- anti-abuse-wg - mailman.ripe.net

Recent Proposals, the Taskforce & v6 Discussion
by Brian Nisbet 03 Feb '11

03 Feb '11

Morning, It seemed easier to bring all of these things into one post. First off, the proposals. Suresh, I'm not sure which proposal from Uwe you're talking about, sorry, but Tobias & Piotr's proposals, or at least the addressing of the issues they identified are progressing. Tobias has been in discussion with the NCC DB group and the other proposals are, well, proposed to be dealt with by the task force. So, that task force... We've agreed the basic structure and aims and I'd expect an announcement to go out either this week or early next week. The TF will be an open, although in an attempt to focus the work, there will be some limits on the membership, however the ongoings and results will be public and discussed. I'm no fan of secrecy and while I appreciate it is required in some areas of anti-abuse, I strongly prefer to avoid it where possible. Finally, while discussion about and awareness of v6 is a very important thing, including how it will impact on anti-abuse, I think the current discussions have been veering more than a little off topic. Thanks, Brian.

3 4

Invitation to particpate in a RIPE Task-Force
by Wilfried Woeber, UniVie/ACOnet 03 Feb '11

03 Feb '11

Invitation to join and actively contribute to a RIPE Taskforce on "Abuse Contact Management in the RIPE Database" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Background: The RIPE Database serves as a data repository for Internet resource assignments and allocations in the RIPE NCC's service region. Among other purposes, it serves as a contact repository for administrative, technical and operational matters regarding IP address ranges and autonomous system numbers. Over time, some mechanisms became available, such as the Incident Response Team (IRT) object and an abuse-mailbox: attribute. Different communities seem to have developed varying expectations and understanding of how the data quality for such contact information can be maintained at a high level, and how and when a report sent to such a contact mechanism will be responded to or otherwise acted upon. Recently, some RIPE Policy Proposals were submitted for consideration and these proposals (2010-08, 2010-09 and 2010-10) were discussed in the Address Policy Working Group, the Anti-Abuse Working Group and briefly in the Database Working Group during the RIPE 61 Meeting in Rome. Deliberations among the responsible working group chairs and senior policy experts suggested that investigation be carried out to get a deeper understanding of the motivations behind the policy proposals, the expected outcomes, the operational and maintenance implications and the role the RIPE Database could perform to support the desired results. It was then suggested to the community and the policy proponents that the most efficient way to progress the issue would be the creation of a RIPE Task Force. There was no objection raised by the members of the community present at the meeting. Call for Participation ----------------------- We invite members of the RIPE community, from the security as well as from the anti-abuse areas, to volunteer and contribute to the proposed task force. Ideally, we would like to bring together the security and anti-abuse communities and the IP resource management and network operations communities to jointly analyse and refine the issue. *Draft* Mandate for the Task Force ---------------------------------- [This draft mandate is for consideration, modification and refinement by the task force] The task force is mandated to: - Agree on a useful name for the task force and, with the help of the RIPE NCC, arrange the logistics and report back to the community about the establishment of the task force - Collect all relevant input that is readily available, in particular policy proposals, information from presentations given recently by the RIPE NCC regarding ideas on the future structure, credibility and quality of data, and the maintenance mechanisms for entries in the RIPE Database - Collect and document comparable mechanisms and proposals in the other RIR Regions (APNIC, AfriNIC, ARIN and LACNIC) - Work with the interested community and the RIPE NCC to understand the problem at hand and the environment in which to develop a proposal. This analysis of the environment should include legal aspects, formal responsibilities for the use of resources on the Internet, well-established operating procedures and relevant operational aspects. - Develop one or more (policy) proposals and/or general recommendations on how collection and maintainace of relevant information in the Registry Database should be organised, including a description of potentially alternative implementations or approaches and the related impact on all parties involved *Draft* Timeline ----------------- The Taskforce should: - Try to collect the core group of participants before end of February 2010 - Start work on the dedicated mailing list as soon as possible, with a view to meet for a face-to-face meeting in advance of RIPE 62 (May 2011) - Report on the task force's progress during RIPE 62 (May 2011) and collect regular input from the RIPE community - Submit a first draft of a recommendation(s) and/or policy proposal(s) before RIPE 63 - Agree on the proposal(s) and agree on the expected implementation deadline Submitting statements of intent to actively participate -------------------------------------------------------- If you would like to participate in the task force, please email the RIPE NCC's Database Manager, Paul Palse, at <ppalse(a)ripe.net>. ________________________________________________________________________ Best regards, Wilfried, circulating this invitation on behalf of the group of the proponents, with kudos to the colleagues at the RIPE NCC for their help with wording!

