- anti-abuse-wg - mailman.ripe.net

I support 2019-03 BGP Hijacking is a RIPE Policy Violation
by André Melancia 28 Mar '19

28 Mar '19

I support 2019-03 BGP Hijacking is a RIPE Policy Violation! André Melancia Developer / DBA / Microsoft Certified Trainer (MCT) <https://www.youracclaim.com/user/andypt> Lunar Cat, Unip.Lda. Owner / Principal Consultant → +351-919443776<tel:+351-919443776> → Mail<mailto:Andy@Andy.COM.PT>; Site<http://andy.pt/>; Facebook<https://facebook.com/ANDY.COM.PT>; Twitter<https://twitter.com/AndyPT>; LinkedIn<https://linkedin.com/in/AndreMelancia>; Skype<skype:AndyCOMPT> Join our Portuguese technical communities (our natives also speak English!): → Data Community Portugal: FB Page<https://facebook.com/DataCommunityPT>; FB Group<https://facebook.com/groups/DataCommunityPT> → IT Pro Portugal: FB Page<https://facebook.com/ITProPortugal>; FB Group<https://facebook.com/groups/ITProPortugal>; Twitter<https://twitter.com/ITProPT>; Site<http://itproportugal.pt/> → PowerShell Portugal: FB Page<https://facebook.com/PowerShellPortugal>; FB Group<https://facebook.com/groups/PowerShellPortugal>; Twitter<https://twitter.com/PowerShellPT> → Community Evenings: Eventbrite<https://communityevenings.eventbrite.com/> → Windows Development Portugal: FB Group<https://facebook.com/groups/WindowsDevPT> → Revista Programar: Revista Programar<https://revista-programar.info/>

1 0

Re: [anti-abuse-wg] 2019-03 and over-reach
by Sascha Luck [ml] 25 Mar '19

25 Mar '19

On Mon, Mar 25, 2019 at 12:44:47PM +0200, ac wrote: >I frequently read someone saying "RIPE is not the Internet >Police" (even I have said that a few times myself) but the hard >truth is that any RIR has a duty to exercise administrative authority. Only as far as it pertains to the registration of allocated/assigned resources. All membership of the RIPE NCC since its foundation was entered into with the understanding that the NCC is a *registry* not an *enforcer* and does not regulate the operation or behaviour of member networks. 2019-03 attempts to change this by plugging into an ill-defined concept of "policy". This is perhaps a fundamental issue, as there has been "mission creep" from "address-policy" (the better term is "resource policy") into all sorts of other aspects of network operations. Unfortunately, RIPE and the NCC were founded in much more cooperative days and so it was omitted to clearly define the "limits of authority", perhaps because it was not seen as necessary back then. I therefore argue that it is maybe time to have a discussion on what exactly RIPE and the NCC should be and what, if any, limits on their administrative power there should be. I hope, though, that everyone can at least agree that *this* is *not* the forum for that discussion. rgds, SL >Finding the balance where this duty is an over-reach, as per the subject >line of this hijacked thread, is an important discussion that I believe >this wg should have sometime as this relates directly to abuse also... > >and, similarly, arguing that because Afrinic etc does not do this or >does not do that, is hardly any great argument either, many interesting >things, angles and points in these 2019-03 discussions and threads :) > >Andre > > >

4 4

Re: [anti-abuse-wg] 2019-03 and over-reach
by Brian Nisbet 25 Mar '19

25 Mar '19

Colleagues, I want to comment on something below... > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ac > Sent: Saturday 23 March 2019 08:54 > > So, anyway, as 2019-03 deals with hijacking, this entire over reach argument > is factually not relevant at all > > and, more so: 2019-03 not proceeding would be counter to the ethical > administration of resources, a dereliction of responsibility and a breach of > trust implied in any such administration (as well as administrative authority) A core part of the policy process in the RIPE Community is that nothing is set in stone. A policy which is rejected one day may be accepted another, or something which is put in place may be changed or altered when new information comes to light. This is all part of the PDP. *If* 2019-03 does not reach consensus it in no way implies the RIPE Community does not care about BGP hijacking (community pushes like MANRS and general work on RPKI says otherwise), all it says is that this proposal was not deemed to be the right way to go about it. Thanks, Brian Co-Chair, RIPE AAWG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 1

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Töma Gavrichenkov 25 Mar '19

