- anti-abuse-wg - mailman.ripe.net

Call For Agenda Items - RIPE82
by Brian Nisbet 30 Mar '21

30 Mar '21

Colleagues, RIPE 82 will be taking place somewhere on the Internet from the 17th - 21st May 2021. https://ripe82.ripe.net<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe81.ri…> The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session is currently scheduled for Wednesday 19th, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 3

AFRINIC -- The Saga Continues
by Ronald F. Guilmette 29 Mar '21

29 Mar '21

Just published. https://mybroadband.co.za/news/internet/390378-afrinic-hired-a-convicted-cr…

1 0

What is YAHOONET?
by Alessandro Vesely 18 Mar '21

18 Mar '21

Hi all, I'm aware of the various pages that Wikipedia dedicate to Yahoo! and related services. I'm unsure how to treat YAHOONET as an ISP. The abuse contact they registered at RIPE in 2007 is abuse(a)yahoo-inc.com. It bounces. I wrote to network-abuse(a)cc.yahoo-inc.com asking what address should I use for complaints. I got an automated reply telling me to go to: https://io.help.yahoo.com/contact/index?page=contact&locale=en_US&y=PROD_MA… That link ultimately redirects to the same host/path with the query string replaced by "page=oops". I had tried to contact someone at Yahoo! before. I don't think it's worth trying again. So I think I'm going to put YAHOONET in the heavily firewalled list of ISPs with no abuse team. I hesitated because I used to consider Yahoo! something big, with possibly many worthy customers. Is it still so? I mean, would any savvy netizen face the Internet through such an ISP? Best Ale --

2 3

Proposed Training on Anti-Abuse
by alireza vaziri 17 Mar '21

17 Mar '21

Hi friends, As we have got several requests and inputs on Anti-Abuse training for LIRs on RIPE 80, we have decided to put up useful information for small and/or new LIRs on abuse handling, in a short webinar format with the help of the RIPE NCC training department. I have attached the draft proposal of the training and it would be great to provide us with your feedback and input as long as it has to help you by reducing the number of unwanted abuses from small and/or new LIRs. Cheers, Alireza -- Alireza Vaziri RIPE AA-WG Co-Chair

2 1

New on RIPE Labs: Where Does Zero Trust Begin and Why is it Important?
by Alun Davies 15 Mar '21

15 Mar '21

Dear colleagues, In the second of a series of guests posts on information security, Kathleen Moriarty from the Center for Internet Security (CIS) takes a close look at the benefits of zero trust architectures and what their increased adoption means for the industry. Read more on RIPE Labs: https://labs.ripe.net/Members/kathleen_moriarty/where-does-zero-trust-begin… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Question about spam to abuse inbox
by Cynthia Revström 28 Feb '21

28 Feb '21

Hi aa-wg, For some context, today and yesterday I have been receiving spam in the form of fake abuse notices to my abuse contact email address. Is there a generally accepted standard for when it's okay to block an address or a prefix from emailing your abuse contact? I consider being able to contact the abuse email address of a network a rather important function, so I prefer not to block it. But also as I have more relaxed spam filters for the abuse contact to make sure nothing gets lost, it feels like blocking the address/prefix is my only option other than manually filtering through these emails (10 so far in total, today and yesterday). So back to the question, is there a generally accepted point at which blocking an address/prefix is fine? Thanks, -Cynthia

17 42

Re: [anti-abuse-wg] Question about spam to abuse inbox
by Alex de Joode 25 Feb '21