1 0

Re: [anti-abuse-wg] Draft Anti-Abuse WG Minutes ? RIPE 61
by Suresh Ramasubramanian 03 Feb '11

03 Feb '11

I am rather late to this thread as it was just drawn to my attention elsewhere. 1. Richard Cox's concerns were entirely valid, and the abuse issues documented at http://www.spamhaus.org/Sbl/listings.lasso?isp=RIPE - mostly PI / PA blocks, several as large as /15, can't be wished away by removing critics of this WG from a co-chair post. 2. I would echo Peter's concerns about this being brought up as AOB, discussed (or rather, not discussed) in overtime with very few people in the room, leading to the removal of a co-chair. A much wider consensus should have been obtained - at least by discussion on this list if not at the plenary. This was not consensus. WG participants (and I count several who are in the anti abuse community, engage regularly with RIRs at other fora, but don't typically have the budget to travel to RIPE) should have been consulted before this. Yes, nobody else had much to say about this removal, so I'll take this opportunity to comment. About Richard Cox's removal and about two other meta issues. First - the prevailing attitude I have seen from at least some participants (this is not "us vs them" in terms of routing / dns people vs abuse people .. you have colleagues in your own organizations who will disagree with your views - especially Shane, I won't speak for Paul Vixie but I am not at all sure he'd agree with you about your comment, even after its rephrase). Second - the mantra, meme, fallacy etc of the "we are not the XYZ police" that I keep hearing cited. It would be fun indeed if a bank manager sanctioned a loan for say a quarter of a million dollars (lets say comparable to an allocation for a /15) and then baldly state that he's not the document police .. That presentation I saw discussed is what I'd call partially shutting the barn door long after the horses, plural, have bolted. That damage's been done, a lot of IP space has been poisoned. It is high time to realize that shooting the messenger is not the best way to deal with such a situation. srs Peter Koch wrote: > > On Wed, Dec 15, 2010 at 03:47:42PM +0000, Brian Nisbet wrote: > > > Peter Koch said the session was already overrun by 15 minutes and this > delicate issue should be resolved at another time. > > I'd like to clarify that my point was that this topic was placed under AOB > _and_ mostly dealt with during overtime, which, absence of written process > and procedures nonwithstanding, did not meet my expectations and experiences > of appropriateness given delicacy. That said, I consider the issue closed. JD Falk wrote: > On Dec 15, 2010, at 3:15 PM, Shane Kerr wrote: > >> I think that my point was that there is a disconnect between people >> working on anti-abuse and the ISPs, not about the Anti-Abuse Working >> Group or its participants. I might not have said that of course... > > Many people who work for ISPs would agree. It's often simply a matter of scale > and imagination.... >

15 38

Re: [anti-abuse-wg] Draft Anti-Abuse WG Minutes - RIPE 61
by Suresh Ramasubramanian 02 Feb '11