25 Mar '19

Hi all, > A new RIPE Policy proposal, 2019-03, "BGP Hijacking is > a RIPE Policy Violation", is now available for discussion. Sorry if the issues I'm raising were already addressed somewhere around the thread. As of now, I believe it's the size of an average fiction book, and I don't quite have enough time to read that. I also apologize now in advance for abstaining from the discussion at some point in future, because in quite the same fashion I won't be able to read unnecessarily (and sometimes I believe deliberately) long responses. Whoever is planning to win a consensus through exhaustion is going to win that anyway. With that in mind, 1. As of now, the draft looks like a nice example of "document designed by a committee". It's too strict where there's no real need to be strict, and at the same time too weak where you don't expect it to be weak. E.g. 4 weeks to report + 4 weeks to investigate + 2 weeks for an appeal give us solid 10 weeks for an attack to stay there, which is, to put it gently, a substantial amount of time. 2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment. In fact in theory this policy could make things worse. Most of the ISPs are very slow in applying security updates to their equipment, including border routers. (Also, vendors themselves are not quite keeping up as well) Now, say, I'm an ISP who really wants to push my competitor out of business. With this policy here's a sequence of steps that will win you the market: - hire a script kiddie who will break into that company's Mikrotik; - announce roughly half of IPv4 address space through that breach just for it to be surely on the news; - relax and enjoy watching your competition disappearing in no later than 2,5 months. While I would, in my perfect dream, personally support the idea of cancelling an LIR membership for not updating one's devices at least on a weekly basis, I don't really think this is what the authors of the draft were going to propose, and I know quite a few people, Randy Bush for starters, whom the authors, to put it mildly, won't probably be able to convince. The example by Warren also deserves attention, and I personally don't really anticipate that "won't be too hard to figure out", because frankly we're in fact yet to see the hijacking attempts where an attacker would be deliberately trying hard to hide their identity. 3. If I were to design that process, I'd put it in a different way, e.g.: - 2 business days to find experts. Really, four weeks for that?! Yes, we know that NCC isn't the most dynamic organization out there, but with a pre-populated pool of experts at the current rate of hijacking incidents reported to public that shouldn't really be an issue. - 3 business days to investigate and prepare a preliminary report. Another 5 business days to continue investigation if necessary, with another report at the end. Maybe a third iteration if necessary. Immediate membership suspension at the end if the experts decide it's necessary to do so now. - A grace period of 8 weeks for the suspected hijacker to collect further evidence and provide additional arguments to justify their position. - An appeal phase of another 8 weeks with ultimate decision and, where necessary, membership termination in the end. All the numbers above are rough estimations, they are only there to showcase the idea: - the reaction to *mitigate* should be immediate; - the reaction to *penalize* should allow for a large enterprise — or a large ISP! — to keep up. -- Töma

7 16

Re: [anti-abuse-wg] 2019-03 and over-reach
by Gert Doering 23 Mar '19

23 Mar '19

Hi, On Sat, Mar 23, 2019 at 12:27:32PM +0200, ac wrote: > On Sat, 23 Mar 2019 18:04:22 +0800 > Lu Heng <h.lu(a)anytimechinese.com> wrote: > > > > It???s very much like electricity company tell you if you do something > > bad we will cut you off and stop supply electricity.and yes, they > > will cut you if you stop paying them, but that doesn???t mean they can > > they also cut if you cheat by stealing electricity. But they will not cut you off if you use the electricity in ways that your neighbours do not like. And this is where things start getting complicated. A and B have a contract. B does something C does not like (but which is legal). Why should that affect A? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

4 6

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 88, Issue 72
by Durga Prasad Malyala 23 Mar '19