25 Feb '21

I've been responsible for the abuse handling of a large dedicated hoster for approx 8 years and I learnt: * not all complainers are honest, * not all complainers share an understanding of what is allowed/legal etc, * not all complainers share an understanding of what a hoster is and can do, * not all complaints are 'crisp and clear', * not all complaints provide all data needed to be actionable, * not all complaints 'make sense' * not all complaints are directed to the proper ISP. A webform is a way to ensure some of these issues are addressed. Most ISP's want their networks to be clean. Most ISP's are responsive to complaints (if not please check if your complaints touch on issue #1-7) Most ISP's will work with you if you take time to adapt your complaint to their procedure. Most ISP's do not like to work with Don Qioxote type of ppl. Most ISP's do not like to be told their system sucks because your fringe procedure does not work. So all the armchair anti abuse handling specialists here can come up with nice procedures that check all imaginary boxes they feel are needed, make proposals that have no anti-abuse effect in practise and complaints if their proposals are rejected, however in the end it's the companies that process the abuse that need to deal with all this. And if you ensure #1-7 are not in your complaint you have contributed more than sending emails as the armchair specialist. -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 On Thu, 25-02-2021 14h 41min, Cynthia Revström via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > I think you have misunderstood my point. > > Would they send such report using their customer's own web form? > No? I don't know what implied that? > > Yes, doing so requires some work too, but heck aren't we paying for that already? > The person sending the abuse report is rarely a paying customer. > > The right thing to do would be to arrange for the abuse mailbox address to point (in)directly to the actual user of the IP address. > I am assuming you are referring to having a separate abuse contact for each customer, so like abuse.cust123@domain and registering it in the RIPE Registry/DB? In some cases with large customers maybe but if you are a hosting provider where each customer might only have one or two IPv4 addresses, that can get to an insane amount of handles and make the database really messy. Also the customer in question is not the only info that is relevant, like is it DoS, spam, or port scanning, etc? > But in general I think there are pros and cons to web forms and email templates just as there are pros and cons to arbitrarily structured emails. > -Cynthia > > On Thu, Feb 25, 2021 at 10:05 AM Alessandro Vesely <vesely(a)tana.it> wrote: > > Sorry for being late to the party... > > On Sun 21/Feb/2021 03:44:07 +0100 Cynthia Revström via anti-abuse-wg wrote: > > If the hosting company provides a web form, they can have a field where they > > explicitly ask for the offending IP address. > > This report could then automatically also be sent to the customer in question, > > because we shouldn't assume the customer is malicious, they might just have a > > bad config that made them a relay for example. > > > Would they send such report using their customer's own web form? > > The right thing to do would be to arrange for the abuse mailbox address to > point (in)directly to the actual user of the IP address. Yes, doing so > requires some work too, but heck aren't we paying for that already? > > > Best > Ale > -- > > > > > > > >

1 0

Re: [anti-abuse-wg] [ripe-list] RIPE AA-WG discussion
by Cynthia Revström 23 Feb '21