02 Feb '11

I am rather late to this thread as it was just drawn to my attention elsewhere. 1. Richard Cox's concerns were entirely valid, and the abuse issues documented at http://www.spamhaus.org/sbl/listings.lasso?isp=RIPE - mostly PI / PA blocks, several as large as /15, can't be wished away by removing critics of this WG from a co-chair post. 2. I would echo Peter's concerns about this being brought up as AOB, discussed (or rather, not discussed) in overtime with very few people in the room, leading to the removal of a co-chair. A much wider consensus should have been obtained - at least by discussion on this list if not at the plenary. This was not consensus. WG participants (and I count several who are in the anti abuse community, engage regularly with RIRs at other fora, but don't typically have the budget to travel to RIPE) should have been consulted before this. Yes, nobody else had much to say about this removal, so I'll take this opportunity to comment. About Richard Cox's removal and about two other meta issues. First - the prevailing attitude I have seen from at least some participants (this is not "us vs them" in terms of routing / dns people vs abuse people .. you have colleagues in your own organizations who will disagree with your views - especially Shane, I won't speak for Paul Vixie but I am not at all sure he'd agree with you about your comment, even after its rephrase). Second - the mantra, meme, fallacy etc of the "we are not the XYZ police" that I keep hearing cited. It would be fun indeed if a bank manager sanctioned a loan for say a quarter of a million dollars (lets say comparable to an allocation for a /15) and then baldly state that he's not the document police .. That presentation about LIR deregistration is what I'd call partially shutting the barn door long after the horses, plural, have bolted. That damage's been done, a lot of IP space has been poisoned. It is high time to realize that shooting the messenger is not the best way to deal with such a situation. srs Peter Koch wrote: > > On Wed, Dec 15, 2010 at 03:47:42PM +0000, Brian Nisbet wrote: > > > Peter Koch said the session was already overrun by 15 minutes and this > delicate issue should be resolved at another time. > > I'd like to clarify that my point was that this topic was placed under AOB > _and_ mostly dealt with during overtime, which, absence of written process > and procedures nonwithstanding, did not meet my expectations and experiences > of appropriateness given delicacy. That said, I consider the issue closed. JD Falk wrote: > On Dec 15, 2010, at 3:15 PM, Shane Kerr wrote: > >> I think that my point was that there is a disconnect between people >> working on anti-abuse and the ISPs, not about the Anti-Abuse Working >> Group or its participants. I might not have said that of course... > > Many people who work for ISPs would agree. It's often simply a matter of scale > and imagination.... >

6 11

Fwd: [anti-abuse-wg] How to Ask For A Website to Be taken Down, was How Not To Ask For A Website to Be taken Down
by Mark Foster 29 Dec '10

29 Dec '10

... This too. ---------- Forwarded message ---------- From: Mark Foster <blakjak(a)gmail.com> Date: Fri, Dec 24, 2010 at 9:54 AM Subject: Re: [anti-abuse-wg] How to Ask For A Website to Be taken Down, was How Not To Ask For A Website to Be taken Down To: tk(a)abusix.com 2010/12/24 Tobias Knecht <tk(a)abusix.com> Hi all, > > > Does it make any sense to produce a RIPE document suggesting the proper > > way to report abuse? > > > > This document can be short & sweet, just like the reports should be. A > > few good ideas are already in this thread: report to the right people, > > say the important bits up-front, and so on. > > We are already working on a format, that is used by more and more > people. It is meant as an extension to the well known RFC 5965 ARF. > Called X-ARF. http://xarf.org > > Everybody who is interested in helping and using it, let us know and we > can subscribe you to the mailinglist. > > Some tools are already available here: https://github.com/xarf > > Anything that makes reporting abuse harder for the victim, is counter-productive, IMHO. This to me is all an attempt to make abuse-complaint-receivers better equipped to use automation to deal with complaints. Noone who reports abuse likes talking to automation. Mark.

3 4

Re: [anti-abuse-wg] Re: Additional Layers for Economic Incentives to improve Internet Security
by Joe St Sauver 28 Dec '10