23 Mar '19

Sorry off topic. How Come I subscribed to digest yet getting multiple mails per day? Cheers/DP On Sat, Mar 23, 2019, 22:53 <anti-abuse-wg-request(a)ripe.net> wrote: > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: 2019-03 New Policy Proposal (BGP Hijacking is a RIPE > Policy Violation) (Carlos Fria?as) > 2. Re: 2019-03 New Policy Proposal (BGP Hijacking is a RIPE > Policy Violation) (Sascha Luck [ml]) > 3. Re: 2019-03 New Policy Proposal (BGP Hijacking is a RIPE > Policy Violation) (Lu Heng) > 4. Re: 2019-03 and over-reach (Nick Hilliard) > 5. Re: 2019-03 and over-reach (Hank Nussbacher) > 6. Re: 2019-03 and over-reach (Hank Nussbacher) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 23 Mar 2019 13:39:04 +0000 (WET) > From: Carlos Fria?as <cfriacas(a)fccn.pt> > To: T?ma Gavrichenkov <ximaera(a)gmail.com> > Cc: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP > Hijacking is a RIPE Policy Violation) > Message-ID: <alpine.LRH.2.21.1903231315330.9599(a)gauntlet.corp.fccn.pt> > Content-Type: text/plain; charset="iso-8859-15"; Format="flowed" > > > On Sat, 23 Mar 2019, T?ma Gavrichenkov wrote: > > > Hi all, > > Hi, > (will try to keep it short) > > > (...) > > 1. As of now, the draft looks like a nice example of "document > > designed by a committee". > > > > It's too strict where there's no real need to be strict, and at the > > same time too weak where you don't expect it to be weak. E.g. 4 weeks > > to report + 4 weeks to investigate + 2 weeks for an appeal give us > > solid 10 weeks for an attack to stay there, which is, to put it > > gently, a substantial amount of time. > > Just two co-authors. The set will grow for proposals in other RIRs. And > we'll gladly accept help, as Jordi is doing the most of heavy lifting. > > If your issue is timescales they can be adapted in subsequent versions. > What we tried to design here was "due process" with enough "checks & > balances" embedded. > > > (...) > > 2. OTOH the ultimate result (membership cancellation) may be seen as a > > very heavy punishment. > > > > In fact in theory this policy could make things worse. > > The scenarios you and others mentioned should be run through the process > and what you call "the ultimate result" should only happen if there is > absolutely no doubt about the intent and about the 'who'. If company A > takes control of company B's router (or hires someone to do it) is already > doing something which in most jurisdictions could fall onto "crime". If > company A could be identified, then they could/should be the 'who', and > not company B. > > I won't expect this proposal will stop *all* intentional hijackers. > Firstly it will depend on a complaint/report, then it must be crystal > clear (with all the checks & balances in place) that is was intentional, > and the hijack was made by person/org X. So if you see bogus routes from > <big company name here>'s ASN coming from somewhere in the world where > they have no business, that's because someone else is (ab)using their > ASN... > > (I would also like to hear Randy's take on 2019-03, even now before > version 2) > > > (...) > > 3. If I were to design that process, I'd put it in a different way, e.g.: > > It's not explicitely written down, but yes, the idea was to have a > (pre-existing) worldwide pool of experts. The timescales were mostly > designed expecting it would be possible to build that pool on a voluntary > basis. So 4 weeks was for a set of experts to agree on the report, > possibly on their own free time... :-) > > > Best Regards, > Carlos > > ------------------------------ > > Message: 2 > Date: Sat, 23 Mar 2019 13:54:06 +0000 > From: "Sascha Luck [ml]" <aawg(a)c4inet.net> > To: JORDI PALET MARTINEZ <jordi.palet(a)consulintel.es> > Cc: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP > Hijacking is a RIPE Policy Violation) > Message-ID: <20190323135406.GO99066(a)cilantro.c4inet.net> > Content-Type: text/plain; charset=us-ascii; format=flowed > > > All, > > can I ask every participant in this discussion to PLEASE, PLEASE > quote properly. It's becoming absolutely impossible to ascertain > who wrote what and who made a statement and who answered it. > > > To brass tacks: > > On Sat, Mar 23, 2019 at 01:44:21PM +0100, JORDI PALET MARTINEZ via > anti-abuse-wg wrote: > > Immediate membership suspension at the end if the experts decide it's > > necessary to do so now. > > This is not possible under the SSA/ripe-697. Section 1.2.1.1 of > ripe-697 states clearly the grounds for termination of > membership. "BGP hijacking" is not one of them. While it is > presumably possible to add additional reasons, it will be, > TTBOMK, only by membership vote. > > I did at the start decide to give this proposal the benefit of > the doubt but I am now convinced that its intent is the > subversion of the RIPE NCC in order to force it to abuse its > dominant market position to remove from (internet) existence, > members who exhibit behaviour that, while arguably legal, > elements of this community don't like. > > Moreover, the proposal aims at doing this while largely > excluding the RIPE NCC itself from the decision-making process, > instead using some panel of "experts" to decide who should live > and who should die. Whence the authority of these "experts" > comes is not explained. The NCC Board is then, or so I surmise, > tasked with giving this decision an air of legitimacy by > ratifying it. Why the (unpaid) Board would even accept such a > questionable honour, I don't know, especially in light of the > potential liabilities. > > Further, the danger exists that this community is not done yet. > Once a mechanism to terminate unwelcome behaviour is established, > it is relatively easy to plug in any other behaviour that this > community, or elements thereof, would like to see removed from the > internet. > > In conclusio, this proposal has the potential to irredeemably > damage the relationship the NCC has with its members and I would > even argue that it has the potential to threaten the very > existence of the NCC if the powers that be decide that it is > abusing its power as a monopoly provider. > > For the avoidance of doubt, I remain in opposition, > > SL > > > > ------------------------------ > > Message: 3 > Date: Sat, 23 Mar 2019 22:26:46 +0800 > From: Lu Heng <h.lu(a)anytimechinese.com> > To: "Sascha Luck [ml]" <aawg(a)c4inet.net> > Cc: JORDI PALET MARTINEZ <jordi.palet(a)consulintel.es>, > anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP > Hijacking is a RIPE Policy Violation) > Message-ID: > <CAAvCx3jaLVGJxH-KBfwsTt-gWk7v77ceDAmm= > DM0yvsO__ioMA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Sat, Mar 23, 2019 at 21:54 Sascha Luck [ml] <aawg(a)c4inet.net> wrote: > > > > > All, > > > > can I ask every participant in this discussion to PLEASE, PLEASE > > quote properly. It's becoming absolutely impossible to ascertain > > who wrote what and who made a statement and who answered it. > > > > > > To brass tacks: > > > > On Sat, Mar 23, 2019 at 01:44:21PM +0100, JORDI PALET MARTINEZ via > > anti-abuse-wg wrote: > > > Immediate membership suspension at the end if the experts decide > it's > > > necessary to do so now. > > > > This is not possible under the SSA/ripe-697. Section 1.2.1.1 of > > ripe-697 states clearly the grounds for termination of > > membership. "BGP hijacking" is not one of them. While it is > > presumably possible to add additional reasons, it will be, > > TTBOMK, only by membership vote. > > > > I did at the start decide to give this proposal the benefit of > > the doubt but I am now convinced that its intent is the > > subversion of the RIPE NCC in order to force it to abuse its > > dominant market position to remove from (internet) existence, > > members who exhibit behaviour that, while arguably legal, > > elements of this community don't like. > > > > Moreover, the proposal aims at doing this while largely > > excluding the RIPE NCC itself from the decision-making process, > > instead using some panel of "experts" to decide who should live > > and who should die. Whence the authority of these "experts" > > comes is not explained. The NCC Board is then, or so I surmise, > > tasked with giving this decision an air of legitimacy by > > ratifying it. Why the (unpaid) Board would even accept such a > > questionable honour, I don't know, especially in light of the > > potential liabilities. > > > > Further, the danger exists that this community is not done yet. > > Once a mechanism to terminate unwelcome behaviour is established, > > it is relatively easy to plug in any other behaviour that this > > community, or elements thereof, would like to see removed from the > > internet. > > > > In conclusio, this proposal has the potential to irredeemably > > damage the relationship the NCC has with its members and I would > > even argue that it has the potential to threaten the very > > existence of the NCC if the powers that be decide that it is > > abusing its power as a monopoly provider. > > > Very well said, +1 > > > > > > > For the avoidance of doubt, I remain in opposition, > > > > SL > > > > -- > -- > Kind regards. > Lu >