23 Feb '21

Hi Carsten, I made a mistake in judgement with regards to what the email was about, so I think this topic is sort of redundant at this point. And to not end up spamming people too much, I think we should at least restrict it to aa-wg only if it should be discussed further (which I don't personally think it should). I got an email mentioning how this is maybe not too much in scope for RIPE list. -Cynthia On Tue, Feb 23, 2021 at 2:46 PM Carsten Schiefner <ripe-wgs.cs(a)schiefner.de> wrote: > Hi Cynthia, > > I share Volker's PoV to some larger extend: yes, Tobias' email might be > a bit edgy wrt. marketing - but one could also read his first mentioning > of him being Co-Chair as just proper introduction. And the second one as > a reasoning why his email just went to you instead of the AA WG list as > a whole. > > Also, it would be interesting - at least for me - which of your postings > triggered Tobias' private response. I am unsure which one of your's at: > > > https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2021-February/date.ht… > > to pick... > > ATB, > > -C. > > On 22.02.2021 18:23, Cynthia Revström via ripe-list wrote: > > It is possible but I highly doubt it. > > > >> We at Abusix run Abuse Desk for dozens of Service Providers of any > > size and any type of product. From Cloud to DC-Services, Cable, and so > on. > > > > That sounds so much like marketing and irrelevant if it wasn't. > > Also if it wasn't marketing, why would he ask for me to schedule a video > > call? > > > > Once again I could be wrong, and if I am, I am sorry, but I can't see > > how this isn't marketing. > > > > -Cynthia > > > > > > On Mon, Feb 22, 2021 at 6:18 PM Volker Greimann > > <vgreimann(a)key-systems.net <mailto:vgreimann@key-systems.net>> wrote: > > > > I think you totally misread his mail. It reads to me as a proposal > > to help you understand the processes used by many providers, not as > > a sales pitch. > > > > Best, > > -- > > Volker A. Greimann > > General Counsel and Policy Manager > > *KEY-SYSTEMS GMBH* > > > > T: +49 6894 9396901 > > M: +49 6894 9396851 > > F: +49 6894 9396851 > > W: www.key-systems.net <http://www.key-systems.net/> > > > > Key-Systems GmbH is a company registered at the local court of > > Saarbruecken, Germany with the registration no. HR B 18835 > > CEO: Oliver Fries and Robert Birkner > > > > Part of the CentralNic Group PLC (LON: CNIC) a company registered in > > England and Wales with company number 8576358. > > > > This email and any files transmitted are confidential and intended > > only for the person(s) directly addressed. If you are not the > > intended recipient, any use, copying, transmission, distribution, or > > other forms of dissemination is strictly prohibited. If you have > > received this email in error, please notify the sender immediately > > and permanently delete this email with any files that may be > attached. > > > > > > On Mon, Feb 22, 2021 at 6:12 PM Cynthia Revström via anti-abuse-wg > > <anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net>> wrote: > > > > Hi, > > > > (intro) > > Tobias Knecht sent me an email (which this is a reply to) > > abusing his position as co-chair in order to try to sell me > > services based on what I said on a mailing list. > > > > (mainly towards Tobias) > > Replying to me based on a mailing list post in order to try to > > sell me services is bad enough. > > To do it as a co-chair and then to use the fact that you are > > co-chair as a selling point is much worse. > > > > I find this utterly appalling behaviour from a co-chair of a > > working group, I didn't reach out to you, you weren't even in > > the thread at all. > > > > also this: > > > As a Co-Chair I didn't want to jump into the mix on the > > mailing list, that's why I'm reaching out to you directly. > > > > I mean that is sort of the point of co-chairs generally speaking > > but yeah it is going to look bad if you are trying to sell > > something, because it is bad. > > > > (mainly towards chair team and aa-wg chairs) > > A co-chair of a working group should absolutely be warned or > > removed if they abuse their position to sell their services. > > > > I also somehow doubt that this is the first time, I could be > > wrong, but idk why this would be the first time. > > > > I hate it when for example Cogent sends me emails trying to sell > > me services despite me never having contacted them (outside of > > replying saying I am not interested). > > But this is more like if the Cogent sales people were co-chairs > > of the db-wg. > > > > Also with a subject like "RIPE AA-WG discussion" I initially > > thought it was actually about something I said or whatever, in > > his role as co-chair, it didn't appear like it was a sales email. > > > > I have also CC'd the aa-wg and ripe list as this is too > > appalling to be held private. > > > > -Cynthia > > > > > > On Mon, Feb 22, 2021 at 5:50 PM Tobias Knecht <tk(a)abusix.com > > <mailto:tk@abusix.com>> wrote: > > > > Hello Cynthia, > > > > my name is Tobias. I'm a Co-Chair of the Anti-Abuse Working > > Group and also Founder and CEO of Abusix. > > > > > > As a Co-Chair I didn't want to jump into the mix on the > > mailing list, that's why I'm reaching out to you directly. > > > > We at Abusix run Abuse Desk for dozens of Service Providers > > of any size and any type of product. From Cloud to > > DC-Services, Cable, and so on. > > > > Happy to jump on a call and answer the questions you have > > and tell you about how our clients handle those things. > > > > Feel free to reach out via email or just pick a time in my > > calendar: https://calendly.com/tobias-knecht/30min > > <https://calendly.com/tobias-knecht/30min> > > > > Thanks and stay safe. > > > > Tobias > > > > -- > > > > > > Tobias Knecht > > > > > > > > Founder & CEO > > > > > > > > > > > > T. > > > > > > > > +49 170 455 98 45 > > > > abusix.com > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > Book a meeting > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > My Logo > > > > > > > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > < > https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN… > > > > > > > > > > > > > > > > > > > > > > CONFIDENTIALITY This email and any attachments are > > confidential and may also be privileged or otherwise > > protected from disclosure. If you are not the named > > recipient, please notify the sender immediately and do not > > disclose the contents to another person, use it for any > > purpose, or store or copy the information in any medium. >