28 Dec '10

Hi, jorgen(a)hovland.cx commented: #> #An ASN does not represent a single legal entity #> #> Actually, at least some ASNs do represent single legal entities. For example, #> AS25 is the University of California at Berkley and AS4983 is Intel, just to #> mention a couple of many examples. # #Maybe or maybe not. You have probably no way of knowing that one day to #another unless you work for those companies. Routine daily life requires reliance on what some term "basic continuity assumptions", e.g., things that we take for granted because they've always been so. For example, assuming I pay my bills, drinking water will continue to come from my faucets, and not pilsner. I could spend a lot of time checking optimistically for (nearly) free beer, but based on historical consistency and other factors, there doesn't seem to be much point. :-; Similarly, I'm willing to make the "leap of faith" and assume that AS25 will continue to be Berkeley and AS4983 will continue to be Intel, etc. That may be more daring than running with scissors, but I'm comfortable taking the chance and I suspect most other folks are, too. #> #Spam in general cannot be defined #> #> Sure it can, and many folks offer definitions, including folks such as #> Spamhaus, see http://www.spamhaus.org/definition.html #> #> Other entities, such as MAAWG, prefer to opt out of the whole "what is #> and what isn't spam" debate, simply referring to "abusive mail" for #> things like their quarterly email metrics reports (see #> http://www.maawg.org/email_metrics_report ) # #Didn't you just show me that it in fact cannot be defined in general? :) No. What you may be noticing is that, unlike units of measurement in the metric system, where a single universal definition exists, squishier concepts (such as spam) may have multiple accepted definitions that exist at the same time. This is not uncommon in the human experience. Beauty, like spam, may mean different things to different people. However, even given regional or cultural differences, changes over time, or differing individual preferences, humans have a working "consensus understanding" of what most would perceive to be beautiful (or of what most would perceive to be spammy). #A site that does measure real mail volume is senderbase. Senderbase does indeed measure real email volume. Unfortunately, that's not the same as spam, although for many sites, spam may be 90% or more of that total volume, so it may be closely correlated for some sites that don't manage their outbound traffic. #> There's also the pragmatic reality that you may not be allowed to do #> the sustained volume of whois queries you'd need to do to map all observed #> IPs to encompassing netblocks, but you can easily map IPs to ASNs at the #> rate that's required. (Besides, trying to work at the per-netblock level #> is pretty unwieldy when it comes to things like maintaining abuse point #> of contact information, while ASN point of contact information is far more #> stable). # #Because something is easier doesn't mean it is better (the opposite also #applies). I'm just a pragmatic person, I suppose, happy for solutions that work (even if they may not be perfect). Like many people I'm also lazy. If a "good-enough" solution is also easy to use, I'm doubly delighted. #> #But we already have blocklists aggressively doing that with netblocks #> #(uceprotect, spamhaus etc). No serious mailprovider in my neighbourhood #> #use those blocklists to block mail or anything else. #> #> You must be in an unusual neighborhood since Spamhaus is generally #> considered to protect about 1.4 billion mailboxes worldwide according #> to http://www.spamhaus.org/organization/index.lasso # #Certain blocklists have lost their credibility because of their ways of #creating collateral damage instead of dealing with the real problem: Spam. #The number 1.4 billion becomes interesting when some people believe #there are only 1.3 billion mailboxes in the world. None of it is #probably true. # http://wiki.answers.com/Q/How_many_email_accounts_are_there_in_the_world I'm not sure that I'd put much stock in an estimate from an unnamed "research organization" (as is the case for the web page you suggested). As a baseline, I would note that MAAWG alone represents over 1 billion mailboxes (as reported by participating ISPs), although it draws largely from North American and European ISPs (some ISPs from other continents also participate, but not as many as I'd like to see). Just to provide one email account estimate from a *named* research organization, :-), the Radicati Group, Inc., estimates the number of email accounts worldwide at 2.9 billion in 2010 (see http://www.mmdnewswire.com/press-release-distribution-8142.html ). Based on that denominator, I could easily believe that Spamhaus really does have 1.4/2.9*100=48.2% market share. Regards, Joe Disclaimer: all opinions strictly my own.