1 0

Re: [anti-abuse-wg] 2019-03 and over-reach
by Lu Heng 23 Mar '19

23 Mar '19

When you stealing electricity the electricity company will not cut your electricity at home but report you to the policy. No one saying stealing is ok, but no one agrees electricity company should have policing power. On Sat, Mar 23, 2019 at 18:27 ac <ac(a)main.me> wrote: > On Sat, 23 Mar 2019 18:04:22 +0800 > Lu Heng <h.lu(a)anytimechinese.com> wrote: > > > > It’s very much like electricity company tell you if you do something > > bad we will cut you off and stop supply electricity.and yes, they > > will cut you if you stop paying them, but that doesn’t mean they can > > they also cut if you cheat by stealing electricity. > > you not talk about stealing but you and Nick talk about how use > electricity. > > use any way you like, ripe not internet police, but you no steal, okay? > > > make themselve self juridical court in any bad thing happen in this > > world. > > > not every bad thing, just administrative duty to say stealing is stealing. > > stealing not the same as using electricity to fry naughty neighbor in > chair. > > stealing is when you no pay for electricity you use to fry neighbor, see? > > you use for anything bad, this your business, ripe not judicial court, > administrative authority. > > but you no hijack, okay? > > > Internet, or registry, are starting if not already is, become part of > > base infrastructure of the society, but that does not give us any > > rights in the society to become the supreme court of the society, > > just like your water company or electricity company won’t judge you > > for what you use water or electricity for. > > > > > > > > On Sat, Mar 23, 2019 at 16:54 ac <ac(a)main.me> wrote: > > > > > > > > ugh, english. I do not mean external as in outside I meant external > > > as in not > > > allocated. > > > > > > for example: complaint received about 147g8oobra912cx47.com > > > > > > versus a HIJACKING complaint received about apple.com > > > > > > my argument would be that; as 147Goobra912cX.com is not allocated, > > > any complaints about such a resource is outside the scope of any > > > administrative authority - and ianal, but, some of what Nick > > > Hilliard said, may apply. Same as abuse BY a resource, when what > > > Nick Hilliard said, may also apply. > > > > > > The main point is that; > > > > > > Because: "hijacking" of a domain name (or any resource) is a direct > > > administrative issue (this is factual - as per my previous post) > > > > > > BUT > > > > > > abuse BY a domain name (or any resource) is not necessarily an > > > administrative issue at all (this is debatable/opinion) - as you > > > said "some" TLD responds some do not...and RIPE NCC is not the > > > Internet Police.... > > > > > > So, anyway, as 2019-03 deals with hijacking, this entire over reach > > > argument is factually not relevant at all > > > > > > and, more so: 2019-03 not proceeding would be counter to the ethical > > > administration of resources, a dereliction of responsibility and a > > > breach of trust implied in any such administration (as well as > > > administrative authority) > > > > > > > > > On Sat, 23 Mar 2019 08:20:01 +0000 > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > > > They either find out for themselves or someone else points it out > > > > to them. In either case their responsibility continues if what > > > > you say holds good > > > > > > > > --srs > > > > > > > > ________________________________ > > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of > > > > ac <ac(a)main.me> Sent: Saturday, March 23, 2019 1:44 PM > > > > To: anti-abuse-wg(a)ripe.net > > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > > > > > > > some of what the wg discusses are opinions and some things are > > > > scientific facts. > > > > > > > > scientific facts may change as environments and other variables > > > > change, but currently it is so that; > > > > > > > > there is NO TLD registry that will allow the ongoing random > > > > hijacking of domain names (under that TLD of course) > > > > > > > > as, this would mean that the TLD does not need to exist at all > > > > and/or it will not have any trust/value. > > > > > > > > RIPE NCC though, is factually a resource administrative authority. > > > > > > > > As such, it does need to administer resources and an integral > > > > part of that resource administration is the core responsibility > > > > implied by such administration itself and the balance of > > > > exercising such authority with the implied and direct > > > > responsibility of any such administration. > > > > > > > > Factually, the authority to allocate (or not) is administrative. > > > > > > > > I think (my opinion) is that the confusion arises due to whether a > > > > resource (whether it be a domain name, ip number, etc) is > > > > allocated, or not. When resources are allocated the > > > > administrative responsibility is not degraded, in fact a very > > > > strong argument could be made that the inverse is true: Allocated > > > > resources increases the level of administrative authority, > > > > responsibility and all of the administration aspects themselves. > > > > > > > > Now, TLD (or RIPE NCC) managing **"external"** complaints about > > > > direct abuse, is, imho, outside the scope of an administrative > > > > authority and would be the scenario Nick Hilliard refers to. Then > > > > again, this is my opinion, so I may be completely wrong (or > > > > not) :) > > > > > > > > On Sat, 23 Mar 2019 07:27:40 +0000 > > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > > > > > There's also the interesting comparison of how some TLD > > > > > registries - many of them - act on canceling spam and phish > > > > > domains while others go to every extreme not to do so. > > > > > > > > > > --srs > > > > > > > > > > ________________________________ > > > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf > > > > > of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 11:16 AM > > > > > To: anti-abuse-wg(a)ripe.net > > > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > > > > > On Fri, 22 Mar 2019 17:13:20 +0000 > > > > > Nick Hilliard <nick(a)foobar.org> wrote: > > > > > > Regarding over-reach, the RIPE NCC was instituted as a > > > > > > numbering registry and as a supporting organisation for the > > > > > > RIPE Community, whose terms of reference are described in the > > > > > > RIPE-1 document. The terms of reference make it clear that > > > > > > the purpose of the RIPE Community and the RIPE NCC is > > > > > > internet co-ordination and - pointedly > > > > > > - not enforcement. Proposal 2019-03 goes well outside the > > > > > > scope of what the RIPE Community and the RIPE NCC were > > > > > > constituted to do, and I do not believe that the Anti Abuse > > > > > > working group has the authority to override this. > > > > > > > > > > > the wg is not overriding anything. 2019-03 is about removing > > > > > resources, in much the same way as same resources would have > > > > > been removed for payment. (RIPE NCC accounts person would > > > > > "judge" that there was no payment and resources would be > > > > > affected) > > > > > > > > > > Just because there is a decision it does not mean that such a > > > > > decision > > > > > > > > > > is "law enforcement" or judicial. > > > > > > > > > > 2019-03 is administrative > > > > > > > > > > and not legal/law/judicial > > > > > > > > > > > The second point relates to the long term consequences of the > > > > > > proposal. If the RIPE Community were to pass this policy, > > > > > > then it would direct the RIPE NCC to act as both a judiciary > > > > > > and policing agency for internet abuse. Judgement and > > > > > > enforcement of behaviour are the competence of national > > > > > > governments, courts and law > > > > > > > > > > No. You are saying the same thing, though eloquently, in a > > > > > different way and trying to link it to some future potential > > > > > hijacking by gov of RIR. > > > > > > > > > > It is not much of a decision that RIPE NCC has to make either > > > > > as: > > > > > > > > > > 1. There was hijacking > > > > > > > > > > OR > > > > > > > > > > 2. There was no hijacking > > > > > > > > > > Whether it was accidental, ongoing for long period of time and > > > > > all the other technical and scientific facts, this may require > > > > > some sort of interpretation of facts. > > > > > > > > > > But, not whether it actually happened or not. > > > > > > > > > > > > > > > > > But, this is not how to handle the problem of BGP hijacking. > > > > > > Even if it had the slightest possibility of making any > > > > > > difference at a technical level (which it won't), the > > > > > > proposal would set the RIPE Community and the RIPE NCC down a > > > > > > road which I believe would be extremely unwise to take from a > > > > > > legal and political point of view, and which would be > > > > > > difficult, if not impossible to manoeuver out of. > > > > > ianal, NCC legal will surely evaluate the legal aspects, but > > > > > practically every new shell company that has to deal with > > > > > compliance and other issues is just another layer in the onion. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > -- > > Kind regards. > > Lu > > -- -- Kind regards. Lu

