- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 8, Issue 19
by Karl-Josef Ziegler 17 Apr '12

17 Apr '12

Hello! > The different pieces of contact information are all potential ways to > get in touch with the Internet number resource holder. If you have > difficulties reaching them via any of those details, you can report this > to us. I would recommend making a reasonable attempt to contact them > first though, for example by giving them a phone call if you find that > their email addresses are no longer working. My experience: I've used the form because the email contacts from a provider in Romania were invalid. The phone contact given in the RIPE database was only a mobile phone number in Romania. I searched for this number in the web and only get a few results which all directed to the entry in the RIPE database. So it seems that this (prepaid?) phone was only used to register this IP space with RIPE. My claim was denied because I didn't made an attempt to contact the provider on mobile phone in Romania. I didn't contact them because I don't speak Romanian and I feared retaliation from possible criminals in Romania. So for an individual it may be very difficult to fulfill all the external requirements which are made by RIPE NCC. And, of course, RIPE may be in a better position to repel retaliations. RIPE NCC wrote back that they don't have the staff to check if the entries in the database are correct. So if RIPE will guarantee the validity of the database today they seem not to have the personal capacity for research. Best regards, - Karl-Josef Ziegler

5 9

Re: [anti-abuse-wg] 2011-06 Discussion Period extended until 7 May 2012 (Abuse Contact Management in the RIPE NCC Database)
by Gilles Massen 17 Apr '12

17 Apr '12

Hello, > Changes in version 2.0 include: > > - Overall rewording > - Description of the use of "abuse-c:" and "abuse-mailbox:" on differing > RIPE Database objects > - Removal of references to a transition period What I still miss is a clear positioning of the IRT object vs. abuse-c. While these may not overlap completely, they certainly would to a large extend for a lot of CERTs, thus creating redundant data. So I'd join Leo on his comments that the use of the object should be clearer before creating it. If not the worst case might be that we end up with another randomly used object. Best, Gilles -- Fondation RESTENA - DNS-LU 6, rue Coudenhove-Kalergi L-1359 Luxembourg tel: (+352) 424409 fax: (+352) 422473

1 0

Re: [anti-abuse-wg] 2011-06 Discussion Period extended until 7 May 2012 (Abuse Contact Management in the RIPE NCC Database)
by Frank Gadegast 16 Apr '12

16 Apr '12

Marco Schmidt wrote: > Dear colleagues, Hello, I like to recommend the following change, from "The "abuse-mailbox:" attribute must be available in an unrestricted way via whois, APIs and future techniques." to "The "abuse-mailbox:" attribute for a given object must be available in an unrestricted way via whois, APIs and future techniques with a single request". because its not clear how the right abuse-mailbox field could be found for example via whois. It will be no help, if there is a first request needed to find the abuse-c and a second request to read the abuse-mailbox field. This could lead to reach limits, if either the access to the abuse-c field is limited or if there is no other method (like a new whois flag) to directly request the abuse-mailbox field from the abuse-c Somebody at the RIPE NCC told me last week, that they intend to integrate the abuse-finder-tool (wich will surely return the abuse-mailbox-field from the abuse-c in a preferred manner) into whois with a new option, if the proposal gets through, but it should be clearer in the proposal, that its intention is, to receive the value of the abuse-mailbox field with simply one request. Kind regards, Frank > > The text of RIPE Policy Proposal 2011-06, "Abuse Contact Management in > the RIPE NCC Database", has been revised based on community feedback > received on the mailing list. > > We published the new version (version 2.0) today, 16 April. As a result, > a new Discussion Phase is set for the proposal. > > Changes in version 2.0 include: > > - Overall rewording > - Description of the use of "abuse-c:" and "abuse-mailbox:" on differing > RIPE Database objects > - Removal of references to a transition period > > You can find the full proposal at: > https://www.ripe.net/ripe/policies/proposals/2011-06 > > We encourage you to review this RIPE Policy Proposal and send your > comments to<anti-abuse-wg(a)ripe.net> by 7 May 2012. > > Regards > > Marco Schmidt > on behalf of the Policy Development Office > RIPE NCC > > > > -- Mit freundlichen Gruessen, -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

