August 2017 - anti-abuse-wg - mailman.ripe.net

upcoming policy proposal for Anti-Abuse WG
by Marco Schmidt 01 Sep '17

01 Sep '17

Hello Brian and Tobias, How are you? You got already your ticket to Dubai? I just want to inform you that likely a policy proposal will find a way to your working group. Gregory from Europol just contacted me, as he want to add a validation requirement to the policy "Abuse Contact Management in the RIPE Database". His proposal looked pretty advanced to me. I gave him some feedback and explained how to start the formal PDP - by contacting you :) I told Greg to put me in cc when he'll send you the proposal. In case he forgets this, can you please add me in your potential reply so I can start the preparation for the publishing? Regards, Marco

3 3

Re: [anti-abuse-wg] *** Re: Abuse Police
by phishing＠storey.xxx 25 Aug '17

25 Aug '17

2 1

Re: [anti-abuse-wg] Abuse Police
by phishing＠storey.xxx 24 Aug '17

24 Aug '17

2 1

Re: [anti-abuse-wg] Abuse Police
by phishing＠storey.xxx 24 Aug '17

24 Aug '17

4 3

Re: [anti-abuse-wg] Abuse Police
by phishing＠storey.xxx 24 Aug '17

24 Aug '17

1 0

Re: [anti-abuse-wg] Abuse Police
by Gareth Llewellyn 22 Aug '17

22 Aug '17

-------- Original Message -------- On 22 Aug 2017, 06:21, ox wrote: The Internet is all about inter operation, co operation and if something is not legal, why not have laws and law enforcement deal with it? All societies have laws, we all have real Police. Why should companies be deciding what is legal and what is not? Our Police and our Laws have become something secondary to these global companies. I'm not accountable to US, Chinese, Russian, Nigerian etc etc laws and neither are my users. We can't be shutting down pinknews.co.uk because some regime regressed a few decades of civil liberties and made their content illegal. Also in places such as the UK our laws haven't exactly been stellar at respecting the right to privacy or against self incrimination in a digital age. "Co-operating" with law enforcement should go as far as local MLATs require and no more.

2 2

Abuse Police
by ox 22 Aug '17

22 Aug '17

Hi All, I would like to propose a serious (and possibly long) conversation about policing abuse. In depth, as it relates to DDOS, AS jacking, pump n dump and everything Internet abuse. Questions posed by Matthew Prince, http://gizmodo.com/cloudflare-ceo-on-terminating-service-to-neo-nazi-site-1… "Prince wants to spark a conversation about how tech should respond to abhorrent content, and whether content should be policed by registrars, browsers, or social networks" This is relevant to all of us, as well as RIPE (all registries) and anyone involved in Internet Abuse as it is far reaching. the NY Times wrote about how social media platforms (including multinationals like Google) are businesses and quoted Kendra Admas: "legal talismans" https://www.nytimes.com/2017/08/21/magazine/how-hate-groups-forced-online-p… My initial comment is that I support what Ronald said (Educate/Education) - To be clear, I am against registrars deciding do de-register domains based on domain content or politics, I am against hosting companies policing content (this is a job for law enforcement) and as the USA seems to be changing. (Corporations are becoming more fascist - Google deciding what may be searched (no user options) Registrars deciding what random domain names may publish on websites, Hosting companies (even here in EU) deciding what example.com may say on a website. We are obviously at or close to a tipping point. It does not help that many important tech companies are mostly all based/operated from the USA and that these tech companies are now exposed as powerful policing authorities - who will enforce (or try to enforce) their opinions/mono culture/pseudo laws on the planet. For example: There was a disagreement with Google recently. - this disagreement was not related to politics, social discourse or anything of even much importance. It was a disagreement on the interpretation of a double blind clinical trial (posted on Eureka Alert) - Google has decided to devalue (and even remove) search results based on whether Google thinks it "agrees" with an opinion or not. I have also had disagreements with Google. It is simply an impossible battle as Google staff themselves are not "free" to express themselves - and if a certain policy team says "xyz" then "xyz" it is and basta! The google staffers that agree with you have no authority (and will never even think of) over the "policy team" - so, these 'policy teams" in various multi nationals are shaping the planet in their image and we are all just along for the ride? It is my argument that this type of behavior is in fact also Internet Abuse. - The Internet is all about inter operation, co operation and if something is not legal, why not have laws and law enforcement deal with it? All societies have laws, we all have real Police. Why should companies be deciding what is legal and what is not? Our Police and our Laws have become something secondary to these global companies. Countries like China has clearly refused this acceptance and I think it is time that many other countries also stand up and simply say "no". Andre