4 16

Re: [anti-abuse-wg] 2019-03 and over-reach
by Lu Heng 23 Mar '19

23 Mar '19

Emm...so if someone steal your house you will take your staff back from his home without police and court? Because you “admin” your staff? Try that next time and try your best explain to the judge why you think he took your staff give you rights to become police. On Sat, Mar 23, 2019 at 18:50 ac <ac(a)main.me> wrote: > On Sat, 23 Mar 2019 18:29:55 +0800 > Lu Heng <h.lu(a)anytimechinese.com> wrote: > > When you stealing electricity the electricity company will not cut > > your electricity at home but report you to the policy. > > > > No one saying stealing is ok, but no one agrees electricity company > > should have policing power. > > > > bottom line: you can do what you like with your electricity but the > electricity company cannot allow you to just take any electricity as > the electricity company is responsible for the administration of the > electricity. > > not stopping you from taking someone else's electricity is not a > "policing" or "judicial" thing - it is an administrative power as this > is the primary job of the electricity company: administer the > electricity. > > otherwise why have an electricity company at all? > > just let anyone use any electricity they like. > > this is a stupid thread. > > > > > > > > On Sat, Mar 23, 2019 at 18:27 ac <ac(a)main.me> wrote: > > > > > On Sat, 23 Mar 2019 18:04:22 +0800 > > > Lu Heng <h.lu(a)anytimechinese.com> wrote: > > > > > > > > It’s very much like electricity company tell you if you do > > > > something bad we will cut you off and stop supply electricity.and > > > > yes, they will cut you if you stop paying them, but that doesn’t > > > > mean they can > > > > > > they also cut if you cheat by stealing electricity. > > > > > > you not talk about stealing but you and Nick talk about how use > > > electricity. > > > > > > use any way you like, ripe not internet police, but you no steal, > > > okay? > > > > make themselve self juridical court in any bad thing happen in > > > > this world. > > > > > > > not every bad thing, just administrative duty to say stealing is > > > stealing. > > > > > > stealing not the same as using electricity to fry naughty neighbor > > > in chair. > > > > > > stealing is when you no pay for electricity you use to fry > > > neighbor, see? > > > > > > you use for anything bad, this your business, ripe not judicial > > > court, administrative authority. > > > > > > but you no hijack, okay? > > > > > > > Internet, or registry, are starting if not already is, become > > > > part of base infrastructure of the society, but that does not > > > > give us any rights in the society to become the supreme court of > > > > the society, just like your water company or electricity company > > > > won’t judge you for what you use water or electricity for. > > > > > > > > > > > > > > > > On Sat, Mar 23, 2019 at 16:54 ac <ac(a)main.me> wrote: > > > > > > > > > > > > > > ugh, english. I do not mean external as in outside I meant > > > > > external as in not > > > > > allocated. > > > > > > > > > > for example: complaint received about 147g8oobra912cx47.com > > > > > > > > > > versus a HIJACKING complaint received about apple.com > > > > > > > > > > my argument would be that; as 147Goobra912cX.com is not > > > > > allocated, any complaints about such a resource is outside the > > > > > scope of any administrative authority - and ianal, but, some of > > > > > what Nick Hilliard said, may apply. Same as abuse BY a > > > > > resource, when what Nick Hilliard said, may also apply. > > > > > > > > > > The main point is that; > > > > > > > > > > Because: "hijacking" of a domain name (or any resource) is a > > > > > direct administrative issue (this is factual - as per my > > > > > previous post) > > > > > > > > > > BUT > > > > > > > > > > abuse BY a domain name (or any resource) is not necessarily an > > > > > administrative issue at all (this is debatable/opinion) - as you > > > > > said "some" TLD responds some do not...and RIPE NCC is not the > > > > > Internet Police.... > > > > > > > > > > So, anyway, as 2019-03 deals with hijacking, this entire over > > > > > reach argument is factually not relevant at all > > > > > > > > > > and, more so: 2019-03 not proceeding would be counter to the > > > > > ethical administration of resources, a dereliction of > > > > > responsibility and a breach of trust implied in any such > > > > > administration (as well as administrative authority) > > > > > > > > > > > > > > > On Sat, 23 Mar 2019 08:20:01 +0000 > > > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > > > > > > > They either find out for themselves or someone else points it > > > > > > out to them. In either case their responsibility continues if > > > > > > what you say holds good > > > > > > > > > > > > --srs > > > > > > > > > > > > ________________________________ > > > > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on > > > > > > behalf of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 1:44 > > > > > > PM To: anti-abuse-wg(a)ripe.net > > > > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > > > > > > > > > > > > > some of what the wg discusses are opinions and some things are > > > > > > scientific facts. > > > > > > > > > > > > scientific facts may change as environments and other > > > > > > variables change, but currently it is so that; > > > > > > > > > > > > there is NO TLD registry that will allow the ongoing random > > > > > > hijacking of domain names (under that TLD of course) > > > > > > > > > > > > as, this would mean that the TLD does not need to exist at all > > > > > > and/or it will not have any