March 2019 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Google Privacy Abuse
by Fi Shing 15 Mar '19

15 Mar '19

1 0

Re: [anti-abuse-wg] Google Privacy Abuse
by Esa Laitinen 14 Mar '19

14 Mar '19

On Thu, Mar 14, 2019 at 6:05 AM ac <ac(a)main.me> wrote: > HTTPS protocol, by design, is secure and private. > > The average consumer expects this to be true. > > Google had to actually go and change, in an "under cover" way, the > entire way and method that HTTPS works. This "change" is being sold as > a "good thing" to poor people and/or people with low bandwidth and that > Google is doing a "good thing" by making this change. > Dear Andre The URLs you're accessing are also available for - your ISP - your VPN provider (unless you've rolled your own) and some information is also potentially stored by - your DNS provider And Opera browser has been doing similar things when you've enabled the bandwidth savings. or am I missing something? OK. I'm ignoring here that this particular thingi is using MITM methods to do the optimization, which is for me a bit more worrying than google having access to the URLs I browse. They have them mostly anyway. But, it is a choice a user makes, it is not forced upon them. Yours, esa -- Skype: reunaesa Yahoo: reunaesa Mobile: +4178 838 57 77

2 1

Re: [anti-abuse-wg] Google Privacy Abuse
by Cynthia Revström 14 Mar '19

14 Mar '19

How is this relevant to RIPE? - Cynthia Thu Mar 14 06:05:10 GMT+01:00 2019 ac <ac(a)main.me>: > On Wed, 13 Mar 2019 14:28:24 -0700 > "Ronald F. Guilmette" wrote: > > ac you wrote: > > >Now Google has apparently started saving, tracking and keeping all > > >https URL's that its chrome/chrome lite products use. > > And? > > If you don't like it, vote with your feet and use a different browser. > > If you have trouble finding any such, try googleing for "browser > > download". > > Oops! But I guess that would expose you to mind numbing and > > tragically horrible snooping on your private parts. > > Sorry. My bad. > > Regards, > > rfg > > P.S. My apologies to the list for indulging that which should not be > > indulged. > > > > I see that you are ignorant of what this actually means? > > Maybe their are other tech's that are also ignorant of what this really > means? > > HTTPS protocol, by design, is secure and private. > > The average consumer expects this to be true. > > Google had to actually go and change, in an "under cover" way, the > entire way and method that HTTPS works. This "change" is being sold as > a "good thing" to poor people and/or people with low bandwidth and that > Google is doing a "good thing" by making this change. > > I know already: Everything Google is not always what it seems and it is > a slippery slope. Soon Google will also be storing all Chrome https url's > > Now: Here is the REAL bad evil - that is coming to YOU (and Me) in the > future: > > So, Chrome, for its tracking, will be faster. > > User will think - ooh, faster = better. > > In all probability this is just the very first change in how local > software manages HTTPS url's and other browsers may be forced to do > similar EVIL as the user (sheep) experience of Chrome users will be > faster (the local device will now store the actual media and link it > with the stored URL) > > By our silence and by our acceptance of the method and how Google does > what it does we allow this business to dominate and control. > > One could also argue that not only is this abuse, but it is fraud. > > As many things Google is often misrepresented. > > It should be made clear to consumers that they are products. > > Society should step up and Governments should do much much more > > to protect the weak, the stupid and all the sheep. > > The Google users do not expect, understand or agree that all the > https url's they visit will be tracked, used and stored. > > And, this is why this is abuse and/or evil. > > Andre > > > >

2 1

Re: [anti-abuse-wg] Google Privacy Abuse
by Ronald F. Guilmette 14 Mar '19

14 Mar '19

ac <ac(a)main.me> you wrote: >Now Google has apparently started saving, tracking and keeping all https >URL's that its chrome/chrome lite products use. And? If you don't like it, vote with your feet and use a different browser. If you have trouble finding any such, try googleing for "browser download". Oops! But I guess that would expose you to mind numbing and tragically horrible snooping on your private parts. Sorry. My bad. Regards, rfg P.S. My apologies to the list for indulging that which should not be indulged.

