- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by Ronald F. Guilmette 19 Aug '16

19 Aug '16

ox <andre(a)ox.co.za> wrote: >(4) Sanctioned >An action, event or situation originating from the authoritative holder >of rights to a resource that gives permission, or permission is granted >by direct implication, which authorises that situation, event or action. OK, Andre, I give up. Congratulations. You've succeded in wearing me down until I just give up. That fact that you still clearly either can't or won't comprehend that the "authority" you speak of has to come from somewhere convinces me that you are now -deliberately- failing to understand. Authority for Internet number resources begins at IANA, and then devolves down to the Regional Internet Registries. The fact that you can go on attempting to define "sanctioned" without ever even menioning any of these official bodies, or their authority, has persuaded me that you actually do not -want- to understand this simple but overridingly critical point. I already asked, multiple times, and in multiple ways, "Sanctioned by who? Sanctioned by what?" But you continue to carry on as if this is just an unimportant, annoying, and irrelevant detail. When push comes to shove and someone asks "Who decides who the authoritative holder of rights to a resource is?" you can just tell them "Judge Judy."

2 1

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by Ronald F. Guilmette 19 Aug '16

19 Aug '16

ox <andre(a)ox.co.za> wrote: >================= >Definition of abuse >================= > >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" > >----------------------------------------------- >Terminology used in the definition >----------------------------------------------- > >(1) Sanctioned >An action, event or situation that specifically or expressly gives >permission, or permission is granted by direct implication, which >authorises that situation, event or action So, if, for example, I, Ron Guilmette, give my friend Joe Hacker, my permission to DDoS your corporate web site, that's OK then, yes? Because he has my permission. Yes? Before responding, in heat or otherwise, please read and consider: To any who may think that I'm just quibbling and/or being pedantic about the definition of the terms of reference here, I'd like to just mention a short and rather famous phrase from another document where the terms of reference were also not adequately or precisely defined, at the outset, and where that lack of specificity, in the end, gave rise to what may perhaps have been the greatest single tragedy to have ever befallen my own great nation: "... that all men are created equal..." At the time that was written and signed, there was an *implicit* understanding among some of those who signed it that the term "all men" in this context was quite obviously intended to mean "all white men". Some of the signers believed that's what it meant. Some others did not. That simple lack of specificity festered, like an open gangrenous wound, in the American body politic until some four score and some odd years later when the differing interpretations finally broke out into armed conflict... The American Civil War, in which brother killed brother, and over 600,000 Americans lost their lives. And of course, I haven't even mentioned the civil strife and hardships of the early 20th Century, as the original term of reference, "all men", slowly started to become redefined, yet again, to mean "all human persons, both male and female"... a redefinition that is still a work-in-progress as of this writing, a full century after it began. So before anybody *else* tells me... like Andre... that I'm just nitpicking or being pedantic, I refer you again to the phrase "... that all men are created equal..." and ask you to consider that the final and total costs of your ambiguities may, in the end, perhaps be borne not just by you, but perhaps also by your children as well. Words matter. Regards, rfg P.S. I have no real feeling, one way or the other, about Andre's general _formulation_ of the definition of abuse. It may perhaps be great. It may perhaps be the absolutely best and most concise way of stating our common beliefs on this subject. It's not the general formulation I have issues with. It's only the lack of clarity with respect to the terms of reference. Once those are adequately and crisply clarified, I might actually like what Andre proposes.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Dave Crocker 19 Aug '16

19 Aug '16

On 8/16/2016 6:08 AM, ox wrote: > unfortunately, I do not know what abuse is, yet. An exercise that might help, but which is certain to have a poor signal-to-noice, is to ask everyone to post examples of what they think is abuse, or rather to post every example they think /might/ be abuse. The group then looks at the resulting compendium of examples and formulates an agreement of what examples are, and what examples are not, abuse. Then there is an attempt to formulate a concise description of what is in. It's likely that the examples will be pretty diverse, so that some sub-categorization might produce a more coherent labeling. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net

9 15

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

On Thu, 18 Aug 2016 13:14:53 +0200 ox <andre(a)ox.co.za> wrote: > ================= > Definition of abuse > ================= > > "The non sanctioned use of a resource to infringe upon the usage > rights of another resource" > > ----------------------------------------------- > Terminology used in the definition > ----------------------------------------------- > > (1) Sanctioned > An action, event or situation that specifically or expressly gives > permission, or permission is granted by direct implication, which > authorises that situation, event or action > > (2) Resource > Any Internet Resource > > (3) Use and Usage > Any direct or indirect action involving a resource > > (4) Infringe > An action, event or situation which limits, reduces, undermines or > encroaches upon the fair use of a resource > > (5) Rights > All sanctioned allocation or assignment of any resource > Maybe rather : The sanctioned entitlement to use an allocated or assigned resource > > Andre > >

