such a resource which results in the entitlement or reasonable expectation to use, or ability to use, such an allocated or assigned resource (4) Sanctioned An action, event or situation originating from the authoritative holder of rights to a resource that gives permission, or permission is granted by direct implication, which authorises that situation, event or action. (5) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource

1 0

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by Ronald F. Guilmette 19 Aug '16

19 Aug '16

ox <andre(a)ox.co.za> wrote: >(4) Sanctioned >An action, event or situation originating from the authoritative holder >of rights to a resource that gives permission, or permission is granted >by direct implication, which authorises that situation, event or action. OK, Andre, I give up. Congratulations. You've succeded in wearing me down until I just give up. That fact that you still clearly either can't or won't comprehend that the "authority" you speak of has to come from somewhere convinces me that you are now -deliberately- failing to understand. Authority for Internet number resources begins at IANA, and then devolves down to the Regional Internet Registries. The fact that you can go on attempting to define "sanctioned" without ever even menioning any of these official bodies, or their authority, has persuaded me that you actually do not -want- to understand this simple but overridingly critical point. I already asked, multiple times, and in multiple ways, "Sanctioned by who? Sanctioned by what?" But you continue to carry on as if this is just an unimportant, annoying, and irrelevant detail. When push comes to shove and someone asks "Who decides who the authoritative holder of rights to a resource is?" you can just tell them "Judge Judy."

2 1

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by Ronald F. Guilmette 19 Aug '16

19 Aug '16

ox <andre(a)ox.co.za> wrote: >================= >Definition of abuse >================= > >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" > >----------------------------------------------- >Terminology used in the definition >----------------------------------------------- > >(1) Sanctioned >An action, event or situation that specifically or expressly gives >permission, or permission is granted by direct implication, which >authorises that situation, event or action So, if, for example, I, Ron Guilmette, give my friend Joe Hacker, my permission to DDoS your corporate web site, that's OK then, yes? Because he has my permission. Yes? Before responding, in heat or otherwise, please read and consider: To any who may think that I'm just quibbling and/or being pedantic about the definition of the terms of reference here, I'd like to just mention a short and rather famous phrase from another document where the terms of reference were also not adequately or precisely defined, at the outset, and where that lack of specificity, in the end, gave rise to what may perhaps have been the greatest single tragedy to have ever befallen my own great nation: "... that all men are created equal..." At the time that was written and signed, there was an *implicit* understanding among some of those who signed it that the term "all men" in this context was quite obviously intended to mean "all white men". Some of the signers believed that's what it meant. Some others did not. That simple lack of specificity festered, like an open gangrenous wound, in the American body politic until some four score and some odd years later when the differing interpretations finally broke out into armed conflict... The American Civil War, in which brother killed brother, and over 600,000 Americans lost their lives. And of course, I haven't even mentioned the civil strife and hardships of the early 20th Century, as the original term of reference, "all men", slowly started to become redefined, yet again, to mean "all human persons, both male and female"... a redefinition that is still a work-in-progress as of this writing, a full century after it began. So before anybody *else* tells me... like Andre... that I'm just nitpicking or being pedantic, I refer you again to the phrase "... that all men are created equal..." and ask you to consider that the final and total costs of your ambiguities may, in the end, perhaps be borne not just by you, but perhaps also by your children as well. Words matter. Regards, rfg P.S. I have no real feeling, one way or the other, about Andre's general _formulation_ of the definition of abuse. It may perhaps be great. It may perhaps be the absolutely best and most concise way of stating our common beliefs on this subject. It's not the general formulation I have issues with. It's only the lack of clarity with respect to the terms of reference. Once those are adequately and crisply clarified, I might actually like what Andre proposes.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Dave Crocker 19 Aug '16

19 Aug '16

On 8/16/2016 6:08 AM, ox wrote: > unfortunately, I do not know what abuse is, yet. An exercise that might help, but which is certain to have a poor signal-to-noice, is to ask everyone to post examples of what they think is abuse, or rather to post every example they think /might/ be abuse. The group then looks at the resulting compendium of examples and formulates an agreement of what examples are, and what examples are not, abuse. Then there is an attempt to formulate a concise description of what is in. It's likely that the examples will be pretty diverse, so that some sub-categorization might produce a more coherent labeling. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net