2 2

Re: [anti-abuse-wg] Verification of abuse contact addresses ?
by Fi Shing 13 Mar '19

13 Mar '19

5 4

Google Privacy Abuse
by ac 13 Mar '19

13 Mar '19

Hi All, https is meant to be secure and Google pushed hard for general adoption all over the planet. The premise was that the pages users visit and user traffic would be more private. Now Google has apparently started saving, tracking and keeping all https URL's that its chrome/chrome lite products use. Google says that Cookies and other personal data is not saved on their servers. https://www.slashgear.com/chrome-lite-pages-bring-data-saver-to-https-websi… The really bad and evil part is that Google is softly softly selling the Kool-Aid (https://en.wikipedia.org/wiki/Drinking_the_Kool-Aid ) and introducing this major, bulk and brutal invasion of privacy (to all the Google sheep/products) as something "good" and saving of bandwidth etc. Yet, technically, the products with the bandwidth issue still have little benefit in trade for this brutal invasion as they still have to download over the same slow network connection... WTF! This type of abuse is also an abuse of common sense and if Google wants to milk their sheep or track their products they should do so more directly and openly so that their products know and understand what the effect of being a google product is. Instead a big play is made that Google does not store the cookies or other personal data. Wow. Andre

1 0

Constructive Approach & Anonymity (Was RE: Verification of abuse contact addresses ? )
by Brian Nisbet 11 Mar '19

11 Mar '19

Folks, We aim for constructive discussion on the mailing list at all times and I would ask everyone to bear this in mind. I very much agree with " We make this a better world by helping with advice that empowers, not with diminish comments." I would also point out that there is no requirement for legal names to be used on the mailing list and there are many reasons in this world for anonymity. As a final point to consider, the word 'lame' isn't great as it is ableist. There are many, many other suitable words in the English language that merit examination that are much better in this context. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of > Serge Droz via anti-abuse-wg > Sent: Friday 8 March 2019 10:54 > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] Verification of abuse contact addresses ? > > Hi > > I'm fairly new here. This is a formidable task, and not easily achieved. > So kudos to RIPE for doing this. The abuse contacts already there helped me > a lot. > > I don't appreciate people who can't even stand up with their real names, just > pointing out that others are lame. > > We make this a better world by helping with advice that empowers, not with > diminish comments. > > Cheers > Serge > > > On 08.03.19 11:40, Shane Kerr wrote: > > Fi Shing, > > > > I'm sure verifying the delivery of 70k e-mails (or however many is in > > the database) can be done in a few hours. > > > > But Marco's response mentions to *correcting* the contact addresses, > > not just verifying them. That involves working with human beings, so > > it makes sense that it will take a while. > > > > Cheers, > > > > -- > > Shane > > > > On 08/03/2019 11.07, Fi Shing wrote: > >> If it takes more than a week to verify your entire database, there is > >> the first sign that something is wrong with your system. > >> > >> > >> -------- Original Message -------- > >> Subject: Re: [anti-abuse-wg] Verification of abuse contact > >> addresses ? > >> From: Marco Schmidt <mschmidt(a)ripe.net > >> <mailto:mschmidt@ripe.net>> > >> Date: Thu, March 07, 2019 10:03 pm > >> To: "Ronald F. Guilmette" <rfg(a)tristatelogic.com > >> <mailto:rfg@tristatelogic.com>>, > >> anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net> > >> > >> Hello Ronald, > >> > >> We are planning to publish an updated timeline soon. > >> > >> Ultimately, our implementation will depend of the level of > >> cooperation > >> we get from LIRs and the nature of issues that need to be fixed > >> before > >> an abuse contact can be updated (for example, some organisations > >> may > >> need to reset their maintainer password). > >> > >> Over the next few weeks we will be analysing our progress, to > >> make a > >> realistic estimation. From observations so far, we think we might > >> be > >> able to finish our initial validation of all abuse contacts > >> within six > >> months - but it is still too early to make any strong predictions. > >> > >> Kind regards, > >> Marco Schmidt > >> RIPE NCC > >> > >> > >> On 05/03/2019 21:51, Ronald F. Guilmette wrote: > >> > In message <9c95c110-d5a3-e94a-6b3c-b02030736e7c(a)ripe.net > >> <mailto:9c95c110-d5a3-e94a-6b3c-b02030736e7c@ripe.net>>, > >> > Marco Schmidt <mschmidt(a)ripe.net <mailto:mschmidt@ripe.net>> > wrote: > >> > > >> >> It is correct that the implementation phase is still ongoing. > >> Currently > >> >> we are validating all the abuse contact information referenced > >> in LIR > >> >> organisation objects. Then we will proceed with the validation > >> of abuse > >> >> contacts referenced in LIR resource objects - the example that > >> you > >> >> mentioned belongs to this group. And finally all abuse > >> contacts > >> >> referenced in End User (sponsored) objects will be validated. > >> > Thanks for the info Marco. > >> > > >> > I guess the only question I would ask is this: Is there a > >> published > >> > timeline for how this whole process is planned to play out, and > >> for > >> > when it is planned to be completed? > >> > > >> > > >> > Regards, > >> > rfg > >> > > >> > >> > > > > > > -- > Dr. Serge Droz > Member of the FIRST Board of Directors Senior Advisor ICT4Peace > https://www.first.org https://www.ict4peace.org