trust/value. > > > > > > > > > > > > RIPE NCC though, is factually a resource administrative > > > > > > authority. > > > > > > > > > > > > As such, it does need to administer resources and an integral > > > > > > part of that resource administration is the core > > > > > > responsibility implied by such administration itself and the > > > > > > balance of exercising such authority with the implied and > > > > > > direct responsibility of any such administration. > > > > > > > > > > > > Factually, the authority to allocate (or not) is > > > > > > administrative. > > > > > > > > > > > > I think (my opinion) is that the confusion arises due to > > > > > > whether a resource (whether it be a domain name, ip number, > > > > > > etc) is allocated, or not. When resources are allocated the > > > > > > administrative responsibility is not degraded, in fact a very > > > > > > strong argument could be made that the inverse is true: > > > > > > Allocated resources increases the level of administrative > > > > > > authority, responsibility and all of the administration > > > > > > aspects themselves. > > > > > > > > > > > > Now, TLD (or RIPE NCC) managing **"external"** complaints > > > > > > about direct abuse, is, imho, outside the scope of an > > > > > > administrative authority and would be the scenario Nick > > > > > > Hilliard refers to. Then again, this is my opinion, so I may > > > > > > be completely wrong (or not) :) > > > > > > > > > > > > On Sat, 23 Mar 2019 07:27:40 +0000 > > > > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > > > > > > > > > There's also the interesting comparison of how some TLD > > > > > > > registries - many of them - act on canceling spam and phish > > > > > > > domains while others go to every extreme not to do so. > > > > > > > > > > > > > > --srs > > > > > > > > > > > > > > ________________________________ > > > > > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on > > > > > > > behalf of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 > > > > > > > 11:16 AM To: anti-abuse-wg(a)ripe.net > > > > > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > > > > > > > > > On Fri, 22 Mar 2019 17:13:20 +0000 > > > > > > > Nick Hilliard <nick(a)foobar.org> wrote: > > > > > > > > Regarding over-reach, the RIPE NCC was instituted as a > > > > > > > > numbering registry and as a supporting organisation for > > > > > > > > the RIPE Community, whose terms of reference are > > > > > > > > described in the RIPE-1 document. The terms of reference > > > > > > > > make it clear that the purpose of the RIPE Community and > > > > > > > > the RIPE NCC is internet co-ordination and - pointedly > > > > > > > > - not enforcement. Proposal 2019-03 goes well outside the > > > > > > > > scope of what the RIPE Community and the RIPE NCC were > > > > > > > > constituted to do, and I do not believe that the Anti > > > > > > > > Abuse working group has the authority to override this. > > > > > > > > > > > > > > > the wg is not overriding anything. 2019-03 is about removing > > > > > > > resources, in much the same way as same resources would have > > > > > > > been removed for payment. (RIPE NCC accounts person would > > > > > > > "judge" that there was no payment and resources would be > > > > > > > affected) > > > > > > > > > > > > > > Just because there is a decision it does not mean that such > > > > > > > a decision > > > > > > > > > > > > > > is "law enforcement" or judicial. > > > > > > > > > > > > > > 2019-03 is administrative > > > > > > > > > > > > > > and not legal/law/judicial > > > > > > > > > > > > > > > The second point relates to the long term consequences of > > > > > > > > the proposal. If the RIPE Community were to pass this > > > > > > > > policy, then it would direct the RIPE NCC to act as both > > > > > > > > a judiciary and policing agency for internet abuse. > > > > > > > > Judgement and enforcement of behaviour are the competence > > > > > > > > of national governments, courts and law > > > > > > > > > > > > > > No. You are saying the same thing, though eloquently, in a > > > > > > > different way and trying to link it to some future potential > > > > > > > hijacking by gov of RIR. > > > > > > > > > > > > > > It is not much of a decision that RIPE NCC has to make > > > > > > > either as: > > > > > > > > > > > > > > 1. There was hijacking > > > > > > > > > > > > > > OR > > > > > > > > > > > > > > 2. There was no hijacking > > > > > > > > > > > > > > Whether it was accidental, ongoing for long period of time > > > > > > > and all the other technical and scientific facts, this may > > > > > > > require some sort of interpretation of facts. > > > > > > > > > > > > > > But, not whether it actually happened or not. > > > > > > > > > > > > > > > > > > > > > > > But, this is not how to handle the problem of BGP > > > > > > > > hijacking. Even if it had the slightest possibility of > > > > > > > > making any difference at a technical level (which it > > > > > > > > won't), the proposal would set the RIPE Community and the > > > > > > > > RIPE NCC down a road which I believe would be extremely > > > > > > > > unwise to take from a legal and political point of view, > > > > > > > > and which would be difficult, if not impossible to > > > > > > > > manoeuver out of. > > > > > > > ianal, NCC legal will surely evaluate the legal aspects, but > > > > > > > practically every new shell company that has to deal with > > > > > > > compliance and other issues is just another layer in the > > > > > > > onion. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > -- > > > > Kind regards. > > > > Lu > > > > > > -- > > -- > > Kind regards. > > Lu > > -- -- Kind regards. Lu