9 15

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

On Thu, 18 Aug 2016 13:14:53 +0200 ox <andre(a)ox.co.za> wrote: > ================= > Definition of abuse > ================= > > "The non sanctioned use of a resource to infringe upon the usage > rights of another resource" > > ----------------------------------------------- > Terminology used in the definition > ----------------------------------------------- > > (1) Sanctioned > An action, event or situation that specifically or expressly gives > permission, or permission is granted by direct implication, which > authorises that situation, event or action > > (2) Resource > Any Internet Resource > > (3) Use and Usage > Any direct or indirect action involving a resource > > (4) Infringe > An action, event or situation which limits, reduces, undermines or > encroaches upon the fair use of a resource > > (5) Rights > All sanctioned allocation or assignment of any resource > Maybe rather : The sanctioned entitlement to use an allocated or assigned resource > > Andre > >

1 0

Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

================= Definition of abuse ================= "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ----------------------------------------------- Terminology used in the definition ----------------------------------------------- (1) Sanctioned An action, event or situation that specifically or expressly gives permission, or permission is granted by direct implication, which authorises that situation, event or action (2) Resource Any Internet Resource (3) Use and Usage Any direct or indirect action involving a resource (4) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource (5) Rights All sanctioned allocation or assignment of any resource Andre

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Okay, just to be clear and precise: You agree that the definition of >abuse is: > >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" You're not hearing me. The answer is "No, I neither agree nor disagree with your formulation for the simple reason that it is amost entirely ambiguous, and thus meaningless, because you haven't defined _any_ of the terms used. Thus, your formulation could mean almost anything that either the writer or the reader wishes it to mean, and thus, it has no real meaning at all." Examples: If by "sanctioned" you mean "agreed to, explicity, and in writing, by Ronald F. Guilmette, regardless of the sentiments or opinions of others" then yea! That will work great for me! I'll accept that! I have a funny feeling however that when and if we were to make this simple and innocuous "clarification" to the definition of "abuse" you are proposing, some other people might possibly object however. Similarly, if by "another resource" you mean "only the Bratsk Hydroelectric Power Station in Irkutsk and no other resources" then no, that isn't quite broad enough for me, nor is it likely to be for anybody else. You're trying to get everyone to agree to a set of words strung together to form a sentence, even though nobody, including you, even has a clear notion of what any of the individual words mean, or are intended to mean. It is a silly and pointless exercise, absent definitions of the terms on reference. Anybody can vote in favor of the proposition that "All God's children should be happy." The devil is in the details. Ask any lawyer. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Making a fraudulent representation to RIPE in order to obtain >resource(s) - is/are abuse Yes. >and then, that five other definitions may be required for those >people that are not as technical. No. Five other definitions are required for your general statement of general principal to have any meaning *at all* to *anyone*. >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" This is swell, as a general statement of general principal, but in the utter absence of definitions of the terms of reference, it is functionally equivalent to the following statement of general principal: All God's childern should be happy. That's an admirable sentiment, and one which most folks would be happy to agree with, but absent a clear statement of who the writer means to include in the term "God's children" and/or a specification of what any of us are being asked or expected to do in order to achieve this general outcome, it is a statement devoid of actual meaning, and is thus just a political slogan. >My position is as follows regarding fake WHOIS information: > >It is clearly fraud to submit fake information in order to obtain a resource > >Fraud is clearly a criminal act > >Either way, using a resource to infringe upon the usage rights of >another resource, which was obtained by fake information, would fit into >the above definition as the use of that resource would not be sanctioned. > >It is important to mention though, that the resource would have had to >be used though, for there to have been abuse in the first place. Defined "use". If I announce a route to an IP block, e.g. one that isn't actually assigned to me, but then I never put anything in that block, have I "used" it? Some what say "yes". Others would say "no". >I think in the further definitions this could be fleshed out for the >non technical or not as technical people You've missed the point entirely. The additional definitions are not simply necessary to satisfy pointy-headed geeks. The additional definitions are necessary for your general statement of general principal to have any actual meaning AT ALL to anybody. Who are "God's children"? Do you mean only the children of His Chosen People? It makes a difference. You need to define terms.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >The above definition DOES include spamming - You say it does not, etc >etc etc. etc. That is a complete misreading of what I wrote. My only comment what was to say that I disagree with your formulation of the definition (of "abuse"). I did not specifically pick out or mention what thing or things I disagreed with. (However since you made an issue of it, now I will. See my P.S. below.) What I did do instead was to formulate, from scratch, my own definition of "internet abuse", then presented it, and the rationale for it, totally without any reference of any kind, either positive or negative, to anybody else's preferred definition. Regards, rfg P.S. If specifically asked however, I would critique your current working definition as follows: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" This does not cover AT ALL cases where fradulent data has been deliberately entered into the WHOIS data base. You attempt to ignore this entire problem area... to