April 2024 - anti-abuse-wg - mailman.ripe.net

Draft Agenda - AA-WG Session @ RIPE88
by Brian Nisbet 22 Apr '24

22 Apr '24

Colleagues, The RIPE Anti-Abuse WG will meet at RIPE88 in Krakow. Our session is planned for 16:00 - 17:30 CEST on Tuesday 21st May and participation will be possible both in person and online. Here is the (very full!) draft agenda for our WG session. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * MeetEcho Mic & Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 87 * Working Group Chair Selection * Finalise agenda * Code of Conduct B. Update * B.1. Recent List Discussion * B.2. AA-WG Future & Possible Recharter Discussion C. Policies - *C.1. D. Interactions - *D.1. "Illegal content online: What is our role as a Regional Internet Registry" - Maria Stafyla, RIPE NCC E. Presentation - *E.1. Change the narrative: How to successfully get consent on Internet standards deployment - Wout De Natris, De Natris Consult *E.2. Peering into the Darkness - The Use of UTRS in Combating DDoS Attacks - Yury Zhauniarovich, TU Delft X. A.O.B. Z. Agenda for RIPE 89 We look forward to seeing you at the meeting! Brian, Markus & Tobias Co-Chairs, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

LEA Transparency Report 2023
by Theodoros Fyllaridis 18 Apr '24

18 Apr '24

Dear colleagues, We have published a transparency report that details the nature and number of requests we received from Law Enforcement Agencies in 2023. You can find the report at: https://www.ripe.net/publications/docs/ripe-819/ . Kind regards, Theodoros Fyllaridis Legal Counsel RIPE NCC

7 15

On "very" fast IPv6-growing entities
by Natale Maria Bianchi 12 Apr '24

12 Apr '24

This specific case is not involved with observed abuse, but it elicited my curiosity. It is not the first time that I see such things, and I'd like to see what other people think. A GB entity with a ukrainian director, incorporated on 23 March 2024, gets an ASN (AS215158) assigned by RIPE NCC on 05 April 2024, and now, just a week later, they are announcing no less than ten /29 IPv6 networks regularly assigned to them: 2a11:e8c0::/29 2a11:ea80::/29 2a11:ff40::/29 2a12:1040::/29 2a12:2e80::/29 2a12:3c00::/29 2a12:8580::/29 2a12:8a00::/29 2a12:9300::/29 2a12:d080::/29 That is quite a bit of space, indicating the entrance in the field of a large communication company making a large investment on infrastructure in preparation for a sizable number of users. So you look for their website, but in vain. They do not even expose their domain in the RIPE database, just a mailbox on a freemail. So my curiosities are: - what will this huge IPv6 space be used for? - what is the business area of this company? - can any individual easily grab ten /29's just for the fun of it, since there are plenty of them (2^29) before we need to think about 512-bit IPv8? - shouldn't the intended usage be made publicly visible somehow, so that the community can see how and why the space is used, and statistics can be made? (if it is already, I apologize and will appreciate pointers). Natale M Bianchi Spamhaus Project

3 4

Call for Nominations: Co-Chair of the Anti-Abuse Working Group
by Markus de Brün 11 Apr '24

11 Apr '24

Dear colleagues, Brian's term as co-chair of the Anti-Abuse Working Group will conclude at RIPE 88. As such, we are initiating the selection process for a new co-chair. You can find detailed information about the selection process at [1]. We encourage you to submit nominations, whether self-nominations or nominations of others, before 17:00 CET on 5th May 2024. For those interested in understanding the responsibilities and expectations of a working group co-chair, please refer to RIPE-692 [2] and RIPE-765 [3]. If you have any further questions or would like to submit a nomination, please do not hesitate to contact us at aa-wg-chair(a)ripe.net. Kind regards, Markus Co-chair, Anti-Abuse Working Group [1] https://www.ripe.net/community/wg/active-wg/anti-abuse/anti-abuse-wg-chair-… [2] https://www.ripe.net/publications/docs/ripe-692 [3] https://www.ripe.net/publications/docs/ripe-765/

2 3

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 146, Issue 10
by Wout de Natris 10 Apr '24