3 2

Re: [anti-abuse-wg] 2019-03 and over-reach
by Lu Heng 23 Mar '19

23 Mar '19

Nick are making good point. How about murder is a policy violation? How about rape is a policy violation? Putting RIPE NCC in a juridical position just not what RIPE NCC is. And start using the threat “if you do bad thing(whatever that is) we will take your IP number back” just simply a bad thing both for community as well as for the registry. It’s very much like electricity company tell you if you do something bad we will cut you off and stop supply electricity.and yes, they will cut you if you stop paying them, but that doesn’t mean they can make themselve self juridical court in any bad thing happen in this world. Internet, or registry, are starting if not already is, become part of base infrastructure of the society, but that does not give us any rights in the society to become the supreme court of the society, just like your water company or electricity company won’t judge you for what you use water or electricity for. On Sat, Mar 23, 2019 at 16:54 ac <ac(a)main.me> wrote: > > ugh, english. I do not mean external as in outside I meant external as in > not > allocated. > > for example: complaint received about 147g8oobra912cx47.com > > versus a HIJACKING complaint received about apple.com > > my argument would be that; as 147Goobra912cX.com is not allocated, any > complaints about such a resource is outside the scope of any > administrative authority - and ianal, but, some of what Nick Hilliard > said, may apply. Same as abuse BY a resource, when what Nick Hilliard > said, may also apply. > > The main point is that; > > Because: "hijacking" of a domain name (or any resource) is a direct > administrative issue (this is factual - as per my previous post) > > BUT > > abuse BY a domain name (or any resource) is not necessarily an > administrative issue at all (this is debatable/opinion) - as you said > "some" TLD responds some do not...and RIPE NCC is not the Internet > Police.... > > So, anyway, as 2019-03 deals with hijacking, this entire over reach > argument is factually not relevant at all > > and, more so: 2019-03 not proceeding would be counter to the ethical > administration of resources, a dereliction of responsibility and a breach > of trust implied in any such administration (as well as administrative > authority) > > > On Sat, 23 Mar 2019 08:20:01 +0000 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > They either find out for themselves or someone else points it out to > > them. In either case their responsibility continues if what you say > > holds good > > > > --srs > > > > ________________________________ > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac > > <ac(a)main.me> Sent: Saturday, March 23, 2019 1:44 PM > > To: anti-abuse-wg(a)ripe.net > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > some of what the wg discusses are opinions and some things are > > scientific facts. > > > > scientific facts may change as environments and other variables > > change, but currently it is so that; > > > > there is NO TLD registry that will allow the ongoing random hijacking > > of domain names (under that TLD of course) > > > > as, this would mean that the TLD does not need to exist at all and/or > > it will not have any trust/value. > > > > RIPE NCC though, is factually a resource administrative authority. > > > > As such, it does need to administer resources and an integral part of > > that resource administration is the core responsibility implied by > > such administration itself and the balance of exercising such > > authority with the implied and direct responsibility of any such > > administration. > > > > Factually, the authority to allocate (or not) is administrative. > > > > I think (my opinion) is that the confusion arises due to whether a > > resource (whether it be a domain name, ip number, etc) is allocated, > > or not. When resources are allocated the administrative responsibility > > is not degraded, in fact a very strong argument could be made that the > > inverse is true: Allocated resources increases the level of > > administrative authority, responsibility and all of the administration > > aspects themselves. > > > > Now, TLD (or RIPE NCC) managing **"external"** complaints about direct > > abuse, is, imho, outside the scope of an administrative authority and > > would be the scenario Nick Hilliard refers to. Then again, this is my > > opinion, so I may be completely wrong (or not) :) > > > > On Sat, 23 Mar 2019 07:27:40 +0000 > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > There's also the interesting comparison of how some TLD registries - > > > many of them - act on canceling spam and phish domains while others > > > go to every extreme not to do so. > > > > > > --srs > > > > > > ________________________________ > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac > > > <ac(a)main.me> Sent: Saturday, March 23, 2019 11:16 AM > > > To: anti-abuse-wg(a)ripe.net > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > On Fri, 22 Mar 2019 17:13:20 +0000 > > > Nick Hilliard <nick(a)foobar.org> wrote: > > > > Regarding over-reach, the RIPE NCC was instituted as a numbering > > > > registry and as a supporting organisation for the RIPE Community, > > > > whose terms of reference are described in the RIPE-1 document. The > > > > terms of reference make it clear that the purpose of the RIPE > > > > Community and the RIPE NCC is internet co-ordination and - > > > > pointedly > > > > - not enforcement. Proposal 2019-03 goes well outside the scope of > > > > what the RIPE Community and the RIPE NCC were constituted to do, > > > > and I do not believe that the Anti Abuse working group has the > > > > authority to override this. > > > > > > > the wg is not overriding anything. 2019-03 is about removing > > > resources, in much the same way as same resources would have been > > > removed for payment. (RIPE NCC accounts person would "judge" that > > > there was no payment and resources would be affected) > > > > > > Just because there is a decision it does not mean that such a > > > decision > > > > > > is "law enforcement" or judicial. > > > > > > 2019-03 is administrative > > > > > > and not legal/law/judicial > > > > > > > The second point relates to the long term consequences of the > > > > proposal. If the RIPE Community were to pass this policy, then it > > > > would direct the RIPE NCC to act as both a judiciary and policing > > > > agency for internet abuse. Judgement and enforcement of behaviour > > > > are the competence of national governments, courts and law > > > > > > No. You are saying the same thing, though eloquently, in a different > > > way and trying to link it to some future potential hijacking by gov > > > of RIR. > > > > > > It is not much of a decision that RIPE NCC has to make either as: > > > > > > 1. There was hijacking > > > > > > OR > > > > > > 2. There was no hijacking > > > > > > Whether it was accidental, ongoing for long period of time and all > > > the other technical and scientific facts, this may require some > > > sort of interpretation of facts. > > > > > > But, not whether it actually happened or not. > > > > > > > > > > > But, this is not how to handle the problem of BGP hijacking. Even > > > > if it had the slightest possibility of making any difference at a > > > > technical level (which it won't), the proposal would set the RIPE > > > > Community and the RIPE NCC down a road which I believe would be > > > > extremely unwise to take from a legal and political point of view, > > > > and which would be difficult, if not impossible to manoeuver out > > > > of. > > > ianal, NCC legal will surely evaluate the legal aspects, but > > > practically every new shell company that has to deal with compliance > > > and other issues is just another layer in the onion. > > > > > > > > > > > > > > > > > > > > > > -- -- Kind regards. Lu