just sweep the whole thing under the rug as if it doesn't exist... kinda makes me wonder if you are just shilling for Sasha Luck, who doesn't want to see there be a WHOIS data base AT ALL because, you know, god forbid that anybody or any company should ever actually be held, you know, accountable. No no no! We can't have THAT now can we? So? Are you shilling for the "pro-privacy" and "anti-transparency" lobby, or what? It's not like you could have missed the fact that bogus WHOIS data has been a topic here recently. Further critique: Your "definition" will require five additional definitions of its own before it will even mean a blasted thing, actually, to anybody: Define "sanctioned". (Sanction by whom? Sanctioned by what? The law?) Define "use". (If I send a packet to you, did I just "use" you?) Define "resource". (Do resources include WHOIS records? If not, why not?) Define "infringe". (If I make a copy of your webpage, have I infringed?) Define "rights". (Which rights, in particular? Who or what grants these "rights" you speak of? God? IANA? RIPE? My local city council?) Until you define those additional five things, your definition doesn't even MEAN anything. Not in any real, meaningful, or concrete sense at least. That's why I didn't even think the whole thing was even worth commenting on, quite frankly, i.e. because it seems so tenuous and incomplete. So I just got out a fresh blank sheet of paper and started writing my own version, which I posted, explained, and provided necessary definitions for, so that readers would have a prayer in hell of being able to at least understand what it means.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >So, If you do not agree with the final definition, please contribute? I don't. The bottom line here is that "abuse" should probably be all of the crap that there is universal or near universal agreeent is "bad" *and* that *fails* to rise to the level of being SOOOOOOOOO terrifically awfully bad that we acually want to risk calling in the already exceptionally busy (and notoriously ham-fisted) LE people to deal with it. This would include, at the low end, just for example, spamming. You're *not* going to run down to your local police station screaming "Mommy! Mommy! He spammed me! Make him stop!" You're not going to do that because (a) it would be silly and because (b) when you got there, even the cops would tell you how silly you were, and how much "real" work they have to do, e.g. monitoring terrorists and catching bank robbers. So basically, all the stuff that we, as rational adult experienced Internet users agree that we *would* want to call LE in on is called "crime". Meanwhile, everything else that we can all agree is "bad" and that "shouldn't happen on the civilized internet" but that *DOES NOT* quite rise to the level where it makes any sense to call in the LE people (e.g. route squatting, spamming) is "abuse". We call this stuff "abuse" rather than "crime" because everybody agrees that it shouldn't happen, but 99.9% of all governments, all around the world, are too stupid to understand any of this stuff, and as a result, you won't find a single country, anywhere in the world, that has formally made route squatting a crime, and also, even my own idiotic country has actually *legalized* spamming. So spamming is not a "crime"... at least not here in the United States, and at least not ACCORDING TO OUR MORONIC LAWS. Spamming *is* however "abuse" on and of the Internet, and most of us, being adult experienced Internet usesrs would and do agree on that, *regardless* of what the law might say in any given meatspace geographical jurisdiction. We know that certain things are "abuse" (e.g. spamming), even if the moronic bribed luddites in our respective national legislatatures do not. So, to review: crime -- Defined as whatever the dumbass meatspace legislators in various dumbass meatspace jurisdictions say it is Internet abuse - Defined as whatever most or all of *us* (actual experienced Internet users with a technical clue) say it is. You can draw a simple Venn diagram, consisting of two circles, each representing the above two things. And there is and will be some overlap, the amount or exact edges of which will be different in each different meatspace jurisdiction. But to the extent that there is overlap, we agree that FOR OUR PURPOSES we prefer that for all those things that might qualify as being -both- "abuse" -and- "crime" we make a judgement call and say that we would prefer LE to just butt out and let us handle it, because if THEY do it, they will either phuck it up (a la Aaron Swartz) or they will waste their precious resources which should be used elsewhere. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >On Wed, 17 Aug 2016 03:31:49 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> I've made three simple points, none of which should really be all that >> difficult to understand. These three points are as follows: >> >> 1) In practice, law enforcement *can't* deal with these things. >> They don't have the resources or, in general, the technical >> competence to even understand them. (See link below.) >> > >They can, and they do. > >an example from two emails ago: >http://www.pcworld.com/article/174651/article.html No. I really can't fathom how you managed to so throughly mis-read that article. You need to go back and read your own reference again. Read the PCWorld article. This time try to comprehend what it actually says. Note that when I said "law enforcement *can't* deal with these things" the specific "things" I was referring to were simple deceptions, perpetrated upon RIPE by various parties in order to obtain number resources. As the PCWorld article makes abundantly clear the police were *already* looking into the various *other* criminal activities of the Russian Business Network, well before there was any interaction between law enforcement and RIPE. And further, by the time that there *was* some interaction between law enforcement and RIPE, it *did not* occur because RIPE had called the police to say "Oh help us! These evil RBN people have tricked us!" Rather, in this case, it was entirely the other way around: Law enforcement came to RIPE to tell RIPE that RIPE was, in effect, guilty of money laundering. That, of course, is yet another example of the generallized "Aaron Swartz principal" which states that *in general* when law enforcement becomes involved in any "cybercrime" matter which *does not* involve some really straightforward crookedness (i.e. a large sum of money being effectively or actually stolen) they routinely screw it up, go overboard, and start blaming all the wrong people. Regards, rfg

