- anti-abuse-wg - mailman.ripe.net

Report & Co-Chair's Decision on Proposal 2019-04
by Brian Nisbet 09 Sep '20

09 Sep '20

Colleagues, A few weeks ago we reached the end of the latest review phase for 2019-04. The Co-Chairs have worked closely with the NCC Policy Development Office since then to try to make a decision on this policy. This email contains a report on the Discussion Phase and Review Phase and then a final decision which, we believe, is supported by the activity during those phases. As always, this is underpinned by the RIPE PDP - https://www.ripe.net/publications/docs/ripe-710 Discussion Phase: There was some clear support for the policy during the Discussion Phase. This came from: Serge Droz, who felt that it would help in a number of cases and that an inability to answer an e-mail every six month probably indicated underlying issues. He also felt it would allow the community to understand who was doing good work and who wasn't, and it will prevent organisations from saying they never received a report. He also pointed out some of the difference in reaction between the security and operator communities on this policy. Carlos Friacas, agreed that it would help, but not solve all problems. He also flagged that if "deregistration" was not a possible outcome for a continuous failure to validate, then the outcome of transparency would still be positive, but did say that must be balanced against the NCC Impact Analysis. Jordi Palet Martinez, the proposer, was, of course, in favour, but also reacted to a number of voices against the proposal: - The job of the RIPE NCC is to implement the policies agreed by the community. I believe is perfectly understandable the need to avoid using manual forms which don't follow a single standard, which means extra work for *everyone*. (Responding to Nick Hilliard) - The actual policy has a bigger level of micro-management, by setting one year and not allowing the NCC to change that. (Responding to Nick Hilliard) - The problem of a form is that is not standard. This is economically non-sustainable and means that the cost of the abuse cases is on the back of the one actually reporting. (Responding to No No) - The actual validation is not working, it is just a technical validation (responding to Gert Doering) - The community prefers to do things in steps, we initially asked for an abuse mailbox, we then added a technical validation, now we are asking for a better validation. I am not asking to verify if you handle abuse case or not and I am not asking to take any new actions. Angel Gonzalez Berdasco suuported the proposal, but also made multiple comments on a different approach, including an abuse-uri and highlighted that standarising the communications was important. A number of people spoke in clear opposition. Nick Hilliard stated that it is not the job of the RIPE NCC to tell its members how to handle abuse reports. He further said that the is self-contradictory, intrusive into NCC membership business processes and there is no compelling reason to believe that the proposal will end up reducing the amount of abuse on the internet. Gert Doering said that if people *do not want* to handle abuse reports, this proposal will not make them and that cases of misconfiguration are already caught today. No No did not want anyone to be restricted in how they received abuse reports. Michele Neylon opposed the proposal and agreed with the points made by Nick. A number of other people posted either with mixed comments, or in a way that did not make it clear where they stood on the proposal: Job Snijders, Elad Cohen, Alistair Mackenzie, Suresh Ramasubramanian, Hans-Martin Mosner, Shane Kerr, Sascha Luck, Arash Naderpur, Richard Clayton, Alessandro Vesely, Randy Bush The Review Phase of the proposal lasted from 20 July 2020 to 18 August 2020. There were 14 messages received during the review phase. Out of which, 3 were from the PDO, 1 was myself's and 2 were Jordi’s requesting clarification on the Impact Analysis. - There was no messages of support to the proposal. There was one message stating that the form is more beneficial than email to report abuse because it always reaches the host to which Jordi tried to address stating that email can be automated whilst forms can not. - There were opposing arguments based on two fronts: 1) Nick Hilliard and Erik Bais commented that the effort and cost to implement this proposal are too great in relations to the benefits that are alleged. 2) Michele Neylon and Arash Naderpour commented that they oppose forcing operators to use only email for handling abuse reports and internal handling procedures should be solely defined by the operator. Nick Hilliard and Michele Neylon also requested the proposal to be dropped as concerns raised over the last 18 months have not been addressed and tweaking this proposal would not add any value. There was no attempt to address the opposing arguments above during the review phase. With all of this in mind, and with the continued failure of any kind of consensus from the working group, the Co-Chairs have decided to withdraw this proposal. As always we would welcome proposals on this and other matters, however we do not feel that there is any likelihood of 2019-04, regardless of possible edits, reaching consensus in the short or medium term. Alireza, Brian, Tobias Co-Chairs, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

12 20

Re: [anti-abuse-wg] Report & Co-Chair's Decision on Proposal 2019-04
by JORDI PALET MARTINEZ 08 Sep '20