4 3

Re: [anti-abuse-wg] 2019-03 and over-reach
by Suresh Ramasubramanian 23 Mar '19

23 Mar '19

They either find out for themselves or someone else points it out to them. In either case their responsibility continues if what you say holds good --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 1:44 PM To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] 2019-03 and over-reach some of what the wg discusses are opinions and some things are scientific facts. scientific facts may change as environments and other variables change, but currently it is so that; there is NO TLD registry that will allow the ongoing random hijacking of domain names (under that TLD of course) as, this would mean that the TLD does not need to exist at all and/or it will not have any trust/value. RIPE NCC though, is factually a resource administrative authority. As such, it does need to administer resources and an integral part of that resource administration is the core responsibility implied by such administration itself and the balance of exercising such authority with the implied and direct responsibility of any such administration. Factually, the authority to allocate (or not) is administrative. I think (my opinion) is that the confusion arises due to whether a resource (whether it be a domain name, ip number, etc) is allocated, or not. When resources are allocated the administrative responsibility is not degraded, in fact a very strong argument could be made that the inverse is true: Allocated resources increases the level of administrative authority, responsibility and all of the administration aspects themselves. Now, TLD (or RIPE NCC) managing **"external"** complaints about direct abuse, is, imho, outside the scope of an administrative authority and would be the scenario Nick Hilliard refers to. Then again, this is my opinion, so I may be completely wrong (or not) :) On Sat, 23 Mar 2019 07:27:40 +0000 Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > There's also the interesting comparison of how some TLD registries - > many of them - act on canceling spam and phish domains while others > go to every extreme not to do so. > > --srs > > ________________________________ > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac > <ac(a)main.me> Sent: Saturday, March 23, 2019 11:16 AM > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > On Fri, 22 Mar 2019 17:13:20 +0000 > Nick Hilliard <nick(a)foobar.org> wrote: > > Regarding over-reach, the RIPE NCC was instituted as a numbering > > registry and as a supporting organisation for the RIPE Community, > > whose terms of reference are described in the RIPE-1 document. The > > terms of reference make it clear that the purpose of the RIPE > > Community and the RIPE NCC is internet co-ordination and - pointedly > > - not enforcement. Proposal 2019-03 goes well outside the scope of > > what the RIPE Community and the RIPE NCC were constituted to do, and > > I do not believe that the Anti Abuse working group has the authority > > to override this. > > > the wg is not overriding anything. 2019-03 is about removing > resources, in much the same way as same resources would have been > removed for payment. (RIPE NCC accounts person would "judge" that > there was no payment and resources would be affected) > > Just because there is a decision it does not mean that such a decision > > is "law enforcement" or judicial. > > 2019-03 is administrative > > and not legal/law/judicial > > > The second point relates to the long term consequences of the > > proposal. If the RIPE Community were to pass this policy, then it > > would direct the RIPE NCC to act as both a judiciary and policing > > agency for internet abuse. Judgement and enforcement of behaviour > > are the competence of national governments, courts and law > > No. You are saying the same thing, though eloquently, in a different > way and trying to link it to some future potential hijacking by gov > of RIR. > > It is not much of a decision that RIPE NCC has to make either as: > > 1. There was hijacking > > OR > > 2. There was no hijacking > > Whether it was accidental, ongoing for long period of time and all the > other technical and scientific facts, this may require some sort of > interpretation of facts. > > But, not whether it actually happened or not. > > > > > But, this is not how to handle the problem of BGP hijacking. Even > > if it had the slightest possibility of making any difference at a > > technical level (which it won't), the proposal would set the RIPE > > Community and the RIPE NCC down a road which I believe would be > > extremely unwise to take from a legal and political point of view, > > and which would be difficult, if not impossible to manoeuver out of. > > > ianal, NCC legal will surely evaluate the legal aspects, but > practically every new shell company that has to deal with compliance > and other issues is just another layer in the onion. > > > > >

2 1