2 1

verio.de
by Reza Farzan 18 Aug '16

18 Aug '16

Hello All, Does anyone knows as to what has happened to this domain, "verio.de" [213.198.86.0 - 213.198.86.151]? Sorbs has listed their IPs as unsafe for sending Spam, yet Verio Deutschland GmbH, and their US partner NTT America IP Addressing do not take any action against these violations. Thank you, Reza Farzan

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >So, to be clear - I am not saying that I THINK ripe should file >criminal charges (THEY MUST) Well, OK, I did miscounstrue your comments, so for that I apologize. But for all the reasons I've already noted, RIPE NCC actually DO NOT do what you think "THEY MUST". They do not call in the police each time some clever forger flim-flams them. If you think you can change that, by all means, you're free to try. But for all the reasons I've already noted, I do not think that will change, nor do I think it should. I would really rather that law enforcement spend their limited time and resources chasing down terrorists, bank robbers, child molesters, child pornographers, and all such other scum-of-the-earth as deserve their special attention. Regards, rfg

2 1

Current Discussion & List Behaviour
by Brian Nisbet 17 Aug '16

17 Aug '16

Colleagues, I'm on holidays right now, so I haven't been reading the list discussion as assiduously as I otherwise might. However I have noticed that things haven't gotten, in places, less professional than we might otherwise wish. Can I remind you all to please remain civil and to assume good intent on the part of all participants. We are all passionate about this subject, but that doesn't mean we can't discuss it in the best manner. My email reading will continue to be sporadic, at best, at least until next week and probably for another couple of weeks, so please bear this email in mind whenever you are putting finger to keyboard. Thanks, Brian Co-Chair RIPE AA-WG Brian Nisbet Network Operations Manager, HEAnet