1 0

Re: [anti-abuse-wg] RIPE AA-WG discussion
by Cynthia Revström 23 Feb '21

23 Feb '21

Hi, (intro) Tobias Knecht sent me an email (which this is a reply to) abusing his position as co-chair in order to try to sell me services based on what I said on a mailing list. (mainly towards Tobias) Replying to me based on a mailing list post in order to try to sell me services is bad enough. To do it as a co-chair and then to use the fact that you are co-chair as a selling point is much worse. I find this utterly appalling behaviour from a co-chair of a working group, I didn't reach out to you, you weren't even in the thread at all. also this: > As a Co-Chair I didn't want to jump into the mix on the mailing list, that's why I'm reaching out to you directly. I mean that is sort of the point of co-chairs generally speaking but yeah it is going to look bad if you are trying to sell something, because it is bad. (mainly towards chair team and aa-wg chairs) A co-chair of a working group should absolutely be warned or removed if they abuse their position to sell their services. I also somehow doubt that this is the first time, I could be wrong, but idk why this would be the first time. I hate it when for example Cogent sends me emails trying to sell me services despite me never having contacted them (outside of replying saying I am not interested). But this is more like if the Cogent sales people were co-chairs of the db-wg. Also with a subject like "RIPE AA-WG discussion" I initially thought it was actually about something I said or whatever, in his role as co-chair, it didn't appear like it was a sales email. I have also CC'd the aa-wg and ripe list as this is too appalling to be held private. -Cynthia On Mon, Feb 22, 2021 at 5:50 PM Tobias Knecht <tk(a)abusix.com> wrote: > Hello Cynthia, > > my name is Tobias. I'm a Co-Chair of the Anti-Abuse Working Group and also > Founder and CEO of Abusix. > > > As a Co-Chair I didn't want to jump into the mix on the mailing list, > that's why I'm reaching out to you directly. > > We at Abusix run Abuse Desk for dozens of Service Providers of any size > and any type of product. From Cloud to DC-Services, Cable, and so on. > > Happy to jump on a call and answer the questions you have and tell you > about how our clients handle those things. > > Feel free to reach out via email or just pick a time in my calendar: > https://calendly.com/tobias-knecht/30min > > Thanks and stay safe. > > Tobias > > -- > > > Tobias Knecht > > Founder & CEO > > > > T. > > +49 170 455 98 45 > > abusix.com > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > Book a meeting > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > > [image: My Logo] > > > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > <https://cloud.letsignit.com/collect/bc/5fc946660b5c6b0008d672f1?p=3QW9LKZRN…> > > > > > > CONFIDENTIALITY This email and any attachments are confidential and may > also be privileged or otherwise protected from disclosure. If you are not > the named recipient, please notify the sender immediately and do not > disclose the contents to another person, use it for any purpose, or store > or copy the information in any medium. > >

5 8

Re: [anti-abuse-wg] Anti-social assholes
by JJS JJS 22 Feb '21

22 Feb '21

To put it alternatively: Imagine you walk down a street and there are lots of pubs (saloons?) that serve Alcohol and they all have drunken people swearing and trashing the place and you ask to report it to the manager but the bouncer of one premises says... "You have to put it in writing via email" and the next premises says "you have to telephone during business hours" and another says "you have to write a letter to an address". That is their choice. Sometimes with forms, it pre-loads it into a system that formats it for them. Sometimes there are email systems that can extract that information and format it anyway. But if they want you to use a form, they are indicating that's the best way for them to know what is happening. On 21/02/2021 2:38 pm, Ronald F. Guilmette wrote: I get an email spam so I report it... via email. I *do not * don snorkle gear. I do not contort my body into odd shapes. I do not make my report out-of-band, via smoke signals, or morse code, or via modulated infrared wavelengths. Call me old fashioned, but as I have already made plain, I do not think that I should be required to do any of these things. It is easier for me just to block all of Hostdime, which I had plenty of reasons to do already anyway. Regards, rfg P.S. Seriously, how much arrogance does it take for them to say to me that it is OK for me to have taken up *my* time to have read the crap that was originated by *their* customer, but *they* cannot be bothered to read *my* mail to them? ------- Forwarded Message Date: Sat, 20 Feb 2021 19:47:33 -0500 From: abuse(a)hostdime.com <abuse(a)hostdime.com> To: rfg(a)tristatelogic.com Subject: [AUTOREPLY] - Please submit complaint to https://www.hostdime.com/abus e-report/ Hello, Thank you for contacting HostDime. Please resubmit your original message at the following link for action to be co nsidered: - ------------------- HostDime Abuse Report Formhttps://www.hostdime.com/abuse-report/ - ------------------- Thank you, HostDime.com, Inc NOTE: This is an automated message. Please do not reply to this email. This mai lbox is not monitored. ------- End of Forwarded Message

4 4