August 2016 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >The above definition DOES include spamming - You say it does not, etc >etc etc. etc. That is a complete misreading of what I wrote. My only comment what was to say that I disagree with your formulation of the definition (of "abuse"). I did not specifically pick out or mention what thing or things I disagreed with. (However since you made an issue of it, now I will. See my P.S. below.) What I did do instead was to formulate, from scratch, my own definition of "internet abuse", then presented it, and the rationale for it, totally without any reference of any kind, either positive or negative, to anybody else's preferred definition. Regards, rfg P.S. If specifically asked however, I would critique your current working definition as follows: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" This does not cover AT ALL cases where fradulent data has been deliberately entered into the WHOIS data base. You attempt to ignore this entire problem area... to just sweep the whole thing under the rug as if it doesn't exist... kinda makes me wonder if you are just shilling for Sasha Luck, who doesn't want to see there be a WHOIS data base AT ALL because, you know, god forbid that anybody or any company should ever actually be held, you know, accountable. No no no! We can't have THAT now can we? So? Are you shilling for the "pro-privacy" and "anti-transparency" lobby, or what? It's not like you could have missed the fact that bogus WHOIS data has been a topic here recently. Further critique: Your "definition" will require five additional definitions of its own before it will even mean a blasted thing, actually, to anybody: Define "sanctioned". (Sanction by whom? Sanctioned by what? The law?) Define "use". (If I send a packet to you, did I just "use" you?) Define "resource". (Do resources include WHOIS records? If not, why not?) Define "infringe". (If I make a copy of your webpage, have I infringed?) Define "rights". (Which rights, in particular? Who or what grants these "rights" you speak of? God? IANA? RIPE? My local city council?) Until you define those additional five things, your definition doesn't even MEAN anything. Not in any real, meaningful, or concrete sense at least. That's why I didn't even think the whole thing was even worth commenting on, quite frankly, i.e. because it seems so tenuous and incomplete. So I just got out a fresh blank sheet of paper and started writing my own version, which I posted, explained, and provided necessary definitions for, so that readers would have a prayer in hell of being able to at least understand what it means.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >So, If you do not agree with the final definition, please contribute? I don't. The bottom line here is that "abuse" should probably be all of the crap that there is universal or near universal agreeent is "bad" *and* that *fails* to rise to the level of being SOOOOOOOOO terrifically awfully bad that we acually want to risk calling in the already exceptionally busy (and notoriously ham-fisted) LE people to deal with it. This would include, at the low end, just for example, spamming. You're *not* going to run down to your local police station screaming "Mommy! Mommy! He spammed me! Make him stop!" You're not going to do that because (a) it would be silly and because (b) when you got there, even the cops would tell you how silly you were, and how much "real" work they have to do, e.g. monitoring terrorists and catching bank robbers. So basically, all the stuff that we, as rational adult experienced Internet users agree that we *would* want to call LE in on is called "crime". Meanwhile, everything else that we can all agree is "bad" and that "shouldn't happen on the civilized internet" but that *DOES NOT* quite rise to the level where it makes any sense to call in the LE people (e.g. route squatting, spamming) is "abuse". We call this stuff "abuse" rather than "crime" because everybody agrees that it shouldn't happen, but 99.9% of all governments, all around the world, are too stupid to understand any of this stuff, and as a result, you won't find a single country, anywhere in the world, that has formally made route squatting a crime, and also, even my own idiotic country has actually *legalized* spamming. So spamming is not a "crime"... at least not here in the United States, and at least not ACCORDING TO OUR MORONIC LAWS. Spamming *is* however "abuse" on and of the Internet, and most of us, being adult experienced Internet usesrs would and do agree on that, *regardless* of what the law might say in any given meatspace geographical jurisdiction. We know that certain things are "abuse" (e.g. spamming), even if the moronic bribed luddites in our respective national legislatatures do not. So, to review: crime -- Defined as whatever the dumbass meatspace legislators in various dumbass meatspace jurisdictions say it is Internet abuse - Defined as whatever most or all of *us* (actual experienced Internet users with a technical clue) say it is. You can draw a simple Venn diagram, consisting of two circles, each representing the above two things. And there is and will be some overlap, the amount or exact edges of which will be different in each different meatspace jurisdiction. But to the extent that there is overlap, we agree that FOR OUR PURPOSES we prefer that for all those things that might qualify as being -both- "abuse" -and- "crime" we make a judgement call and say that we would prefer LE to just butt out and let us handle it, because if THEY do it, they will either phuck it up (a la Aaron Swartz) or they will waste their precious resources which should be used elsewhere. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >On Wed, 17 Aug 2016 03:31:49 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> I've made three simple points, none of which should really be all that >> difficult to understand. These three points are as follows: >> >> 1) In practice, law enforcement *can't* deal with these things. >> They don't have the resources or, in general, the technical >> competence to even understand them. (See link below.) >> > >They can, and they do. > >an example from two emails ago: >http://www.pcworld.com/article/174651/article.html No. I really can't fathom how you managed to so throughly mis-read that article. You need to go back and read your own reference again. Read the PCWorld article. This time try to comprehend what it actually says. Note that when I said "law enforcement *can't* deal with these things" the specific "things" I was referring to were simple deceptions, perpetrated upon RIPE by various parties in order to obtain number resources. As the PCWorld article makes abundantly clear the police were *already* looking into the various *other* criminal activities of the Russian Business Network, well before there was any interaction between law enforcement and RIPE. And further, by the time that there *was* some interaction between law enforcement and RIPE, it *did not* occur because RIPE had called the police to say "Oh help us! These evil RBN people have tricked us!" Rather, in this case, it was entirely the other way around: Law enforcement came to RIPE to tell RIPE that RIPE was, in effect, guilty of money laundering. That, of course, is yet another example of the generallized "Aaron Swartz principal" which states that *in general* when law enforcement becomes involved in any "cybercrime" matter which *does not* involve some really straightforward crookedness (i.e. a large sum of money being effectively or actually stolen) they routinely screw it up, go overboard, and start blaming all the wrong people. Regards, rfg