2 1

Re: [anti-abuse-wg] Re: Additional Layers for Economic Incentives to improve Internet Security
by Joe St Sauver 28 Dec '10

28 Dec '10

jorgen(a)hovland.cx commented: #So a quick summary: #An ASN does not represent a single legal entity Actually, at least some ASNs do represent single legal entities. For example, AS25 is the University of California at Berkley and AS4983 is Intel, just to mention a couple of many examples. Other ASNs may represent ISPs which provide services to multiple downstream customers, but those ISPs are still "single legal entities" I think the point that you're trying to make is that blocking by ASN is overly broad, and might cause too much collateral damage in some cases. I would agree with you, for example, that folks likely wouldn't want to block AS701, for example, but in other cases blocking by ASN, or at least accumulating reputation by ASN, may be quite feasible. #Spam in general cannot be defined Sure it can, and many folks offer definitions, including folks such as Spamhaus, see http://www.spamhaus.org/definition.html Other entities, such as MAAWG, prefer to opt out of the whole "what is and what isn't spam" debate, simply referring to "abusive mail" for things like their quarterly email metrics reports (see http://www.maawg.org/email_metrics_report ) #It's not ranking the spam volume People can (and do) track spam volume by IP, by the netblock encompassing a spamming IP, by in-addr domain, and yes, by ASN. Some track actual spam volume by ASN, others may just track the number of observed spam sources (e.g., typically botted hosts) per ASN. Both can be interesting numbers, and the two are typically strongly correlated. And FWIW, ASNs do work just fine as an aggregation channel for network abuse sources, particularly since who's *using* (e.g., routing) a network block may be more important than the person to whom a given netblock may nominally be assigned or allocated (e.g., we know that number resources can and have been hijacked). There's also the pragmatic reality that you may not be allowed to do the sustained volume of whois queries you'd need to do to map all observed IPs to encompassing netblocks, but you can easily map IPs to ASNs at the rate that's required. (Besides, trying to work at the per-netblock level is pretty unwieldy when it comes to things like maintaining abuse point of contact information, while ASN point of contact information is far more stable). #Yes, I am really concerned that people might decide to blacklist ASNs #due to spam. It doesn't make any sense in almost all cases. I'd have to disagree with your assertion that "it doesn't make sense in almost all cases." There are some ASNs that may be routing only a small amount of space, and which seem to have an extremely strong correlation with badness. In those cases it may makes perfect sense for an ISP to decide that it doesn't want to exchange traffic with that provider. Heck, some people just tag their incoming email with the ASN of the handoff host, and then let selected anti-spam products automatically handle the hand-off host's ASN as added to the header as just another Bayesian message attribute -- if it is helpful when it comes to classifying spam and non-spam, it gets used; if it isn't, it doesn't. Shrug. See http://linuxmafia.com/~karsten/Download/procmail-asn-header for one recipe that some folks use for this purpose. In any event, if you elect to route a given network block, you're responsible for the unwanted traffic that may be emitted by that network block. #But we already have blocklists aggressively doing that with netblocks #(uceprotect, spamhaus etc). No serious mailprovider in my neighbourhood #use those blocklists You must be in an unusual neighborhood since Spamhaus is generally considered to protect about 1.4 billion mailboxes worldwide according to http://www.spamhaus.org/organization/index.lasso Regards, Joe St Sauver (joe(a)oregon.uoregon.edu) http://pages.uoregon.edu/joe/ Disclaimer: all opinions expressed are my own

4 3

How Not To Ask For A Website to Be taken Down
by Michele Neylon :: Blacknight 27 Dec '10