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >When anyone commits fraud to obtain a resource from RIPE, RIPE has the >responsibility to file criminal charges against that criminal. > >I am not saying that I think RIPE should file criminal charges... I would suggest that you consider running for President of the United States, but we've already got another guy in the race who routinely manages to contradict himself within the space of two consecutive sentences. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >> Yes, by all means, let's take a violation of contractual terms between >> two private parties and turn it into a law enforcement matter. And > >I am not sure what you mean, maybe you can explain it to me better? I'm not sure what it is that you're not sure about. I've made three simple points, none of which should really be all that difficult to understand. These three points are as follows: 1) In practice, law enforcement *can't* deal with these things. They don't have the resources or, in general, the technical competence to even understand them. (See link below.) 2) In practice, in those rare instances when law enforcement stupidly injects itself into civil contractual disputes, claiming that they have criminal jurisdiction, they usually do so in a ham-fisted way that does more harm than good. (See link below.) 3) Even RIPE NCC legal staff recognize that it would be the height of silly absurdity for them to call in the Dutch police, or Interpol whenever they get snookered by some clever Russian or Egyptian, which happens these days with disturbing regularity due to the fact that RIPE NCC never actually checks anybody's bona fides themselves until *after* some schmo like me raises a stink, by which time it's too late, the number resources have already been allocated, the overt criminality has already begun, and RIPE's own rules require a laborious, lengthy, tedious, and exceptionally time-consuming multi-month process just for them to be able to take back what they should never have handed out in the first place. In effect, RIPE NCC is walking around with a billboard-sized sign on its back saying "CHEAT ME!" and criminals from all over the world, eager to make an illegal buck, are only too happy to oblige them. The following two links support the first two points above: 1) http://www.bbc.com/news/uk-36731694 2) https://en.wikipedia.org/wiki/Aaron_Swartz Regarding point #3, I've suggested... although perhaps not clearly enough... that if you have trouble understanding it, you should do some simple research, i.e.: a) Ask RIPE NCC Legal yourself how many times they have taken a contract breach and gone to law enforcement and filed a criminal complaint on account of that. (Hint: Never.... because they are not stupid, and because they understand points #1 and #2 above.) b) Ask RIPE NCC Legal yourself how they were magically able to verify the bona fides of ORG-IL351-RIPE aka "Icenetworks Ltd." aka "OrangeWebsite.Com", even though there is simply is no way for _any_ mere mortal to verify either the existance of, or, conversely, the non-existance of _any_ Belize company, let alone verifying which human individuals are or are not empowered to enter into legally binding contracts on behalf of such a company. If they give you an answer to that last one, please do let me know. Whatever it is, it is quite likely to be either (a) facinating or (b) laughable, or perhaps (c) both facinating -and- laughable. Regards, rfg

3 2

Re: [anti-abuse-wg] Definition of Abuse
by Sergey 17 Aug '16

17 Aug '16

That's easy. The analogy is weak. Don't mess the Internet with real world things. The Internet has been self-regulated since its birth. Otherwise we'd have govts and not RIRs controlling the number resources. And I hear it all the time that it's specifically RIPE's problem of dealing with rogue sign-ups. 17 августа 2016 г. 11:24:44 GMT+03:00, ox <andre(a)ox.co.za> пишет: >On Wed, 17 Aug 2016 01:11:44 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> ox <andre(a)ox.co.za> you wrote: >> >Are fake whois records abuse? I think this is an excellent question >> >and requires discussion. >> >Personally I think filing fake information to a resource is actually >> >a crime called fraud. I am sure that this is also a crime under >> >Dutch law and that the Dutch Law enforcement should investigate >this? >> >> Why yes! (Now why didn't *I* think of that?) >> Yes, by all means, let's take a violation of contractual terms >between >> two private parties and turn it into a law enforcement matter. And > >I am not sure what you mean, maybe you can explain it to me better? > >When one private person/organization steals another private >person/organization's car, it is not theft? > >When one private party lies, cheats and fraudulently obtains something >from another party, it is not fraud? > >Because why? > >Because they are "private parties" ? > >I am so sorry that I am slow in understanding this and than you so much >for taking the time to explain this to me > >Andre -- Простите за краткость, создано в K-9 Mail.

5 8

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 17 Aug '16

17 Aug '16

Yes that is what I said about a legal obligation versus good citizenship --srs > On 17-Aug-2016, at 2:46 PM, ox <andre(a)ox.co.za> wrote: > > On Wed, 17 Aug 2016 14:38:09 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> I think the term that's being collectively groped for is whether >> ripe ncc has a reporting obligation in case it discovers criminal >> activity >> >> The number of cases where such reporting is mandatory in law and not >> simply a matter of good citizenship is rather limited - threat to >> life, kidnap, etc. >> > No, not so much... > > It is not a "point of view" whether RIPE has the obligation to file > criminal complaints when there is fraud committed against RIPE > > Under Dutch Law, We have already heard how RIPE is registered... > > In fact, if it was a public company, it would not be much different either.. > > Speaking generally, in most places in the world where you are working > or operating the assets of someone other than yourself their are many > additional things that become relevant to your own operation... > > I think that we may want to hear from RIPE legal in that regard > > But, what I am also saying is that socially, civil society and simple > ethics and good custodial management, basic decency and so very very > many other things demand that RIPE files criminal complaints when there > is crime. > > For example: Should an official of RIPE steal money at RIPE there is an > obligation to file a criminal complaint. > > Same principles apply all throughout > > Andre > > > > >> --srs >> >> On 17-Aug-2016, at 2:26 PM, Rob Evans <rhe(a)nosc.ja.net> wrote: >> >>>> When anyone commits fraud to obtain a resource from RIPE, RIPE has >>>> the responsibility to file criminal charges against that criminal. >>>> >>>> I am not saying that I think RIPE should file criminal charges, I >>>> am saying that not doing so is in itself a questionable action. >>> >>> Well, to be pedantic, *criminal* charges are filed by the police >>> or other law-enforcment body, not by companies. :) >>> >>> Rob >>> > >

