September 2016 - anti-abuse-wg

Educating ISPs to properly process Abuse/Spam
by Reza Farzan 09 Nov '16

09 Nov '16

2 1

The email marketing needs a reset button
by Marilson 30 Sep '16

30 Sep '16

Whereas the abuse victims do not need to be told what abuse is, considering that existing policies and regulations are satisfactory, and considering that the WHOIS records are 95% correct, I make the following appeal: The email marketing needs a reset button. This appeal I do to decent people. To the others I say try not be hypocrites accusing people of ad hominem using polite phrases whereas are passing their days, sitting in front of a keyboard, angering millions of people. Remember that: you are not imputable only when you act according your AUP and ASP on a denounce. To funny guys: I'm not suggesting changing your AUP and TOS, certainly. Marilson

2 1

Re: [anti-abuse-wg] Need policy to require abuse contacts to accept abuse reports
by Marilson 28 Sep '16

28 Sep '16

On Set 23, 2016 Shane wrote: "But to check that abuse complaints are actually handled is quite difficult." On Sep 26, 2016 I wrote about Shane: "In fact it's a bit laborious but very very EASY." On Sep 26 Norman asked: "What is very easy? Report to whom?" Norman, to check that abuse complaints ARE ACTUALLY HANDLED is NOT quite difficult, it is very very easy. Report to whom? Let’s talk about spam: If you denounce a spammer TO HIS ISP < retransmitter, originating sender ou website host > and the spamming stop... great! Problem solved! If the spamming continues, you must to ALERT his ISP. You must to copy and paste the full header e full message, of the new spam and send to his ISP *customer ISP* But, if the spamming, same spammer and same ISP, happening for the third time, well... Have no doubt about that! This Provider does not respect their contracts, AUPs and ASPs. It does not respect those who denounce and should be treated as a criminal. >From there you have no one else to turn to. Or rather, you have but without any consequence. Complaining to RIPE... would do better complaining to Pope Francisco. The reasons are economic and absolute lack of ethics and honesty. I have already given you the reasons. Like me and Shane said the solution depends on a change in the attitude of ISPs, which has the support of governments, Registrars and media where big providers as Microsoft, Amazon, SoftlayerIBM pour tons of money on advertising *my speech not Shane*. That's why I suggested practice spam with denounces. We must continue denouncing and copying for all institutions that I have related to you. Copy for Congressman who you voted for. Copy to the media.Do not copy to the RIPE it will be thrown in the trash, it will not be sent to the "anti-abuse" group. Only civil society can pressure governments to enact laws that make crimes such abuses. Norman, do you remember the hint I gave you? Read between the lines? I'll give you another example: > On Sep 26, 2016 Brian Nisbet wrote: > I would love to hear your opinions, and those of others, and perhaps, baby-step by baby-step, WE CAN CONTINUE TO IMPROVE THINGS, even if the end result is not what we envisaged in the beginning. To improve for whom, pale face? Things never improved. Things always changed for the worse. Abuse on the Internet has always been on the rise. The achieved levels are alarming. NEVER SO FEW DID SO MUCH EVIL TO SO MANY IN THE HISTORY OF MANKIND. > The real world, sadly, doesn't work like that. Look, we are talking the same thing. The difference is that he does not dare to call a spade a spade. And Mr Nisbet, there is no DARK motives behind everything you do, as you wrote. You are always crystal clear... between the lines! Marilson

1 0

Re: [anti-abuse-wg] Need policy to require abuse contacts to accept abuse reports
by Norman Diamond 26 Sep '16

26 Sep '16

Marilson wrote: "In fact it's a bit laborious but very very EASY. Just report once, with evidence. If the spammer repeat, the Provider needs to be alerted, with evidence." What is very easy? Report to whom? I report to the ISP's registered abuse address, and the registerd abuse address bounces the report back to me. I report to RIPE NCC that the ISP registered a fake abuse address, and RIPE NCC tells me they will do nothing. I suggest to RIPE NCC that RIPE policy should be changed to require a truthful abuse address which will really accept reports about the ISP's spams, and RIPE NCC advises me to post the suggestion here. "If a small percentage of victims of abuse act that way" Then the spam-dedicated ISP will continue spamming and will continue bouncing victims' reports back to victims. RIPE NCC will continue doing nothing about reports that ISPs registered fake abuse contacts. This group here will continue setting expectations straight: nothing will be done. Sorry I wasted time, but I don't even understand what Marilson is trying to suggest.