2 1

verio.de
by Reza Farzan 18 Aug '16

18 Aug '16

Hello All, Does anyone knows as to what has happened to this domain, "verio.de" [213.198.86.0 - 213.198.86.151]? Sorbs has listed their IPs as unsafe for sending Spam, yet Verio Deutschland GmbH, and their US partner NTT America IP Addressing do not take any action against these violations. Thank you, Reza Farzan

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >So, to be clear - I am not saying that I THINK ripe should file >criminal charges (THEY MUST) Well, OK, I did miscounstrue your comments, so for that I apologize. But for all the reasons I've already noted, RIPE NCC actually DO NOT do what you think "THEY MUST". They do not call in the police each time some clever forger flim-flams them. If you think you can change that, by all means, you're free to try. But for all the reasons I've already noted, I do not think that will change, nor do I think it should. I would really rather that law enforcement spend their limited time and resources chasing down terrorists, bank robbers, child molesters, child pornographers, and all such other scum-of-the-earth as deserve their special attention. Regards, rfg

2 1

Current Discussion & List Behaviour
by Brian Nisbet 17 Aug '16

17 Aug '16

Colleagues, I'm on holidays right now, so I haven't been reading the list discussion as assiduously as I otherwise might. However I have noticed that things haven't gotten, in places, less professional than we might otherwise wish. Can I remind you all to please remain civil and to assume good intent on the part of all participants. We are all passionate about this subject, but that doesn't mean we can't discuss it in the best manner. My email reading will continue to be sporadic, at best, at least until next week and probably for another couple of weeks, so please bear this email in mind whenever you are putting finger to keyboard. Thanks, Brian Co-Chair RIPE AA-WG Brian Nisbet Network Operations Manager, HEAnet

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >When anyone commits fraud to obtain a resource from RIPE, RIPE has the >responsibility to file criminal charges against that criminal. > >I am not saying that I think RIPE should file criminal charges... I would suggest that you consider running for President of the United States, but we've already got another guy in the race who routinely manages to contradict himself within the space of two consecutive sentences. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >> Yes, by all means, let's take a violation of contractual terms between >> two private parties and turn it into a law enforcement matter. And > >I am not sure what you mean, maybe you can explain it to me better? I'm not sure what it is that you're not sure about. I've made three simple points, none of which should really be all that difficult to understand. These three points are as follows: 1) In practice, law enforcement *can't* deal with these things. They don't have the resources or, in general, the technical competence to even understand them. (See link below.) 2) In practice, in those rare instances when law enforcement stupidly injects itself into civil contractual disputes, claiming that they have criminal jurisdiction, they usually do so in a ham-fisted way that does more harm than good. (See link below.) 3) Even RIPE NCC legal staff recognize that it would be the height of silly absurdity for them to call in the Dutch police, or Interpol whenever they get snookered by some clever Russian or Egyptian, which happens these days with disturbing regularity due to the fact that RIPE NCC never actually checks anybody's bona fides themselves until *after* some schmo like me raises a stink, by which time it's too late, the number resources have already been allocated, the overt criminality has already begun, and RIPE's own rules require a laborious, lengthy, tedious, and exceptionally time-consuming multi-month process just for them to be able to take back what they should never have handed out in the first place. In effect, RIPE NCC is walking around with a billboard-sized sign on its back saying "CHEAT ME!" and criminals from all over the world, eager to make an illegal buck, are only too happy to oblige them. The following two links support the first two points above: 1) http://www.bbc.com/news/uk-36731694 2) https://en.wikipedia.org/wiki/Aaron_Swartz Regarding point #3, I've suggested... although perhaps not clearly enough... that if you have trouble understanding it, you should do some simple research, i.e.: a) Ask RIPE NCC Legal yourself how many times they have taken a contract breach and gone to law enforcement and filed a criminal complaint on account of that. (Hint: Never.... because they are not stupid, and because they understand points #1 and #2 above.) b) Ask RIPE NCC Legal yourself how they were magically able to verify the bona fides of ORG-IL351-RIPE aka "Icenetworks Ltd." aka "OrangeWebsite.Com", even though there is simply is no way for _any_ mere mortal to verify either the existance of, or, conversely, the non-existance of _any_ Belize company, let alone verifying which human individuals are or are not empowered to enter into legally binding contracts on behalf of such a company. If they give you an answer to that last one, please do let me know. Whatever it is, it is quite likely to be either (a) facinating or (b) laughable, or perhaps (c) both facinating -and- laughable. Regards, rfg