10 Apr '24

It has been a while that I was in LEA, but I remember this same complaint from the 00s. A LEA-RIPE NCC working group was started circa 2008 and that led to a lot better understanding of each others competences and information that could be shared. Like myself, all these people are now in other positions. So, without me knowing what is asked by whom, a renewed effort could be the answer. @Michele @Serge. Yes, at times I hear exasperation from law makers as well. The fact that this very WG is discussing its future remit, if there is one at all, may well be one of the causes of this exasperation. Self-regulation does mean just that. It should not equate inactivity. The alternative is regulation. In more and more stages of society in general, this is becoming the case. The Internet already is and will not be an exception. There's still a chance to self-regulate. Kind regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of anti-abuse-wg-request(a)ripe.net <anti-abuse-wg-request(a)ripe.net> Sent: Wednesday, April 10, 2024 12:07 PM To: anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: anti-abuse-wg Digest, Vol 146, Issue 10 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: LEA Transparency Report 2023 (Michele Neylon - Blacknight) 2. Re: LEA Transparency Report 2023 (Michele Neylon - Blacknight) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Apr 2024 10:03:36 +0000 From: Michele Neylon - Blacknight <michele(a)blacknight.com> To: Suresh Ramasubramanian <ops.lists(a)gmail.com>, Serge Droz <serge.droz(a)first.org>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] LEA Transparency Report 2023 Message-ID: <DB8PR09MB3324C8ED9C46B8F36AE42BC7CD062(a)DB8PR09MB3324.eurprd09.prod.outlook.com> Content-Type: text/plain; charset="windows-1252" Suresh The devil is in the details?. Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours. From: Suresh Ramasubramanian <ops.lists(a)gmail.com> Date: Wednesday, 10 April 2024 at 10:38 To: Michele Neylon - Blacknight <michele(a)blacknight.com>, Serge Droz <serge.droz(a)first.org>, anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] LEA Transparency Report 2023 [EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources. LEA especially the computer crime part of LEA has been dealing with RIRs for some decades now? The specifics of this case would be interesting. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Michele Neylon - Blacknight via anti-abuse-wg <anti-abuse-wg(a)ripe.net> Sent: Wednesday, April 10, 2024 3:02:51 PM To: Serge Droz <serge.droz(a)first.org>; anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] LEA Transparency Report 2023 Serge The report speaks about French LEA asking RIPE for data that RIPE does not have. You then go off on some complete tangent about governments not being satisfied with tech companies. How are the two related? What purpose does asking RIPE (or anyone else) for data they simply do not have serve? A much more rational explanation is that LEA simply do not understand what data RIPE (or others) have and that maybe the solution is to educate them. I have heard from some in LEA that the amount of engagement from RIPE, ICANN etc., in the past couple of years has reduced, though that?s purely anecdotal. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours.

1 0

Reverse DNS delegations
by Alessandro Vesely 08 Apr '24

08 Apr '24

Hi all, what's the policy for reverse delegation? My provider assigned me a 2a02:29e1:500:6c00::/56. Great. However they didn't delegate reverse DNS. Indeed, their own 2a02:29e1::/32 has no delegations: ; <<>> DiG 9.18.24-1-Debian <<>> 1.e.9.2.2.0.a.2.ip6.arpa ns ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19800 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: cad8ae482b0e559c01000000660fe49763aa815e05fda159 (good) ;; QUESTION SECTION: ;1.e.9.2.2.0.a.2.ip6.arpa. IN NS ;; AUTHORITY SECTION: 0.a.2.ip6.arpa. 3600 IN SOA pri.authdns.ripe.net. dns.ripe.net. 1712314758 3600 600 864000 3600 Now there are mail servers which reject mail if they don't find a matching PTR: <<< 554 resimta-c2p-559421.sys.comcast.net resimta-c2p-559421.sys.comcast.net 2a02:29e1:500:6c00::4 Comcast requires that all mail servers must have a PTR record with a valid Reverse DNS entry. Currently your mail server does not fill that requirement. For more information, refer to: https://postmaster.comcast.net/smtp-error-codes.php#554 Why isn't it possible to gain a delegation by proving number assignment? Best Ale --

6 16

Seeking Input on the Future of the Anti-Abuse Working Group
by Markus de Brün 03 Apr '24

03 Apr '24

* Dear Anti-Abuse Working Group Members, As Co-Chairs, we have been carefully monitoring the discussions on the mailing list and are concerned about the current state of stagnation and lack of progress. After consideration and discussion among the Co-Chairs, we believe it is necessary to initiate a dialogue regarding the future direction of our working group. Some action is needed to revitalise our efforts. The Co-Chairs have discussed a number of options, both between ourselves and with the RIPE Chair Team. However, due to the lack of general engagement, and the circular conversations on the list, we see three viable options at this point:: 1. Re-charteringthe working group, possibly transitioning it into a Security Working Group to broaden our scope and address related concerns comprehensively. (The current charter can be found here: https://www.ripe.net/community/wg/active-wg/anti-abuse/ <https://www.ripe.net/community/wg/active-wg/anti-abuse/>) 2. It is possible we are simply the wrong Co-Chairs at the wrong time, so we can step-downand allow the working group to select new Co-Chairs. 3. Closing the working groupif consensus cannot be reached on a viable path forward. It may be that there are people in the Working Group who are eager to propose new policies, or embark on a project to systematically examine the abuse ecosystem, but over the last year or so, there has been no evidence this is the case. However, we firmly believe that the best course of action is to engage all members of the Anti-Abuse Working Group in an open and transparent discussion about the challenges we face and the opportunities for positive change. Your input and perspectives are invaluable in shaping the future of our community. Therefore, we are inviting you to participate actively in this crucial conversation. We encourage you to share your thoughts, suggestions, and concerns regarding the current state of the working group and your vision for its future direction. Your input will help inform our next steps and guide the evolution of the Anti-Abuse Working Group. We encourage you to share your feedback openly on the mailing list so that all members can participate in the conversation. We hope to discuss the status at RIPE88. Thank you for reading this far. We look forward to your active participation in shaping the future of the Anti-Abuse Working Group. Best regards, Brian, Tobias, Markus *

11 10