3 2

Re: [anti-abuse-wg] Need policy to require abuse contacts to accept abuse reports
by Marilson 26 Sep '16

26 Sep '16

Amazing Norman, Taking advantage of the good mood of Shane and plagiarizing Dr Seuss, I would say to you, Norman, Oh, the places you will go! Do not expect a future filled with unlimited potential as envisioned by Dr. Seuss. Unlike Dr. Seuss, me and Shane will not motivate you. I'll support you because, like you, I'm not an administrator, and Shane, despite being one of the fox caring the henhouse and work (volunteer) in the RIPE Programme Committee, he is reliable and cultivated. ;) First I would like to tell you that here is not the place to discuss abuse (I'm not joking) and much less to get policy to require abuse contacts to accept abuse reports. Where would be ?! There is no such place. And the reason is very simple: in 2014 were 162 billion spam PER DAY. Turn it into cash, jobs and taxes and you will understand why governments turn a blind eye. And most people in that group are here to ensure the continuity of the status quo. I'll give you a hint. Try to read between the lines of the answers you receive from this group. Eg .: read again the first response you received from co-chair Bryan and compare with the second after you say you're following a suggestion of an RIPE NCC IP resource analyst. And try to understand what motivates them. Norman, you wrote: “...But if the community really still favours spammers, I'm sorry I wasted your time too.” Yes, all over the world, this community not only favors as protect and hide spammers and scammers from their victims. Greed moves the wheels of the global economy. The agenda is: cheating, just try not to get caught. I'll tell you what Shane told you but with other words: You do not need any new policy or better definitions, or improving the existing Whois. As Shane said everything depends solely on the ISP and Registrars posture. The elements that are there are enough for you to build a complete complaint. More detailed information will not change the position of a provider. Even the identity of a spammer, with privacy protection service, is dispensable although there are ways to identify him. Shane was wrong when told you that the members of RIPE will say: “thank you for your e-mail, we will not act on it at this time.” The answer will be: “Sorry, this is not our function” If you insist they will rub on your face a convenient statute. And you will have the feeling that you are talking to mobsters. Shane sorry but you are wrong when you say: “...but to check that abuse complaints are actually handled is quite difficult.” In fact it's a bit laborious but very very EASY. Just report once, with evidence. If the spammer repeat, the Provider needs to be alerted, with evidence. If it happens a third time, the same spammer and same ISP, make no mistake - this Provider does not respect their AUPs and ASPs, does not respect those who denounce and should be treated as a criminal scoundrel he is. And Norman, from this third complaint all new complaints against this Provider should be copied to all Providers involved – relay, sender, host – and to the organizations that regulate these activities, to the media (I suggest WSJ, The Economist, The Guardian and local midia) and for scanners. Depending on the severity of the complaint, copy also to Anonymous. If a small percentage of victims of abuse act that way, will demonize the life of these scoundrels as they do to us - spam of denounce. They are thousands but we are billions. And Norman, you do not need anyone. “Jump, and you will find out how to unfold your wings as you fall.” (Ray Bradbury) Marilson -------------------------------------------------------------- From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, September 24, 2016 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 59, Issue 23 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Need policy to require abuse contacts to accept abuse reports (Shane Kerr) ---------------------------------------------------------------------- Message: 1 Date: Fri, 23 Sep 2016 16:24:30 +0200 From: Shane Kerr <shane(a)time-travellers.org> To: Norman Diamond <n0diamond(a)yahoo.co.jp> Cc: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Need policy to require abuse contacts to accept abuse reports Message-ID: <20160923162430.71adafcf(a)pallas.home.time-travellers.org> Content-Type: text/plain; charset="utf-8" Norman, At 2016-09-23 06:41:04 +0900 Norman Diamond <n0diamond(a)yahoo.co.jp> wrote: > > Again, if you would like to proceed, I and the NCC would be very > > happy to help. > > OK, if Mr. Nisbet and the NCC think it would be worth while to > proceed, I will try to help. > > Do you need copies of bounces?? Copies of the short e-mail discussion > between me and the NCC? I admire your willingness to help. In the words of Dr. Seuss, "?Unless someone like you cares a whole awful lot, Nothing is going to get better. It's not." Having said that, there are several very difficult issues to solve in making a policy as you describe. The first issue is that having a contact e-mail does not really help if the company does not do anything about an abuse report. Even if the policy says "each report must be seen by a human" then it will just mean that the RIPE members will have a person who's job it is to say "thank you for your e-mail, we will not act on it at this time". If you insist that a organization do something for an abuse report, then it becomes very difficult to define what must be done. A related issue is how you check any requirement to have contacts. It is easy to make an automated check that an abuse mail works. It is even easy to make a system where you insure that a human is checking the mailbox. But to check that abuse complaints are actually handled is quite difficult. Another issue is what should be done to organizations that do not implement such a policy properly. In principle it is possible to revoke number resources (IP addresses and autonomous system numbers). While this was always a difficult idea, it is even more difficult now, since people are trading IP addresses between each other for large amounts of money. I think that without any penalty for violating the policy, it will not make any difference. Good operators will continue to run their networks responsibly, and bad operators will not care. Cheers, -- Shane