08 Sep '20

Hi Brian, all, First of all, tks for this detailed report. I’m still processing it. However, I’ve a open question for you, which I think it has been also clear from other emails, that it is not clear for the community. People in favor (or against) the proposal has not (including myself), re-stated their position or repeated the same arguments. Is not that an indication that they keep their previous position? Regards, Jordi @jordipalet El 7/9/20 17:19, "anti-abuse-wg en nombre de Brian Nisbet" <anti-abuse-wg-bounces(a)ripe.net en nombre de brian.nisbet(a)heanet.ie> escribió: Colleagues, A few weeks ago we reached the end of the latest review phase for 2019-04. The Co-Chairs have worked closely with the NCC Policy Development Office since then to try to make a decision on this policy. This email contains a report on the Discussion Phase and Review Phase and then a final decision which, we believe, is supported by the activity during those phases. As always, this is underpinned by the RIPE PDP - https://www.ripe.net/publications/docs/ripe-710 Discussion Phase: There was some clear support for the policy during the Discussion Phase. This came from: Serge Droz, who felt that it would help in a number of cases and that an inability to answer an e-mail every six month probably indicated underlying issues. He also felt it would allow the community to understand who was doing good work and who wasn't, and it will prevent organisations from saying they never received a report. He also pointed out some of the difference in reaction between the security and operator communities on this policy. Carlos Friacas, agreed that it would help, but not solve all problems. He also flagged that if "deregistration" was not a possible outcome for a continuous failure to validate, then the outcome of transparency would still be positive, but did say that must be balanced against the NCC Impact Analysis. Jordi Palet Martinez, the proposer, was, of course, in favour, but also reacted to a number of voices against the proposal: - The job of the RIPE NCC is to implement the policies agreed by the community. I believe is perfectly understandable the need to avoid using manual forms which don't follow a single standard, which means extra work for *everyone*. (Responding to Nick Hilliard) - The actual policy has a bigger level of micro-management, by setting one year and not allowing the NCC to change that. (Responding to Nick Hilliard) - The problem of a form is that is not standard. This is economically non-sustainable and means that the cost of the abuse cases is on the back of the one actually reporting. (Responding to No No) - The actual validation is not working, it is just a technical validation (responding to Gert Doering) - The community prefers to do things in steps, we initially asked for an abuse mailbox, we then added a technical validation, now we are asking for a better validation. I am not asking to verify if you handle abuse case or not and I am not asking to take any new actions. Angel Gonzalez Berdasco suuported the proposal, but also made multiple comments on a different approach, including an abuse-uri and highlighted that standarising the communications was important. A number of people spoke in clear opposition. Nick Hilliard stated that it is not the job of the RIPE NCC to tell its members how to handle abuse reports. He further said that the is self-contradictory, intrusive into NCC membership business processes and there is no compelling reason to believe that the proposal will end up reducing the amount of abuse on the internet. Gert Doering said that if people *do not want* to handle abuse reports, this proposal will not make them and that cases of misconfiguration are already caught today. No No did not want anyone to be restricted in how they received abuse reports. Michele Neylon opposed the proposal and agreed with the points made by Nick. A number of other people posted either with mixed comments, or in a way that did not make it clear where they stood on the proposal: Job Snijders, Elad Cohen, Alistair Mackenzie, Suresh Ramasubramanian, Hans-Martin Mosner, Shane Kerr, Sascha Luck, Arash Naderpur, Richard Clayton, Alessandro Vesely, Randy Bush The Review Phase of the proposal lasted from 20 July 2020 to 18 August 2020. There were 14 messages received during the review phase. Out of which, 3 were from the PDO, 1 was myself's and 2 were Jordi’s requesting clarification on the Impact Analysis. - There was no messages of support to the proposal. There was one message stating that the form is more beneficial than email to report abuse because it always reaches the host to which Jordi tried to address stating that email can be automated whilst forms can not. - There were opposing arguments based on two fronts: 1) Nick Hilliard and Erik Bais commented that the effort and cost to implement this proposal are too great in relations to the benefits that are alleged. 2) Michele Neylon and Arash Naderpour commented that they oppose forcing operators to use only email for handling abuse reports and internal handling procedures should be solely defined by the operator. Nick Hilliard and Michele Neylon also requested the proposal to be dropped as concerns raised over the last 18 months have not been addressed and tweaking this proposal would not add any value. There was no attempt to address the opposing arguments above during the review phase. With all of this in mind, and with the continued failure of any kind of consensus from the working group, the Co-Chairs have decided to withdraw this proposal. As always we would welcome proposals on this and other matters, however we do not feel that there is any likelihood of 2019-04, regardless of possible edits, reaching consensus in the short or medium term. Alireza, Brian, Tobias Co-Chairs, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

4 5

2nd Call For Agenda Items - AA-WG @ RIPE81
by Brian Nisbet 07 Sep '20

07 Sep '20

Colleagues, RIPE 81 will be taking place somewhere on the Internet from the 27th - 30th October 2020. https://ripe81.ripe.net<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fripe81.ri…> The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session will is currently scheduled for 45 minutes, as it was at RIPE80. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