2011-06 Discussion Period extended until 7 May 2012 (Abuse Contact Management in the RIPE NCC Database)
by Marco Schmidt 16 Apr '12

16 Apr '12

Dear colleagues, The text of RIPE Policy Proposal 2011-06, "Abuse Contact Management in the RIPE NCC Database", has been revised based on community feedback received on the mailing list. We published the new version (version 2.0) today, 16 April. As a result, a new Discussion Phase is set for the proposal. Changes in version 2.0 include: - Overall rewording - Description of the use of "abuse-c:" and "abuse-mailbox:" on differing RIPE Database objects - Removal of references to a transition period You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 We encourage you to review this RIPE Policy Proposal and send your comments to <anti-abuse-wg(a)ripe.net> by 7 May 2012. Regards Marco Schmidt on behalf of the Policy Development Office RIPE NCC

1 0

Re: [anti-abuse-wg] abuse email address validation - VOTE
by Jørgen Hovland 14 Apr '12

14 Apr '12

1 0

Introducing the RIPE NCC Report Form
by Laura Cobley 14 Apr '12

14 Apr '12

[Apologies for duplicate emails] Dear colleagues, We would like to introduce the RIPE NCC Report Form. Using this form, you can now easily report various issues, including abnormalities in Internet number resource registrations, to us for further investigation. By making it easy to report these issues to us and by putting a clear process in place, we aim to work together with you to further improve the quality of the data in the Internet number resource registry. The first release of the form offers basic functionality. We will review the form, its usage and your feedback before deciding whether further development is needed in the future. You can find more details at: https://labs.ripe.net/Members/andrea/ripe-ncc-report-form If you have any questions or feedback, please contact <ncc(a)ripe.net>. Best regards, Laura Cobley RIPE NCC

12 22

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 8, Issue 9
by Wout de Natris 13 Apr '12