1 0

Re: [anti-abuse-wg] Need policy to require abuse contacts to accept abuse reports
by Norman Diamond 23 Sep '16

23 Sep '16

Brian Nisbet wrote: > I would argue the community does not favour spammers (although I know > there are others who would say otherwise). However there are many other > considerations that must be considered, which only come out during > debate and discussion around such policies. Yes, if those other considerations that must be considered are opposed to the community which does not favour spammers, then those others might be correct to say otherwise. > Again, if you would like to proceed, I and the NCC would be very happy > to help. OK, if Mr. Nisbet and the NCC think it would be worth while to proceed, I will try to help. Do you need copies of bounces? Copies of the short e-mail discussion between me and the NCC? Yours sincerely, Norman Diamond

2 1

Re: [anti-abuse-wg] Need policy to require abuse contacts to accept abuse reports
by Norman Diamond 21 Sep '16

21 Sep '16

I thank Michele Neylon for replying. > If you'd like to propose the policy then it would be discussed etc., Indeed the reason I suggested it was because I think it should be proposed, and Laurens Hoogendoorn, RIPE NCC IP resource analyst, suggested that I address this issue on this anti-abuse mailinglist. I am an ordinary spam victim, not an ISP administrator and not even working for an ISP. When a spam reaches my inbox instead of spambox, I try to report it to abuse contacts. I do feel that ISPs who register fake abuse contacts should be blocked, but I can't do it myself. I made my best suggestion. > What Brian was trying to do was to help set your expectations. Brian Nisbet successfully set my expectations. No doubt about that. If someone besides me cares, and if someone thinks RIPE NCC will care, please kindly proceed. I've already given my best suggestion. (By the way, I set Yahoo web mail to send plain text, but it still doesn't send plain text. A few years ago I tried to persuade Yahoo's administrators to fix it, but I guess they don't see the problem -- because Yahoo web mail decodes its own encoding and displays it as plain text. Sorry for the way my messages appear on this list, but I did my best.) Yours sincerely, Norman Diamond

1 0

Re: [anti-abuse-wg] Need policy to require abuse contacts to accept abuse reports
by Norman Diamond 21 Sep '16

21 Sep '16

I thank Brian Nisbet for having replied: > Policies can be proposed by anyone and they are > considered on merit, not on the occupation of the proposer. > > However such a policy must actually be written and put to the working > group. If you are not able to do this, who is? The WG Chairs and the > RIPE NCC are able to help with the drafting of a policy. Laurens Hoogendoorn, RIPE NCC IP resource analyst, suggested that I address this issue on this anti-abuse mailinglist. I did so. If Laurens Hoogendoorn cannot put the issue to the working group, I should not waste any further time. > However I must warn you that historically such policies have not been > met with great acceptance by the community. The way it looks from my position as ordinary spam victim, it looks like RIPE formerly had no policy at all requiring ISPs to register an abuse contact address or to prohibit untruthful information (such as a famous ISP registered in the country Republik Cyberbunker), and it looks like RIPE made some degree of improvement in this policy. But if the community really still favours spammers, I'm sorry I wasted your time too. Yours sincerely, Norman Diamond

3 2

Need policy to require abuse contacts to accept abuse reports
by Norman Diamond 19 Sep '16

19 Sep '16

Several ISPs put useless abuse contact addresses in their RIPE registrations. I am told that RIPE only requires an ISP to register an address for the supposed purpose of reporting abuse, but RIPE doesn't require the ISP to actually accept abuse reports at the registered address. Therefore a change in policy is required. Some examples are that an abuse address inspects a report for indications of spam. If a spamming ISP observes that a victim's report includes a quotation of the ISP's spam, containing headers and contents to prove that the spam is spam and which IP address sent the spam, then the ISP bounces the victim's report back to the victim, because the ISP's spam really was spam and it's included in the victim's report. Some examples are that an abuse address inspects the mail server of the victim's ISP. If a spamming ISP observes that their victim is a customer of a different ISP which formerly used to be an equally bad spamming ISP, then the ISP bounces the victim's report back to the victim. The spamming ISP might reject the report even before seeing the contents of the report, terminating the mail connection early. Or it might wait and bounce later. An improved RIPE policy would require an ISP to register an address where the ISP will actually accept reports of the ISP's spam. (Now, I am just an ordinary customer of an ISP, coincidentally one which formerly used to send a lot of spam, and I used to be more vicious in reporting my ISP's spam to its administrators than in reporting to most other ISPs. In fact Yahoo US and Yahoo Japan often block each other because they know that they're both famous for spamming. However, it seems they've cleaned up to the extent where they accept reports from each other's customers. Anyway, I am just an ordinary customer, not an administrator, and this is not my job, so I intend to unsubscribe from this list in a few days. Please kindly consider the foregoing suggestion on its own merits not on the suggester's occupation.) Yours sincerely, Norman Diamond