27 Dec '10

Got this earlier today (not to our abuse contact of course .. ) Couple of things to note Unless you read it a few times it's not easy to work out what the hell they are actually asking about If your first language isn't English then I suspect you'll dismiss it as spam .. .. I know some of my staff did and they supposedly speak English! "Dear Sir or Madame, As a result of our activities, Bank of America and/or its affiliates have acquired significant reputations in the field of banking and financial services worldwide and our trademark and brand (the “Marks”) are registered and/or used in the United States as well as many countries globally. We have now detected a website, or a redirect to a website, hosted on your network that purports to be a Bank of America or a Bank of America affiliate* website. The referenced site(s) uses the Marks, leading visitors to believe it is a website sponsored or endorsed by Bank of America or a Bank of America affiliate* while no such sponsorship or endorsement actually exists. The site requests visitors to supply sensitive personal or financial information. We have confirmed that this webpage is NOT authorized or endorsed by Bank of America and/or its affiliates. The use of our Marks in this way is likely to cause confusion in the mind of the public, leading them to believe that the website is associated with Bank of America or that we are otherwise supplying goods and services through it. As you know, “Phishing” sites such as this usually are part of larger criminal schemes that violate a number of federal, state and international laws. We request your immediate assistance in stopping the continued operation of this website and its unauthorized use of our Marks. Continued operation of the website in this way is not only likely to result in substantial damage to our reputation and goodwill but also perpetuates the appearance that your network is cooperating with the fraudulent purpose behind the website. We request that you please assist us in shutting down the website immediately. URL - http://xxxxxxxxx IP Address - xxxxxx As part of this action we request that you redirect all traffic going to this website to the following URL: http://education.apwg.org/r/en?xxxxxxxxxxxx By doing this it will provide a way for consumers to educate themselves about phishing. Information about implementing a redirect to this page can be found here: http://education.apwg.org/r/how_to.html Please forward this message with your response, directly to anti-phishing(a)bankofamerica.com. We thank you in advance for assisting us in stopping phishing and refusing to allow your network to be used for illegal activity. Thank you, Abuse Team Bank of America Contact Email: anti-phishing(a)bankofamerica.com *Bank of America affiliates include the following brands: MBNA Merrill Lynch Countrywide Military Bank LaSalle Fleet" Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://blacknight.mobi/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Twitter: http://twitter.com/mneylon PS: Check out our latest offers on domains & hosting: http://domainoffers.me/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

10 18

Re: Additional Layers for Economic Incentives to improve Internet Security
by Mirjam Kuehne 27 Dec '10

27 Dec '10

Dear colleagues, Following up from his earlier posts on RIPE Labs, John Quarterman is now looking at 'ASN Ranking Correlations Between Spam Blocklists': http://labs.ripe.net/Members/jsq/asn-ranking-correlations-between-spam-bloc… Kind Regards and Happy Holidays, Mirjam Kuehne RIPE NCC

5 4

Fwd: [anti-abuse-wg] How Not To Ask For A Website to Be taken Down
by Mark Foster 24 Dec '10