1 0

Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

================= Definition of abuse ================= "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ----------------------------------------------- Terminology used in the definition ----------------------------------------------- (1) Sanctioned An action, event or situation that specifically or expressly gives permission, or permission is granted by direct implication, which authorises that situation, event or action (2) Resource Any Internet Resource (3) Use and Usage Any direct or indirect action involving a resource (4) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource (5) Rights All sanctioned allocation or assignment of any resource Andre

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Okay, just to be clear and precise: You agree that the definition of >abuse is: > >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" You're not hearing me. The answer is "No, I neither agree nor disagree with your formulation for the simple reason that it is amost entirely ambiguous, and thus meaningless, because you haven't defined _any_ of the terms used. Thus, your formulation could mean almost anything that either the writer or the reader wishes it to mean, and thus, it has no real meaning at all." Examples: If by "sanctioned" you mean "agreed to, explicity, and in writing, by Ronald F. Guilmette, regardless of the sentiments or opinions of others" then yea! That will work great for me! I'll accept that! I have a funny feeling however that when and if we were to make this simple and innocuous "clarification" to the definition of "abuse" you are proposing, some other people might possibly object however. Similarly, if by "another resource" you mean "only the Bratsk Hydroelectric Power Station in Irkutsk and no other resources" then no, that isn't quite broad enough for me, nor is it likely to be for anybody else. You're trying to get everyone to agree to a set of words strung together to form a sentence, even though nobody, including you, even has a clear notion of what any of the individual words mean, or are intended to mean. It is a silly and pointless exercise, absent definitions of the terms on reference. Anybody can vote in favor of the proposition that "All God's children should be happy." The devil is in the details. Ask any lawyer. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Making a fraudulent representation to RIPE in order to obtain >resource(s) - is/are abuse Yes. >and then, that five other definitions may be required for those >people that are not as technical. No. Five other definitions are required for your general statement of general principal to have any meaning *at all* to *anyone*. >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" This is swell, as a general statement of general principal, but in the utter absence of definitions of the terms of reference, it is functionally equivalent to the following statement of general principal: All God's childern should be happy. That's an admirable sentiment, and one which most folks would be happy to agree with, but absent a clear statement of who the writer means to include in the term "God's children" and/or a specification of what any of us are being asked or expected to do in order to achieve this general outcome, it is a statement devoid of actual meaning, and is thus just a political slogan. >My position is as follows regarding fake WHOIS information: > >It is clearly fraud to submit fake information in order to obtain a resource > >Fraud is clearly a criminal act > >Either way, using a resource to infringe upon the usage rights of >another resource, which was obtained by fake information, would fit into >the above definition as the use of that resource would not be sanctioned. > >It is important to mention though, that the resource would have had to >be used though, for there to have been abuse in the first place. Defined "use". If I announce a route to an IP block, e.g. one that isn't actually assigned to me, but then I never put anything in that block, have I "used" it? Some what say "yes". Others would say "no". >I think in the further definitions this could be fleshed out for the >non technical or not as technical people You've missed the point entirely. The additional definitions are not simply necessary to satisfy pointy-headed geeks. The additional definitions are necessary for your general statement of general principal to have any actual meaning AT ALL to anybody. Who are "God's children"? Do you mean only the children of His Chosen People? It makes a difference. You need to define terms.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >The above definition DOES include spamming - You say it does not, etc >etc etc. etc. That is a complete misreading of what I wrote. My only comment what was to say that I disagree with your formulation of the definition (of "abuse"). I did not specifically pick out or mention what thing or things I disagreed with. (However since you made an issue of it, now I will. See my P.S. below.) What I did do instead was to formulate, from scratch, my own definition of "internet abuse", then presented it, and the rationale for it, totally without any reference of any kind, either positive or negative, to anybody else's preferred definition. Regards, rfg P.S. If specifically asked however, I would critique your current working definition as follows: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" This does not cover AT ALL cases where fradulent data has been deliberately entered into the WHOIS data base. You attempt to ignore this entire problem area... to just sweep the whole thing under the rug as if it doesn't exist... kinda makes me wonder if you are just shilling for Sasha Luck, who doesn't want to see there be a WHOIS data base AT ALL because, you know, god forbid that anybody or any company should ever actually be held, you know, accountable. No no no! We can't have THAT now can we? So? Are you shilling for the "pro-privacy" and "anti-transparency" lobby, or what? It's not like you could have missed the fact that bogus WHOIS data has been a topic here recently. Further