- anti-abuse-wg - mailman.ripe.net

Agenda Items - RIPE 65 - First Call
by Brian Nisbet 08 Aug '12

08 Aug '12

Colleagues, I do hope you're all enjoying your summer holidays, but I wanted to mention that RIPE 65 is around six weeks away (give or take) and the Anti-Abuse Working Group session has space on the agenda for any items you may will to raise at the meeting. Please contact me on or off list if you think you might like to present on (or just talk about) any items of interest to the community. Regards, Brian.

1 0

the mandatory abuse field
by Frank Gadegast 04 Aug '12

04 Aug '12

Hi all, I really have the feeling, that some in the community fear a mandatory abuse field, and try find any strange argument against it, but I really cannot see why. If somebody does not want to receive abuse reports or does not want to do something against abuse originating from his own resources or likes to receive them not via email or has whatever else reason, well, name it this-email-address-is-not-being-read(a)yourdomain.com or no-reply(a)example.com or send it to devnull ... Lots of resource holders are already doing the same, we keep a list of there email addresses, so we do not have to send them reports that will only fill our mail queue to bounce back. I can understand them and respect that others like to work things different and we do not send them reports anymore. On the other end, a mandatory abuse field will clean up everything in RIPEs database, remove the unparseble remarks, will help the abuse teams to receive reports only to ONE address, because sender can be educated, abuse tools can be simplified and integrated in webpages easily aso ... A mandatory abuse field has that much advantages for everybody who likes to work against abuse, that I cannot understand, why people, that do not want the same for there own reasons are against it. Let us optimize our procedures and if you do not want to participate, well set the email address to whatever or ignore every incoming mail ... Well, there is one reasons I can think of: Those people are not concerned, that they have to do something against abuse coming from there OWN resources, it must be the people that are causing the abuse problem in the first place, its there business, and so they are worried, that others find easier and better methods in preventing abuse. So, my personal summary is: --- Anybody, who is against a mandatory abuse field, is a professional spammer, abuser, maintains a bot net or sells open proxies or other services used for abusing others. They are criminals to my opinion. But thats only my impression ... --- Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

11 41

Re: [anti-abuse-wg] the mandatory abuse field
by None 03 Aug '12

03 Aug '12

1 0

Re: [anti-abuse-wg] the mandatory abuse field
by Jørgen Hovland 02 Aug '12

02 Aug '12

2 1

2011-06 Proposal comment
by Davide Migliavacca 02 Aug '12

02 Aug '12

Dear all, being a newcomer in this group I took some time to review the proposal and go through list archives for previous discussions on the 2011-06 policy proposal. I believe this proposal goes in the right direction to solve long-standing issues with RIPE resources whois data usability for abuse report routing, and I would love see the proposal move forward and become policy allowing the implementation phases to start. Thanks to all WG members for their work so far. Kind regards, Davide Migliavacca CTO, ContactLab ------------------- Milano, IT Tel +39 02 2831181 Fax +39 02 70030269 www.contactlab.com

1 0

Manual vs automated reports
by Luis Muñoz 01 Aug '12

01 Aug '12

Hi there, I've been quickly going through the archives to try to catch up in the discussion after reading the current document. It struck me as odd that the role objects will have a single abuse-mailbox object which should be used to receive both automatic and manual reports. I'm aware of this (related) exchange (from the archives): From Tobias Knecht > > Is it for high volume automated report dissemination (trap or sensor initiated > > identification of "activity")? > > > For this to work it needs automated handling on the receiving side and it should > > be clearly opt-in, so that the receiving entity can prepare for proper processing. > > Disagree from my experience in the anti-abuse industry. First of all > reporting must be easy and receiving reports must be easy as well. [...] > > Second, if you do not want to receive reports from one party, block them > or directly delete them. That is best practice and widely adopted and > really not complicated to do. [...] While this matches my experience -- and I'm sure this will also match with the experience of anybody who has had to handle a large volume anti-abuse operation -- I remember there were times where I wished there was an easier way. The automated reports tend to vastly outnumber the manual reports, which also mix with the loads of spam that are (purposely?) pointed at the abuse contacts. This complicates the task of sifting through the mail flow to direct the complaints into their proper bins for processing. There's also the case of those that don't care about abuse originating from their resources. Those are likely to simply devnull their abuse complaint flow just as they have been doing up until now. I believe that having an optional "auto-abuse-mailbox" object (that is mandatory to use when present) dealing only with automated reports, could help anti-abuse operators (both in the report sending and receiving sides). The automated, high volume generators can decide not to waste resources with entities that do not have the right objects setup (ie, if there's not an auto-abuse-mailbox, do not generate the report) and the entities that are not prepared to deal with automated reports, could signal that to the community by not defining an auto-abuse-mailbox. Note that I still support the notion of a mandatory abuse-mailbox where manual complaints can be sent. At least that takes a way a lot of (guess)work out of figuring out where to send the complaint. Best regards -lem