24 Dec '10

Sent this directly to Ronald by mistake, it was meant for the list... ---------- Forwarded message ---------- From: Mark Foster <blakjak(a)gmail.com> Date: Fri, Dec 24, 2010 at 9:48 AM Subject: Re: [anti-abuse-wg] How Not To Ask For A Website to Be taken Down On Thu, Dec 23, 2010 at 7:59 PM, Ronald F. Guilmette <rfg(a)tristatelogic.com>wrote: > > > > #2) Even for those networks where abuse@ is not aliased to /dev/null, > sending anything other than a _spam_ report to that address will typically > engender either (a) no response at all (with the message being silently > discarded) or else (b) an irritated response of the form "Why are you > sending this to abuse@??" or else (c) a more or less automated response > (either from an actual program or else from a low-paid human who has been > trained to act like one) the form "We're sorry, but we cannot accept > abuse complaints without either (a) a full set of e-mail headers or else > (b) a complete set of system intrusion logs." > I find myself taking exception to this and whilst I usually lurk in the background here I think it needs to be said: - I would expect any malicious or illegal behavior to be reported to abuse@ - Whilst Spam reports will form the vast majority of these, I expect my Abuse-Queue-Staff to be plucking the _non_-Spam reports out for early attention (as other types of abuse are more frequently time sensitive). Those who do tech support are familiar with the idea of triage in a customer-facing sense; the stuff that's likely to have large ramifications, either in scale, or PR, or cost, will get early attention because that's just commonsense. For stuff happening in real-time that's a serious issue (say a DoS) I have (as an engineer) taken both emails and phonecalls directly - but I still expect a report to abuse@ so that the appropriate records are able to be created and placed on file for future legal or customer-service obligations. This logic has applied for ISPs operating with 1000 to 500,000 customers. Unfortunately as your organisation gets larger, the 'human touch' of handling abuse cases seems to dissapear and you do wind up with lesser-cloo'd people dealing with the complaints, and using templated answers that infuriate those who're actually taking the time to report abuse. The number of people these days who simply block, or ignore, abusive internet behavior, is counter-productive to those ISPs who are resultantly blind as to the actual negative impact their customers are having. So with these points in mind, (a) above is possible, but a move that demonstrates poor 'internet citizenship' on the part of the ISP, (b) shouldn't ever happen, and in my experience only happens when you land an idiot at the other end, and (c) again demonstrates poor internet citizenship. To the point where I will actively take my business away from any organisation that operates that way. My current issue is with Yahoo's requirement that all complaints comply with ARF. They're one of the biggest sources of spam and have opted to require complaints to fit into their particular brand of round-shaped-hole or they're going to ignore the report. I refuse to waste more of my time reporting spammers, and instead am much more prepared to simply block their domain(s) with a reject line similar to 'mail will not be accepted until Yahoo stops with the head-in-sand technique of operating, and instead deals with the spammers in its midst'. If your operation is big enough to spin millions of dollars per year in revenue, you're big enough to be a responsible netizen and show some respect to anyone taking the time to report abuse. Because if you deliberately ignore complaints, you become responsible for the behavior itself and become an accessory to the abuse, or crime, in effect. > > > #3) Although, for the various reasons noted above, and others, sending a > report like this to an abuse@ address might yield no meaningful or useful > action at all, the mere presence of the corporate abuse@ address, either > in the To: header or in the Cc: header would most likely cause any and > all other parties to whom such a report had been addressed (and who might > otherwise potentially be more responsive/responsible than abuse@) to > simply > trash the message, e.g. because they might reasonably assume that "Oh! > This was sent to abuse@ too, so the abuse department/person will surely > handle it, and I don't need to get involved." > If your abuse@ team are of any value, they will of course do exactly that. If you're an 'other recipient' then in good concience you should at least be checking with them to ensure it's followed up. That's customer service 101. Is the risk to your reputation worth it? > #4) Last but not least, in the circles I travel in, a clear and unambiguous > distinction is often drawn between "abuse ON the network" and "abuse OF the > network". As we all know, the latter occurs almost every second of the > day, > somewhere on the Internet, and it can range from undeserved insults and > slanders to sophisticated social engineering con games involving millions > of dollars. But none of that "abuse ON the network" in any way threatens > the operational status of any part of the net. Conversely, of course, spam > and DoS attack directly threaten the operational status of either parts of > the net or, in sum, even the whole thing, and thus, by tradition among the > people I commonly hang out with, "abuse OF the net" is widley considered to > be the only thing (a) that humans can reasonably fight and also (b) in many > people's minds, it is the only thing that's _worth_ fighting for. (After > all, the world and the net will go on even if you or I are heniously > slandered > or even defrauded, tomorrow, somewhere on the Internet.) > If someone reports a customer of mine breaching T&C I will expect our customer care team to enforce T&C. Antisocial behavior might not be a T&C breach. If it crosses that line, however, we'll act as a reasonable ISP should. If the customers conduct is illegal, or a DoS, or spam, or other behavior which will negatively affect our own online reputation, we'll similarly take steps to respond. Often an external report is the way that we find out about this behavior - we don't have eyes everywhere. > The upshot of all this line of thinking is that some (many?) believe that > it's not even the job of an ISP abuse desk to even delve into any matters > that do not clearly affect network operational status. At any and all > ISPs of this persuasion, a note to abuse@ regarding a clear trademark > violation (and a plausible/possible phishing threat) would be discarded > virtually the moment it was opened. > > The ISP is responsible for being a good online citzen (morally). But they're also obliged to preserve their own reputation if they want to ensure folks won't simply blackhole their traffic, so if they choose to turn a blind eye to the problems their customers cause, ultimately it will affect their bottom line. The ISP will then care - so the ISP's Abuse Desk, being the group who deal with the outside world in respects abusive behavior online, should be prepared to deal with this. Across the several ISP's I've worked for, this is certainly the case. And I will actively steer business away from any ISP who chooses to reneg on this obligation. Mark.

1 0