critique: Your "definition" will require five additional definitions of its own before it will even mean a blasted thing, actually, to anybody: Define "sanctioned". (Sanction by whom? Sanctioned by what? The law?) Define "use". (If I send a packet to you, did I just "use" you?) Define "resource". (Do resources include WHOIS records? If not, why not?) Define "infringe". (If I make a copy of your webpage, have I infringed?) Define "rights". (Which rights, in particular? Who or what grants these "rights" you speak of? God? IANA? RIPE? My local city council?) Until you define those additional five things, your definition doesn't even MEAN anything. Not in any real, meaningful, or concrete sense at least. That's why I didn't even think the whole thing was even worth commenting on, quite frankly, i.e. because it seems so tenuous and incomplete. So I just got out a fresh blank sheet of paper and started writing my own version, which I posted, explained, and provided necessary definitions for, so that readers would have a prayer in hell of being able to at least understand what it means.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >So, If you do not agree with the final definition, please contribute? I don't. The bottom line here is that "abuse" should probably be all of the crap that there is universal or near universal agreeent is "bad" *and* that *fails* to rise to the level of being SOOOOOOOOO terrifically awfully bad that we acually want to risk calling in the already exceptionally busy (and notoriously ham-fisted) LE people to deal with it. This would include, at the low end, just for example, spamming. You're *not* going to run down to your local police station screaming "Mommy! Mommy! He spammed me! Make him stop!" You're not going to do that because (a) it would be silly and because (b) when you got there, even the cops would tell you how silly you were, and how much "real" work they have to do, e.g. monitoring terrorists and catching bank robbers. So basically, all the stuff that we, as rational adult experienced Internet users agree that we *would* want to call LE in on is called "crime". Meanwhile, everything else that we can all agree is "bad" and that "shouldn't happen on the civilized internet" but that *DOES NOT* quite rise to the level where it makes any sense to call in the LE people (e.g. route squatting, spamming) is "abuse". We call this stuff "abuse" rather than "crime" because everybody agrees that it shouldn't happen, but 99.9% of all governments, all around the world, are too stupid to understand any of this stuff, and as a result, you won't find a single country, anywhere in the world, that has formally made route squatting a crime, and also, even my own idiotic country has actually *legalized* spamming. So spamming is not a "crime"... at least not here in the United States, and at least not ACCORDING TO OUR MORONIC LAWS. Spamming *is* however "abuse" on and of the Internet, and most of us, being adult experienced Internet usesrs would and do agree on that, *regardless* of what the law might say in any given meatspace geographical jurisdiction. We know that certain things are "abuse" (e.g. spamming), even if the moronic bribed luddites in our respective national legislatatures do not. So, to review: crime -- Defined as whatever the dumbass meatspace legislators in various dumbass meatspace jurisdictions say it is Internet abuse - Defined as whatever most or all of *us* (actual experienced Internet users with a technical clue) say it is. You can draw a simple Venn diagram, consisting of two circles, each representing the above two things. And there is and will be some overlap, the amount or exact edges of which will be different in each different meatspace jurisdiction. But to the extent that there is overlap, we agree that FOR OUR PURPOSES we prefer that for all those things that might qualify as being -both- "abuse" -and- "crime" we make a judgement call and say that we would prefer LE to just butt out and let us handle it, because if THEY do it, they will either phuck it up (a la Aaron Swartz) or they will waste their precious resources which should be used elsewhere. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >On Wed, 17 Aug 2016 03:31:49 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> I've made three simple points, none of which should really be all that >> difficult to understand. These three points are as follows: >> >> 1) In practice, law enforcement *can't* deal with these things. >> They don't have the resources or, in general, the technical >> competence to even understand them. (See link below.) >> > >They can, and they do. > >an example from two emails ago: >http://www.pcworld.com/article/174651/article.html No. I really can't fathom how you managed to so throughly mis-read that article. You need to go back and read your own reference again. Read the PCWorld article. This time try to comprehend what it actually says. Note that when I said "law enforcement *can't* deal with these things" the specific "things" I was referring to were simple deceptions, perpetrated upon RIPE by various parties in order to obtain number resources. As the PCWorld article makes abundantly clear the police were *already* looking into the various *other* criminal activities of the Russian Business Network, well before there was any interaction between law enforcement and RIPE. And further, by the time that there *was* some interaction between law enforcement and RIPE, it *did not* occur because RIPE had called the police to say "Oh help us! These evil RBN people have tricked us!" Rather, in this case, it was entirely the other way around: Law enforcement came to RIPE to tell RIPE that RIPE was, in effect, guilty of money laundering. That, of course, is yet another example of the generallized "Aaron Swartz principal" which states that *in general* when law enforcement becomes involved in any "cybercrime" matter which *does not* involve some really straightforward crookedness (i.e. a large sum of money being effectively or actually stolen) they routinely screw it up, go overboard, and start blaming all the wrong people. Regards, rfg

2 1