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> you wrote: >Are fake whois records abuse? I think this is an excellent question and >requires discussion. > >Personally I think filing fake information to a resource is actually a >crime called fraud. I am sure that this is also a crime under Dutch law >and that the Dutch Law enforcement should investigate this? Why yes! (Now why didn't *I* think of that?) Yes, by all means, let's take a violation of contractual terms between two private parties and turn it into a law enforcement matter. And while we're at it, let's have Interpol come out to your house and cuff you for those rental DVDs you returned 2 days late. Yes, that's obviously the best choice, and the best possible use of limited law enforcement resources. And look at how well it worked out in the Aaron Swartz case! So I'm sure your're right. But you shouldn't rely on just _my_ humble opinion. Why not ask the RIPE NCC legal team how many of those 7 cases of non-financial contract breaches in 2015 and 2016 they called in law enforcement on. I'm sure they'll tell you they did so in all 7 cases... ... or maybe not. >But, imho, fake whois records and/or incorrect whois records, is not >abuse. Yes. What the hell! Let's just turn off the RIPE WHOIS server and then everything will be so much simpler and straightforward. At least then we won't have to wonder anymore. Instead we will be SURE that none of us has the least clue who is actually using which IP ranges, or who takes responsibility for any of them. A rational choice, if ever there was one. Regards, rfg

2 1

82.221.130.64/26
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

Additional information about security issues relating to the 82.221.130.64/26 IP address block: https://forum.eset.com/topic/2121-what-is-this-exactly/

1 0

Re: [anti-abuse-wg] Definition of Abuse
by ox 16 Aug '16

16 Aug '16

On Tue, 16 Aug 2016 14:23:21 +0000 David Hilario <fransossen(a)hotmail.com> wrote: > Hi Andre, > Thank you so much David That is a very complete, informed and direct answer I also do not foresee anything changing anytime soon, or that there is even a need for anything to change, for that matter. We do really need a definition of "abuse" though, as some actions may, or may not be abuse and/or crimes - and when there are general discussions about "abuse" it would be good to know the definition and/or parameters. It would be within the scope of an operational abuse list, to define what abuse is. So, we are still at this last definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" Current discussions about what needs to be added still? (add if I am missing anyone or anything please) (1) Gert Doering suggested that "there are legal reason why someone could infringe on someon else's use rights" - added the 'non sanctioned' - seems fine now, Gert? (2) unauthorized access / hacking / and/or breaking in ( Dave Crocker - abuse concerns unauthorized access ) (Andre - breaking in is crime, abuse is use something for bad purpose ) (3) causing damage to others ( Dave Crocker - "and to actions that inflict damage on others" ) ( Michele Neylon - I like the idea of “damage” or “harm” on others The “infringe on usage .. “ thing didn’t seem very clear to me and I don’t see how that would apply to spam etc) (Andre - damage is a result of an action or result of abuse? crime?) > > >Maybe you can help, David? > > > >When RIPE investigates "abuse" what are they investigating? Crimes? > >Criminal activity? Fraud? or actual abuse? > > Short version: > RIPE NCC can only investigate and take actions against resource > holders based on RIPE policy violations and contractual agreement > violations. (With the exception of legal requirements such as court > orders enforceable under dutch law, embargo that apply to Dutch based > organisation, RIPE NCC functions under Dutch law and has to comply at > that level...but those things are outside of the scope of the RIPE > policies) > > Long version: > This is the document you are looking for: > https://www.ripe.net/publications/docs/ripe-640 > > It lists the reasons for being under violations and the eventual > consequences (de-registration of resources, closure of LIR). > > Anything else is actually sort of irrelevant, unless a RIPE policy is > to be put in place against something that would be defined as > "abuse". This would be decided here within the WG and not by the RIPE > NCC. > > The RIPE NCC will then be able to enforce the policy that has been > decided here. > > I don't really foresee any of that changing anytime soon though. > But actions are taken, where actions can be taken by the RIPE NCC, > based on the current set of policies. > > Cheers, > David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by David Hilario 16 Aug '16