13 Apr '12

"Re: Contents of anti-abuse-wg digest..." Why does this discussion take so many words and arguments? 1. Primarily RIPE NCC needs or at least should need a proper overview of who its members are for several reasons that all have to do with internal processes like reaching out, billing and maintaining correct records, in short common business practice. 2. There is an abuse function for well ... abuse, so members can reach out to each other and amend whatever goes wrong. All this isn't strange or weird, but normal practice for any company, club, association, etc. As soon as an address isn't correct the company, club, association, university, etc. reaches out to the customer, member, student concerned in order to get new relevant data, so it can do billing, maintenance of records, send news, etc. If the customer, member, et al, does not respond, steps are taken to terminate the relation. This is common practice to any company, club, association, etc. and has, primarily, nothing to do with law enforcement of any kind, but with customer/member relations, correct records, due payment, etc. So how come that as soon as this discussion is about the Internet, whether domain name registrations or in this case IP addresses, this totally normal form of doing business is denied as being standard practice? If data is not correct and there is no way the, in this case RIPE NCC, member can be found, it is not so strange that, after a published notice with a due time frame, a relation is terminated. Certainly in a period of scarcity in IPv4 addresses, this should be common practice. (And if it happens to concern a criminal organisation, they won't show up any way. All others will within about 2 seconds of termination.) So if correct data is standard practice and law enforcement needs them for whatever reason, they can access this data either through Whois of through correct proceedings in the Dutch law. Like it should be. Correct data saves money in the end, for all concerned, and makes becoming a member less attractive for individuals or organisations that most of us agree don't need a place on the internet. I don't think LEAs ask for more than that, but as a RIPE member I would look at my own organisation first. LEAs need to deal with LIRs more than an RIR, I'd guess, so assist them in finding these LIRs. Wout > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 8, Issue 9 > To: anti-abuse-wg(a)ripe.net > Date: Wed, 11 Apr 2012 16:13:31 +0200 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: Introducing the RIPE NCC Report Form (julien tayon) > 2. Re: current business practices (Frank Gadegast) > 3. Re: Introducing the RIPE NCC Report Form (Chris Heinze) > 4. Re: current business practices (Gert Doering) > 5. Re: current business practices (Michele Neylon :: Blacknight) > 6. Re: current business practices (Suresh Ramasubramanian) > 7. Re: current business practices (Frank Gadegast) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 11 Apr 2012 15:49:01 +0200 > From: julien tayon <julien(a)tayon.net> > Subject: Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form > To: Brian Nisbet <brian.nisbet(a)heanet.ie> > Cc: anti-abuse-wg(a)ripe.net > Message-ID: > <CAFpLVkyZQb0W3iCTMuq_uK3fBysQf8gHt8sP23MLypu3P4hriw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > 2012/4/11 Brian Nisbet <brian.nisbet(a)heanet.ie>: > > Chris, > > > > "Chris" wrote the following on 11/04/2012 11:03: > >> > >> On 04/10/2012 05:18 PM, Joe St Sauver wrote: > >>> > >>> Maintenance of the database documenting who's been allocated/assigned > >>> space is *core* to RIPE's mission. > >> > >> > >> simply wrong. > >> ripe's core is allocation. that's what they do. your mission is your > >> private error. > > > > > Ripe's core is at least to provide **change management** over > contact on allocation of internet resources (IP, AS) so that > stakeholder's can cooperate, since internet protocols relies on swift > cooperation between entities. Imagine a world in which you cannot > reach a LIR or RIR having wrong BGP rules ? > > Furthermore, RIPE NCC is bound by its contract with ICANN in its > mission of allocating resources. I think reading the actual contract > might settle the topic pretty fast. > > Since I don't have the contract under my eyes right now, I will make a > simple reasoning based on public informations and personnal > experience. > > Let's stick to the common sense of database first : > *Data accuracy is the most important property of a database.* Ripe NCC > is entitled to manage the whois database, therefore it is in their > mission to ensure DB integrity. > > If it is not convincing enough, let's remember data accuracy is > considered by ICANN as a **MUST DO** for delegated entities (both for > gTLD and resources). > Just search ICANN web sites and you'll have extended papers explaining > why accuracy matters, and how this responsability is also delegated. > http://www.icann.org/en/gsearch/accuracy > > In a world without accurate whois contact it will be the the > strongest's rule that shall prevail. > > What tickles me is how can RIPE NCC bill instances they don't have the > **accurate** contacts ? Are there 2 DBs one for billing (with accurate > data) and another one for public access with inaccurate data ? > > RIPE NCC cant choose the parts it likes in its delegated mission from > ICANN. A contract is a contract and RIPE NCC is bound by its duties > regarding ICANN. If ICANN states RIPE NCC MUST have accurates data, > and MUST enforce internet policies I cannot see how RIPE NCC or RIPE > can decide it is does not fall into their responsabilities. > > Now, all everybody needs to know : > * what level of accuracy ICANN can realistcly expect from its delegates ? > * what are the