4 3

Re: [anti-abuse-wg] Verification of abuse contact addresses ?
by Fi Shing 11 Mar '19

11 Mar '19

5 4

Re: [anti-abuse-wg] Verification of abuse contact addresses ?
by Fi Shing 08 Mar '19

08 Mar '19

4 3

Verification of abuse contact addresses ?
by Ronald F. Guilmette 08 Mar '19

08 Mar '19

Sorry folks, when this topic was discussed, I confess that I wasn't really paying much attention. So now I am forced to ask: Was someone going to verify the abuse contact addresses listed in the RIPE WHOIS data base? If so, how is that project coming along? I'll tell you why I ask. It's quite simple really. Some jerk, probably Mexican, just sent me a spam wherein he was advertising for sale his list of 18 million "business" email addreses. (I can't quite tell if those are all supposed to be specifically Mexican email addrses or what... because the spam was written in Spanish, and I don't speak Spanish.) https://pastebin.com/raw/dT11krpN Note that the specific email address of mine that was spammed was one that I only used in ancient times, and only in conjunction with my activities on one specific web site. (It obviously leaked somehow.) The envelope sender address was forged to be my own. The source IP was 109.68.33.19 as you can see. So naturally, I performed a RIPE WHOIS query on that IP address and the results I got back indicated that the contact email address for spam reports was <abuse(a)meshdigital.com>. So I emailed off a report to that address. Of course, it bounced back to me immediately as undeliverable. This causes me to suspect that either (a) that stuff that I thought that I has seen previously about a project to verify abuse addresses was all just a bunch of malarkey, or else (b) that project is still unfinished and perhaps not going all that well. Could someone please enlighten me and tell me which possibility actually applies? Regards, rfg P.s. It is annoying enough to have to lookup who the bleep should receive a report about spamming from their network _and_ to have to even write such reports, when 9 time sout of ten, the sending network could have easly prevented the spam from even going out. It is just adding insult to injury when the bloody "official" abuse reporting address doesn't even actually exist. And of course, neither meshdigital.com nor meshdigital.net even have functioning web sites. Apparently this is all the work of some dolts at a company called heg.com, in Germany. Do any of you happen to know any of the clueless nitwits who work there? If so, maybe you could put me in direct touch so that I could personally apply a much needed clue-by-four.

3 5