3 2

Re: [anti-abuse-wg] Definition of Abuse
by Sergey 17 Aug '16

17 Aug '16

That's easy. The analogy is weak. Don't mess the Internet with real world things. The Internet has been self-regulated since its birth. Otherwise we'd have govts and not RIRs controlling the number resources. And I hear it all the time that it's specifically RIPE's problem of dealing with rogue sign-ups. 17 августа 2016 г. 11:24:44 GMT+03:00, ox <andre(a)ox.co.za> пишет: >On Wed, 17 Aug 2016 01:11:44 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> ox <andre(a)ox.co.za> you wrote: >> >Are fake whois records abuse? I think this is an excellent question >> >and requires discussion. >> >Personally I think filing fake information to a resource is actually >> >a crime called fraud. I am sure that this is also a crime under >> >Dutch law and that the Dutch Law enforcement should investigate >this? >> >> Why yes! (Now why didn't *I* think of that?) >> Yes, by all means, let's take a violation of contractual terms >between >> two private parties and turn it into a law enforcement matter. And > >I am not sure what you mean, maybe you can explain it to me better? > >When one private person/organization steals another private >person/organization's car, it is not theft? > >When one private party lies, cheats and fraudulently obtains something >from another party, it is not fraud? > >Because why? > >Because they are "private parties" ? > >I am so sorry that I am slow in understanding this and than you so much >for taking the time to explain this to me > >Andre -- Простите за краткость, создано в K-9 Mail.

5 8

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 17 Aug '16

17 Aug '16

Yes that is what I said about a legal obligation versus good citizenship --srs > On 17-Aug-2016, at 2:46 PM, ox <andre(a)ox.co.za> wrote: > > On Wed, 17 Aug 2016 14:38:09 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> I think the term that's being collectively groped for is whether >> ripe ncc has a reporting obligation in case it discovers criminal >> activity >> >> The number of cases where such reporting is mandatory in law and not >> simply a matter of good citizenship is rather limited - threat to >> life, kidnap, etc. >> > No, not so much... > > It is not a "point of view" whether RIPE has the obligation to file > criminal complaints when there is fraud committed against RIPE > > Under Dutch Law, We have already heard how RIPE is registered... > > In fact, if it was a public company, it would not be much different either.. > > Speaking generally, in most places in the world where you are working > or operating the assets of someone other than yourself their are many > additional things that become relevant to your own operation... > > I think that we may want to hear from RIPE legal in that regard > > But, what I am also saying is that socially, civil society and simple > ethics and good custodial management, basic decency and so very very > many other things demand that RIPE files criminal complaints when there > is crime. > > For example: Should an official of RIPE steal money at RIPE there is an > obligation to file a criminal complaint. > > Same principles apply all throughout > > Andre > > > > >> --srs >> >> On 17-Aug-2016, at 2:26 PM, Rob Evans <rhe(a)nosc.ja.net> wrote: >> >>>> When anyone commits fraud to obtain a resource from RIPE, RIPE has >>>> the responsibility to file criminal charges against that criminal. >>>> >>>> I am not saying that I think RIPE should file criminal charges, I >>>> am saying that not doing so is in itself a questionable action. >>> >>> Well, to be pedantic, *criminal* charges are filed by the police >>> or other law-enforcment body, not by companies. :) >>> >>> Rob >>> > >

2 1