internet policies ICANN mentions ? > > Cheers. > > -- > Jul > Experienced freelance for years (having worked for ISP). > > > > ------------------------------ > > Message: 2 > Date: Wed, 11 Apr 2012 16:08:11 +0200 > From: Frank Gadegast <ripe-anti-spam-wg(a)powerweb.de> > Subject: Re: [anti-abuse-wg] current business practices > To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Message-ID: <4F85904B.8090203(a)powerweb.de> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > V > > >> > subpoena by deleting the wrong AS object from the database > > > >> ;o) > > > > > > > > Heh. ACK on the role. But I was thinking towards urging the ISP itself to take action (once you HAVE contacted them) on the abuse complaints. That's where the pressure of a lea agency can come in handy, if such a regulator is available. > > > > > > Well, the only possibility would be the police. > They do care here in Germany are kind of > technical disadvanced :o( > > There is some organizations this ISP is a member of > (like the ECO), and they have also a abuse clearing > board, but that one isnt really useful because > it never did anything against their members ... > > And why should they do something, they are not > responsible for the resources ... > > > Kind regards, Frank > > > > > Pepijn > > > > +++++++++++++++++++++++++++++++++++++++++++++ > > > > Disclaimer > > > > Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. > > > > Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging > > > > of ander gebruik ervan niet is toegestaan. > > > > Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan > > > > direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. > > > > Dit e-mailbericht is uitsluitend gecontroleerd op virussen. > > > > OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen > > > > geen rechten aan worden ontleend. > > > > > > > > > > > > This e-mail message may contain confidential information or information protected by professional privilege. > > > > If it is not intended for you, you should be aware that any distribution, copying or other form of use of > > > > this message is not permitted. > > > > If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 > > > > or e-mail mailto:mail@opta.nl and destroy the message immediately. > > > > This e-mail message has only been checked for viruses. > > > > The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. > > > > OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. > > > > No rights can be derived from this message. > > > > > > > > > > > > > -- > > Mit freundlichen Gruessen, > -- > MOTD: "have you enabled SSL on a website or mailbox today ?" > -- > PHADE Software - PowerWeb http://www.powerweb.de > Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de > Schinkelstrasse 17 fon: +49 33200 52920 > 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 > ====================================================================== > > > > > ------------------------------ > > Message: 3 > Date: Wed, 11 Apr 2012 14:49:13 +0200 > From: Chris Heinze <Chris.Heinze(a)consol.de> > Subject: Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form > To: anti-abuse-wg(a)ripe.net > Message-ID: <4F857DC9.8060905(a)consol.de> > Content-Type: text/plain; charset=UTF-8 > > On 04/11/2012 02:13 PM, Brian Nisbet wrote: > >> ripe's core is allocation. that's what they do. your mission is your private error. > > > > http://www.ripe.net/lir-services/ncc/functions > > right, that sums it up nicely, thanks. > > > Once all of v4 space is allocated (soon now, soon), the primary job of the NCC and the other four RIRs will be keeping a good registry. > > ripe's job isn't defined by and doesn't depend on whether or not v4 space is completely allocated (which it btw probably never will). > keeping a good registry is as explained a service kindly provided by ripe to help - and it did that since the beginning. > > regards, > > Chris > > > > ------------------------------ > > Message: 4 > Date: Wed, 11 Apr 2012 15:29:17 +0200 > From: Gert Doering <gert(a)space.net> > Subject: Re: [anti-abuse-wg] current business practices > To: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Cc: shane(a)time-travellers.org, Brian Nisbet <brian.nisbet(a)heanet.ie>, > anti-abuse-wg(a)ripe.net, Tobias Knecht <tk(a)abusix.com>, "Michele Neylon > :: Blacknight" <michele(a)blacknight.ie>, Laura Cobley <laura(a)ripe.net>, > Florian Weimer <fw(a)deneb.enyo.de>, Frank Gadegast > <ripe-anti-spam-wg(a)powerweb.de>, Gert Doering <gert(a)space.net> > Message-ID: <20120411132917.GN84425(a)Space.Net> > Content-Type: text/plain; charset="us-ascii" > > hi, > > On Wed, Apr 11, 2012 at 06:50:02PM +0530, Suresh Ramasubramanian wrote: > > On Wed, Apr 11, 2012 at 6:32 PM, Frank Gadegast > > <ripe-anti-spam-wg(a)powerweb.de> wrote: > > > will receives this could please make a > > > telnet mamba.ripe.net 25 > > > from some IPs he own (best would be not using his or her usual IP, > > > if he or she likes, lets see how big that problem really > > > is, thats why I have to mail the most active people directly). > > > > suresh@frodo 03:54:25 :~$ telnet mamba.ripe.net smtp > > Trying 2001:67c:2e8:11::c100:1328... > > Trying 193.0.19.40... > > telnet: Unable to connect to remote host: Connection refused > > > > Things seem to be RIPE for a change eh? > > So, what exactly causes the assumption that mamba is supposed to be > reachable from the outside, on Port 25? > > $ host -t mx ripe.net > ripe.net mail is handled by 250 postlady.ripe.net. > ripe.net mail is handled by 200 postgirl.ripe.net. > > Now, obviously, expecting anti-spammers to understand about MX records > and how to read Received: lines might be asking for a bit much... > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279 >