16 Aug '16

Hi Andre, >Maybe you can help, David? > >When RIPE investigates "abuse" what are they investigating? Crimes? >Criminal activity? Fraud? or actual abuse? Short version: RIPE NCC can only investigate and take actions against resource holders based on RIPE policy violations and contractual agreement violations. (With the exception of legal requirements such as court orders enforceable under dutch law, embargo that apply to Dutch based organisation, RIPE NCC functions under Dutch law and has to comply at that level...but those things are outside of the scope of the RIPE policies) Long version: This is the document you are looking for: https://www.ripe.net/publications/docs/ripe-640 It lists the reasons for being under violations and the eventual consequences (de-registration of resources, closure of LIR). Anything else is actually sort of irrelevant, unless a RIPE policy is to be put in place against something that would be defined as "abuse". This would be decided here within the WG and not by the RIPE NCC. The RIPE NCC will then be able to enforce the policy that has been decided here. I don't really foresee any of that changing anytime soon though. But actions are taken, where actions can be taken by the RIPE NCC, based on the current set of policies. Cheers, David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 16 Aug '16

16 Aug '16

Easier to ask – why do other RIRs not have nearly the same high quantum of such issues? What do they do to prevent these, and reclaim resources allocated to bogus entities? --srs On 15/08/16, 8:56 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: Unauthorized access is NOT ABUSE, in terms of the current definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" And, this is the crux of it all, this defining of "abuse" is exactly why we require a definition.

4 6

Re: [anti-abuse-wg] Definition of Abuse
by Gert Doering 16 Aug '16

16 Aug '16

Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

7 8

Re: [anti-abuse-wg] Definition of Abuse
by Marilson 15 Aug '16

15 Aug '16

“Define abuse” Are you kidding? In this WG? “Complicated” Only for those who feed with the practice of abuse. “meaningless political expression” Are you with nefarious intent? (using Andre words) “it should be defined by RIPE” This just keeps getting better than stand-up comic. Until... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, August 15, 2016 5:37 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 21 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Definition of Abuse (Gert Doering) 2. Re: Definition of Abuse (Gert Doering) 3. Re: Definition of Abuse (Sascha Luck [ml]) 4. Re: Definition of Abuse (andre(a)ox.co.za) 5. Re: Definition of Abuse (andre(a)ox.co.za) 6. Unsubscribe (Eoin C. Bair?ad) ---------------------------------------------------------------------- Message: 1 Date: Sun, 14 Aug 2016 21:15:19 +0200 From: Gert Doering <gert(a)space.net> To: andre(a)ox.co.za Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse Message-ID: <20160814191519.GM79185(a)Space.Net> Content-Type: text/plain; charset="us-ascii" Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Erik Bais 15 Aug '16