1 0

Call For Agenda Items - AA-WG RIPE 75
by Brian Nisbet 21 Aug '17

21 Aug '17

Colleagues, The next meeting of the Anti-Abuse WG will take place on Wednesday 25th October at 11:00 GST (UTC +4) during RIPE 75. While we have a few things for the agenda already, there is still space, so please let Tobias and I know if there is something you would like to present or propose in Dubai. However due to Dubai Department of Tourism & Commerce (DTCM) regulations any speakers at the meeting, including those in Working Groups, must provide additional information. This comprises of a colour photocopy of your passport and a short (at least 200 characters) personal profile. This information will be passed on to the RIPE NCC who will pass it on to the DTCM. The stated reason is to facilitate greater efficiency for event organisers and government entities that are responsible for granting permits. The data is used to conduct analysis, market research and examine industry trends. The data is not shared with other event organisers or ticket resellers/registration companies. Due to these regulations we will need to submit a finalised agenda by the 4th of September, so if you would like to add anything to the agenda, please make contact with aa-wg-chair(a)ripe.net soon. Tobias and I understand the unusual nature of this request and the effect it may have on AA-WG participation at RIPE75, but we still hope and plan to have an interesting agenda for the meeting. Thanks, Brian -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 2

More funny business involvolving the RIPE Route Registry
by Ronald F. Guilmette 15 Aug '17

15 Aug '17

I'd like to call the attention of all of you to a NANOG posting that I made recently: https://mailman.nanog.org/pipermail/nanog/2017-August/091954.html It would appear that the network AS29073, formerly known as Ecatel, and also formerly known as Quasi Networks, and now known as Novogara Ltd. may be having a spot of bother soon. The English translation of a document that I was given a link to today appears to indicate that some or all of the principals behind this specific "bullterpoof hosting" company have been ordered by a Dutch court to answer some pointed questions about their ownnership and/or control over this "Seychelles Islands" company, and perhaps also about their alleged tendency to provide hosting for other people's intellectual property: https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBDHA:2017:9026… That, of course, is not really -my- main concern. I am at the moment rather more concerned about the manner in which they came to be doing routing for a particular legacy Afrinic /14 block, i.e. the 196.16.0.0/14 block. That has not been adequately explained as of now, I think. I wonder if any of you on this list peer with this network, AS29073 and if so, why. It seems to have a rather colorful reputation, to say the least: http://www.cyberlightglobal.com/is-another-attack-on-western-financial-inst… http://news.softpedia.com/news/complex-bitcoin-phishing-scheme-leads-back-t… https://umbrella.cisco.com/blog/2016/06/20/bitcoin-wallet-phishes-reveal-ro… https://techcrunch.com/2012/08/04/grum-inside-the-takedown-of-one-of-the-wo… I can speak another time about how easy it was, apparently, for these clever fellows to slip a route object into the RIPE data base which would seem to sanction their routing of the suspect block in question. Regards, rfg

1 0

Re: [anti-abuse-wg] Not Abuse
by peter h 15 Aug '17

15 Aug '17

On Tuesday 15 August 2017 09.17, ox wrote: > Hi All, > > Some spammers are now sending "verify your email account" spam abuse. I would say that sending a single unsolicited "verify your email account" IS SPAM The keyword here is "unsolicited" This is not the same as a mail sent as a respons to some action done, subscribe or purchase from someone. That "verify your email account" is legitimate. But unsolicited is always spam. > > When an email address is submitted and a vendor confirms that email > address (prior to subscribing it to a bulk mail list, etc) : > > imho, sending a single (one) email to verify/confirm every 24 hour > period - with a maximum of two verify/confirms reminders (one per 24 > hour period) - is not abuse. > > But sending more than one verify/confirm email, in a single 24 hour > period - and sending more than 3 emails in total - in any period - is > abuse. > > I know that I have used the spammer, twitter.com before as an example, > but they are good examples to use. > > Twitter.com seems to never remove their victims email addresses (and > even ignores unsubscribe requests). Twitter.com also seems to go > through bursts of activity and sends many confirmation emails to > spamtraps (accounts that has never existed and only exists in stolen > databases - i.e not real person/people) - whether criminals or third > parties submit these fake email addresses to twitter.com or how > twitter.com obtains these addresses are not relevant to this thread > > What is relevant is: Do you agree that sending "more than 3 verify your > email account" is abuse? > > If you do not agree, what do you think that number should be? > > How many "verify your email address" and reminders to confirm, etc. is > not abuse, in your opinion? > > Like I said, I think one in 24 hours and a total of three, seems > reasonable to me. > > Thanks! > > Andre > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

2 1