6 6

Re: [anti-abuse-wg] Analysis of the Legal Framework and Procedures Proposed by the Data Protection Task Force
by lists＠help.org 13 Apr '12

13 Apr '12

There are companies now that download the various whois databases and repackage and resell the data. One company DomainTools.com has their parent company in the EU in Luxembourg. How is it that they download all this data and resell it apparently without a problem. If it was illegal why they don't get prosecuted? This "legal framework" doesn't address any of that. DomainTool.com has filed a lawsuit in the US federal courts asking them to rule that downloading and selling whois data is illegal. the lawsuit in question involves data from Tucows in Canada so it is unclear how a US court can rule on that. In any case none of this stuff in discussed in the legal framework paper. Are there plans to take legal action against DomainTools.com for selling this data? If not, why not? Why are there restrictions on others if some companies are downloading and selling this data anyway? Just like you can't force people to answer their abuse mailboxes I don't see how you can force people to use (or not to use) data in a certain way after it is made public. http://domainnamewire.com/2012/04/06/domain-tools-files-preemptive-lawsuit/

3 6

Analysis of the Legal Framework and Procedures Proposed by the Data Protection Task Force
by Athina Fragkouli 12 Apr '12

12 Apr '12

Dear colleagues, Current rules regarding bulk access to the data held in the RIPE Database were set based on the work of the Data Protection Task Force, which concluded its work in 2011. At that time, the DPTF published a report on it's activities and outcomes, which was published here: https://www.ripe.net/ripe/groups/tf/dp/report-of-the-ripe-data-protection-t… Recent discussion on this list has suggested that a clear overview of the legal background to the framework and procedures proposed by the DPTF may help foster better community understanding of the RIPE Database rules and the justification behind them. In the interests of transparency and understanding, the RIPE NCC has produced a report that provides the legal analysis and background of all proposals made by the DPTF. This report, which is intended to complement the original DPTF report, is available now at: https://www.ripe.net/data-tools/support/documentation/legal-framework-and-p… Kind regards, Athina Fragkouli Legal Counsel RIPE NCC

2 1

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Joe St Sauver 12 Apr '12

12 Apr '12

Chris commented: #1) if you have a legal problem, go to a legal organisation ("police"), not #ripe. clarify your legal issues there. ripe isn't the place for this. Errors in registration details are not a police matter. Errors in registration details ARE directly germane to RIPE's remit as administrator of number resources, a function it provides for those in its region on behalf of the worldwide Internet community. #2) i generally appreciate ripe ncc's efforts to provide adequate aid in case of #any problems - nevertheless it has it's functions and tasks to stick to, #letting sbdy use it to mess with ripe-external stuff Maintenance of the database documenting who's been allocated/assigned space is *core* to RIPE's mission. #non-ripe-charged 'ripe-extraterritorials' creating lengthy flamey #threats as to what kind of services they "demand" from ripe, i btw #find - err - "curious"... Note that by RIPE policy, participation in RIPE Working Groups (including the Anti-Abuse Working Group) is open to all, which is, I believe, an appropriate reflection of the fact that RIPE-allocated resources can and do have an impact on users worldwide. Of course, if you take issue with that policy, you're free to propose a new policy that would change that. #3) if the complainant isn't prepared, able, or willing to express his complaint #against the alleged suspect, this probably already says it all... (ok so much: #then ncc shouldn't play bully for some troll) The question on the table was a simple one: what should be required of a party notifying RIPE of a data inaccuracy in the existing database. Should the notifying party be required to demonstrate exhaustion of all possible self-notification channels before referring the matter to RIPE as a "last resort?" No. A good Samaritan volunteer reporters has no obligation to do RIPE's work for them, and any attempt to impose arbitrary additional obligations on voluntary reporters is misplaced and inappropriate, and shows a lack of respect for the community member making that report. I see nothing wrong or inappropriate about expecting a RIR to maintain accurate records concerning the resouces it oversees, nor do I see how that makes anyone a "troll." Regards, Joe

11 18