17 50

Re: [anti-abuse-wg] 2011-06 Review Phase Extension
by Jørgen Hovland 31 Jul '12

31 Jul '12

5 4

2011-06 Review Phase Extension
by Brian Nisbet 31 Jul '12

31 Jul '12

Colleagues, Thank you all for your discussion on 2011-06, however I will admit that the picture of how the Working Group stands in regards ton consensus is not clear. At various points in time different members of the WG have spoken up, voiced objections, agreed, asked questions or answered questions, but in several circumstances the opinions were still not clear after all the discussion. In order to try to get a clear idea of how to progress and after speaking to the NCC in regards to the PDP I have decided to extend the Review Phase by four weeks to see if that can produce some clarity. I would ask if members could raise any points that they are still uncertain about and state as clearly as possible, their current opinion on the proposal. I would encourage everyone to read the last mails from Tobias and the NCC (in the guise of Denis Walker) as they address a number of points. While I'm hoping we can get a clearer picture in less than four weeks given that we are now in mid-summer, a decent period of time seemed like a good idea. Thanks, Brian, AA-WG Co-Chair

4 5

Re: [anti-abuse-wg] the mandatory abuse field
by Frank Gadegast 29 Jul '12

29 Jul '12

Lu Heng wrote: >> region, where its legal to abuse computers and services) >> > > Every country has different legal definition about spam, or "abuse", Again, "every country" does not count. Its illegal in my country, and they are harming me personal as well as my business, so I can call them criminals. > spam and abuse are very broad term, without court judgement of the Thats right, but as for the RIPE region, it will only count, whats law in the RIPE region and most countries have very similar laws here, specially those in the EU. > activity, I will be very careful calling anybody criminal--as I don't > have the rights to identify them(I am not sure which country you came > from, ( that why I usally do not hide and add a sig) > at least the countries I ever heard of in my life, the rights of > identify someone as criminal are only hold by judges. not even police > has rights to call someone criminal--they can call "suspect"). So I can call those criminals, that are already in jail ? Well, happening every day in Germany. > Ripe region cross wide range of culture and countries, I don't believe > anybody in any specific region has rights to define what is "abuse" > for another very different country. and especially regarding the legal > terms like "criminal" is very serious term that I don't believe > anybody has rights to identify the entire ripe region's population, > not even EU, as Ripe covers wider area than EU does. Sad enough, what a stupid idea to set up an organization without common law ... > But again, Ripe is only a registration service, No RIPE is a community. RIPE NCC is offering the services. > Ripe NCC has no rights > either the entire community has no rights to identify any body in a > legal term, if a spammer need an IP range for a technical term, Ripe > NCC has to give to them--It is not Ripe NCC's position to judge Never said and sure not. The NCC can give the resources to any MEMBER ! They are not giving them to the community ! Only to members. So: why should the community decide about the format of the database ? > anybody's action if legal, seems to me so many times people forget > that Ripe NCC is only a registration service, they are not government > of the internet, either they need a police force to regulate the > internet. Well, the police IS regulating the internet, according to the laws of several countries and every day criminals are being send to jail for some computer crime. Worldwide. And if they are allowed to use an internet terminal in their cell, they could even post here, that a mandatory field is stupid, without any good reson against it. And the so-called "community" then does not have any consensus ... Oh, Im fantazising know ... Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

Re: [anti-abuse-wg] the mandatory abuse field
by Frank Gadegast 28 Jul '12

28 Jul '12

H.Lu wrote: > Hi > Hi, >> So, my personal summary is: >> --- >> Anybody, who is against a mandatory abuse field, >> is a professional spammer, abuser, maintains >> a bot net or sells open proxies or other services >> used for abusing others. >> They are criminals to my opinion. >> > > I think this is a bit too absolute... Not at all. There is only four types: 1 people that do like to do something against abuse originating from there resources 2 people that do like to do something against abuse reaching there networks 3 people that do not like to do anything against abuse originating from there networks Some of those interest could be combinated. (and all those will have no problem with the mandatory abuse field, they will either love it or they can ignore it) and: 4 people that dont want that others have it easier to work against spam THEY cause > > But even they are, identify them as criminal might not be true as in some country spam might not even consider as offense. Well, its illegal in my country, so I can call them criminals. (please do me a favor and name one country in the RIPE region, where its legal to abuse computers and services) The big question is: - should we stop any progress in spam reporting and the cleanup of the database because of people, that are criminals in most member countries ? - and that are not even located in the RIPE region ? - and that are no members ? The following always puzzled me anyway: how can people influence the regulations without being members or without bing located in the RIPE region ? The members pay the service and to my opinion, paying members should be the only ones, we should listen too. Its a weird situation, that anybody from whatever country with whatever background or regulations can influence everything. Lets take ICANN as an example: do you really think that I will have the chance to influence a vote at the ICANN members board without being a member ? Well, they might listen, what others have to say, but finally it will be a vote. Lets have a vote asking all RIPE members abuse this proposal instead of listening to every criminal from the world ... Kind regards, Frank >> But thats only my impression ... >> --- >> >> >> Kind regards, Frank >> -- >> PHADE Software - PowerWeb http://www.powerweb.de >> Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de >> Schinkelstrasse 17 fon: +49 33200 52920 >> 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 >> ====================================================================== >> > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0