New on RIPE Labs: DDoS Hide & Seek - On the Effectiveness of a Booter Services Takedown
by Mirjam Kuehne 25 Aug '20

25 Aug '20

Dear colleagues, In this article, the authors investigate booter-based DDoS attacks in the wild and the impact of an FBI takedown targeting fifteen booter websites: https://labs.ripe.net/Members/daniel_kopp/ddos-hide-and-seek Kind regards, Mirjam Kühne RIPE NCC

1 0

Re: [anti-abuse-wg] 2019-04 Review Phase (Validation of "abuse-mailbox") Reminder
by Michele Neylon - Blacknight 18 Aug '20

18 Aug '20

Brian Thanks for the reminder. I’m not sure if there’s anything to be gained in my repeating previous comments on this, but to summarise briefly: * We oppose policy forcing operators to use email only for handling abuse reports. If an operator’s processes and procedures require reporters to use a form then so be it. * We oppose increasing the costs to RIPE NCC due to the proposed policy change * We do not believe that tweaking the proposal again is of any value and we, therefore, believe that the proposal should be shelved Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com https://blacknight.blog / http://ceo.hosting/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park, Sleaty Road, Graiguecullen, Carlow, R93 X265,Ireland Company No.: 370845 From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Brian Nisbet <brian.nisbet(a)heanet.ie> Date: Monday 17 August 2020 at 09:42 To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] 2019-04 Review Phase (Validation of "abuse-mailbox") Reminder Folks, Just to remind you all, the current Review Phase is formally due to end tomorrow. If you haven't, then now is an excellent opportunity to look at Petrit's email from the 22nd of July and to read the Impact Analysis from the NCC and make any comments you wish to make. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 2

Re: [anti-abuse-wg] [address-policy-wg] New on RIPE Labs: IPv4 Transfer Markets Misuse: A First Look
by Randy Bush 17 Aug '20

17 Aug '20

> In this article Vasileios Giotsas summarises the results of a detailed > study of how transferred IPv4 prefixes are misused in the wild by > synthesising an array of longitudinal IP blacklists, honeypot data, and > AS reputation lists: > > https://labs.ripe.net/Members/vgiotsas/a-first-look-at-the-misuse-and-abuse… an interesting read, and looks to be a solid analysis. as a researcher, i like it a lot. as an operator, i am not sure what the heck we can do about it. randy

1 0

New on RIPE Labs: IPv4 Transfer Markets Misuse: A First Look
by Mirjam Kuehne 17 Aug '20

17 Aug '20

Dear colleagues, In this article Vasileios Giotsas summarises the results of a detailed study of how transferred IPv4 prefixes are misused in the wild by synthesising an array of longitudinal IP blacklists, honeypot data, and AS reputation lists: https://labs.ripe.net/Members/vgiotsas/a-first-look-at-the-misuse-and-abuse… This research was supported by the RIPE NCC Projects Fund. Kind regards, Mirjam Kühne RIPE NCC

1 0

2019-04 Review Phase (Validation of "abuse-mailbox") Reminder
by Brian Nisbet 17 Aug '20

17 Aug '20

Folks, Just to remind you all, the current Review Phase is formally due to end tomorrow. If you haven't, then now is an excellent opportunity to look at Petrit's email from the 22nd of July and to read the Impact Analysis from the NCC and make any comments you wish to make. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

2019-04 Review Phase (Validation of "abuse-mailbox")
by Petrit Hasani 22 Jul '20

22 Jul '20

Dear colleagues, Policy proposal 2019-04, "Validation of "abuse-mailbox"", is now in the Review Phase. This proposal aims to have the RIPE NCC validate "abuse-c:” information more often and introduces a new validation process. The RIPE NCC has prepared an impact analysis to support the community’s discussion. You can find the proposal and impact analysis at: https://www.ripe.net/participate/policies/proposals/2019-04 https://www.ripe.net/participate/policies/proposals/2019-04#impact-analysis And the draft documents at: https://www.ripe.net/participate/policies/proposals/2019-04/draft As per the RIPE Policy Development Process (PDP), the purpose of this four week Review Phase is to continue discussion of the proposal, taking the impact analysis into consideration, and to review the full draft RIPE Policy Document. At the end of the Review Phase, the working group chairs will determine whether the WG has reached rough consensus. It is therefore important to provide your opinion, even if it is simply a restatement of your input from the previous phase. We encourage you to read the proposal, impact analysis and draft document and send any comments to <anti-abuse-wg(a)ripe.net> before 18 August 2020. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

5 10

First Call For Agenda Items - AA-WG @ RIPE81
by Brian Nisbet 16 Jul '20

16 Jul '20

Colleagues, RIPE 81 will be taking place somewhere on the Internet from the 27th - 30th October 2020. https://ripe81.ripe.net The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session will likely be short as per RIPE80, but we'll confirm that closer to the time. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0