2 1

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issuزe 14
by Mehdi Yazdani 16 Sep '16

16 Sep '16

sent by my phone On Sep 13, 2016 6:04 PM, <anti-abuse-wg-request(a)ripe.net> wrote: > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: anti-abuse-wg Digest, Vol 59, Issue 11 > (Michele Neylon - Blacknight) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Sep 2016 13:34:06 +0000 > From: Michele Neylon - Blacknight <michele(a)blacknight.com> > To: Marilson <marilson.mapa(a)gmail.com>, "anti-abuse-wg(a)ripe.net" > <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issue 11 > Message-ID: <4A78AF9F-3FBD-403C-A3C8-6C93E89F6650(a)blacknight.com> > Content-Type: text/plain; charset="utf-8" > > Non sanctioned in this context would mean ?without permission? > > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > http://www.blacknight.host/ > http://blacknight.blog/ > http://www.blacknight.press - get our latest news & media coverage > http://www.technology.ie > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Social: http://mneylon.social > Random Stuff: http://michele.irish > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of > Marilson <marilson.mapa(a)gmail.com> > Reply-To: Marilson <marilson.mapa(a)gmail.com> > Date: Tuesday 6 September 2016 at 22:57 > To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 59, Issue 11 > > Someone could help a non-native to understand the meaning of the word > (SANCTIONED) used by Andre? > > In the definition of Internet Abuse: *The non sanctioned use...* > > And in defining the terminology: *(5) Sanctioned - Infringement upon...* > > The sanction verb as: > > - give permission or approval for > or > - impose a sanction or penalty on > > In both sentences ? SANCTIONED - as imposed sanction or permission and > sanction? > > Thanks > Marilson > > From: anti-abuse-wg-request(a)ripe.net<mailto:anti-abuse-wg-request@ripe.net > > > Sent: Tuesday, September 06, 2016 2:37 AM > To: anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> > Subject: anti-abuse-wg Digest, Vol 59, Issue 11 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Definition of Internet Abuse - The agony of trying to > unsubscribe (Marilson) > 2. Re: anti-abuse-wg Digest, Vol 59, Issue 7 (Richard Clayton) > 3. Re: anti-abuse-wg Digest, Vol 59, Issue 7 (ox) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 5 Sep 2016 18:01:08 -0300 > From: "Marilson" <marilson.mapa(a)gmail.com> > To: <anti-abuse-wg(a)ripe.net> > Subject: [anti-abuse-wg] Definition of Internet Abuse - The agony of > trying to unsubscribe > Message-ID: <00A5F6C9CEEA4D26B48EF249C755BD90@xPC> > Content-Type: text/plain; charset="utf-8" > > ?People say we live in an age of information overload. Right? I don't know > about that, but I just know that I get too many marketing emails.? > ?...I scrolled down to the bottom of the email, and I pressed, > "Unsubscribe." And I thought that'd be the end of it. But a week later, I > got another one that said,...? > ?And I thought, obviously, I haven't clicked hard enough. So I tried it > again. Right? Lo and behold, a week passes, you guessed it,...? > ?And I was really annoyed with them, and I thought, OK, I was about to > write a strongly worded email, which I can do quite well.? > > http://www.ted.com/talks/james_veitch_the_agony_of_trying_to_unsubscribe > > So Andre, people who do this say they are not committing INTERNET ABUSE > because they put a link to unsubscribe. This is too much hypocrisy or they > really believe that we are mentally feeble? > According to your concerns as you classify this attitude? > > I see billions of spam > > Red scam too > > I see them blomm > > For me and you > > And I think to myself > > What a wonderful word > > > > I see skies of shit > > And Clouds of bits > > The bright blessed day > > Become a dark pit > > And I think to myself > > What a wonderful word > > > > The colors of the messages > > So pretty in the sky > > Are also on the faces > > Of spammers going by > > I see friends wasting time > > Saying: "What can we do?" > > They are really saying > > "I hate all of you" > > Yes, I think to myself > > What a wonderful world > > > Thanks > Marilson >

1 0