15 Aug '16

Hi Andre, > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > The use of a resource to infringe upon the usage rights of another resource The core of the problem of a good definition of abuse, is the intend of the action ... And intend is in the eye of the beholder ... I'll give an example : BGP Hijacking ... BGP Leaks ... If someone is doing a BGP Hijacks in order to knowingly divert traffic to harm others, while either the AS or the prefix is not rightfully under their control, it could be considered a Hijack. ( similar as carjacking. ) If those prefixes are used in order to : deny service to the original legitimate owner of the prefix, or an un-used prefix is abused for spewing out spam .. or to regain control of a Command and Control server/infrastructure ( Hacking Team action after Santrex was closing and they stopped announcing their prefixes ... ) there is clear intent to take something that wasn't yours in order to benefit from the outcome. However .. when some Bulgarian dude hijacked a prefix from the Ministry of Foreign Affairs 1.5 years ago, with the intent to spam on it ( Domains were pointed to it and other space they hijacked was also quickly spammed on and abused before released..) it was interesting to learn that hijacking as an Act, isn’t a crime .. (the law doesn't mention it.. it isn't illegal.. hence .. it is legal..) There could be made a case that the wrongful intent is and if they would actually spammed on the space, it is directly a crime.. But they didn't (yet) and they stopped the hijack before spamming on it.. So nothing happened, as if your neighbor borrowed your bike and returned it to your doorstep before you knew it was missing. In the same pristine condition .. It could have been said, this is a denial of service, but as the particular ministry wasn't using the space, nothing was denied ... they didn't even noticed it for a complete week. ((!! ) But that is another topic..) Now let's do a similar thing .. but with Cyber Crime fighting or Anti-Abuse in mind .. here comes the DMCA lobby or TRA (Telecom Regulator Agency in some Middle East country..) or some similar organization that is fond of protecting digital content rights.. And they are going to inject routes in a network, fiddle with BGP routing, in order to take down : Dreambox Key Servers on the internet (useful for free satellite decoding without subscriptions.. ) or phishing sites or command and control servers in $country .. or hell, why not take down the complete /21 of North Korea in the process while we talk about it ... Just because we can.. Who defines the greater good ... who is defining the wrongful intent of party X or party Y. Is the DMCA lobby correct if they want to shutdown some hosters torrent site customer.. or if the hoster correct that they don't take action on it and are not disclosing any information unless they are forced by a court order. There have been BGP injections in the past, to see if that could help in TRA compliance .. just in a subset of AS's. If those actions would have had a larger effect ... ( so large that it would have been noticed outside the region and into (this?) community perhaps.. or in the media.. ) ... who are we going to investigate .. The TRA that would like to enforce their local / regional laws and compliance .. or the violators that are facilitating the dreambox key servers that are sharing satellite subscriptions cards over the internet ... or the actual users of the dreambox in various countries ... In either of these scenario's .. the actual hoster or ISP that is hosting the 'service' on their IP space, is most likely outside the local jurisdiction and might not even be aware ... ( they are naughty/ignorant, that is different from being bad. ) In the near future, we will see a lot of grey actions, done by people that in their own mind and under their local laws, stand in their right to fiddle with your routing, if that means they can enforce local censorship or re-gain access to certain infrastructure or deny $party to their infrastructure when they will have a tactical benefit in this.. ( think Turkey during a coup.. or Syria being completely removed from the internet during attacks in Aleppo.. ) Our community covers a huge set of countries and there are quite a lot of political issues ( there are several countries that are real warzones today in our region.) .. and some of those political issues are corruption ( people getting paid to look the other way .. ) and some are just not dealing with the Spam Source because $investigator is blown out of his mind in the US or France Riviera ... RIPE isn't the internet police and this working group isn't either .. I think we should educate each other on what is going on, keep reporting on the issues we see, specifically around certain rotten area's .. We should refrain from forcing the RIPE NCC in becoming an internet police .. as they are an impartial party (like the Red Cross). They provide resources to those that need/request it.. and register who are using it. The same as the Red Cross, they hand out food to all people. Some of them might pick up a rifle 15 minutes later and shoot someone or sell that food .. but you can't blame the Red Cross for handing out food in certain areas or tell them to change their mission. Disciplinary actions (like de-registration due to abuse for instance) should not be up to the NCC, unless the information provided for registration isn´t correct. Everything else is not within the scope of the NCC imho. It should be taken up to the local law enforcement if things are not in compliance with the law ... And that could be different in each country of this huge service region... Moving into any other direction might be a very slippery slope we are getting ourselves into ... Ambition is good, but we shouldn't outreach our place in this delicate environment ... Regards, Erik Bais

2 3

Unsubscribe
by Eoin C. Bairéad 15 Aug '16

15 Aug '16

Unsubscribe me please Eoin C. Bairéad IT Mazars Block 3 The Harcourt Centre Charlotte Street Dublin 2 phone: +353 (1) 4494490 fax: +353 (1) 4750089 mobile: +353 (87) 2311357 ##################################################################################### Internet communications are not secure and the firm does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm. This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. ##################################################################################### ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by NetIQ MailMarshal #####################################################################################

1 0

Definition of Abuse
by andre＠ox.co.za 14 Aug '16

14 Aug '16

Definition of Abuse as it should be defined by RIPE --------------------------------------------------------------------- The use of a resource to infringe upon the usage rights of another resource Reasoning: ---------------- The above covers all abuse scenarios and it does not tell anyone what to do or what not to do. It is fair and reasonable and includes everything

1 0