Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
Hi all,
A new RIPE Policy proposal, 2019-03, "BGP Hijacking is a RIPE Policy Violation", is now available for discussion.
Sorry if the issues I'm raising were already addressed somewhere around the thread. As of now, I believe it's the size of an average fiction book, and I don't quite have enough time to read that. I also apologize now in advance for abstaining from the discussion at some point in future, because in quite the same fashion I won't be able to read unnecessarily (and sometimes I believe deliberately) long responses. Whoever is planning to win a consensus through exhaustion is going to win that anyway. With that in mind, 1. As of now, the draft looks like a nice example of "document designed by a committee". It's too strict where there's no real need to be strict, and at the same time too weak where you don't expect it to be weak. E.g. 4 weeks to report + 4 weeks to investigate + 2 weeks for an appeal give us solid 10 weeks for an attack to stay there, which is, to put it gently, a substantial amount of time. 2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment. In fact in theory this policy could make things worse. Most of the ISPs are very slow in applying security updates to their equipment, including border routers. (Also, vendors themselves are not quite keeping up as well) Now, say, I'm an ISP who really wants to push my competitor out of business. With this policy here's a sequence of steps that will win you the market: - hire a script kiddie who will break into that company's Mikrotik; - announce roughly half of IPv4 address space through that breach just for it to be surely on the news; - relax and enjoy watching your competition disappearing in no later than 2,5 months. While I would, in my perfect dream, personally support the idea of cancelling an LIR membership for not updating one's devices at least on a weekly basis, I don't really think this is what the authors of the draft were going to propose, and I know quite a few people, Randy Bush for starters, whom the authors, to put it mildly, won't probably be able to convince. The example by Warren also deserves attention, and I personally don't really anticipate that "won't be too hard to figure out", because frankly we're in fact yet to see the hijacking attempts where an attacker would be deliberately trying hard to hide their identity. 3. If I were to design that process, I'd put it in a different way, e.g.: - 2 business days to find experts. Really, four weeks for that?! Yes, we know that NCC isn't the most dynamic organization out there, but with a pre-populated pool of experts at the current rate of hijacking incidents reported to public that shouldn't really be an issue. - 3 business days to investigate and prepare a preliminary report. Another 5 business days to continue investigation if necessary, with another report at the end. Maybe a third iteration if necessary. Immediate membership suspension at the end if the experts decide it's necessary to do so now. - A grace period of 8 weeks for the suspected hijacker to collect further evidence and provide additional arguments to justify their position. - An appeal phase of another 8 weeks with ultimate decision and, where necessary, membership termination in the end. All the numbers above are rough estimations, they are only there to showcase the idea: - the reaction to *mitigate* should be immediate; - the reaction to *penalize* should allow for a large enterprise — or a large ISP! — to keep up. -- Töma
Hi Töma, El 23/3/19 13:25, "anti-abuse-wg en nombre de Töma Gavrichenkov" <anti-abuse-wg-bounces@ripe.net en nombre de ximaera@gmail.com> escribió: Hi all, > A new RIPE Policy proposal, 2019-03, "BGP Hijacking is > a RIPE Policy Violation", is now available for discussion. Sorry if the issues I'm raising were already addressed somewhere around the thread. As of now, I believe it's the size of an average fiction book, and I don't quite have enough time to read that. I also apologize now in advance for abstaining from the discussion at some point in future, because in quite the same fashion I won't be able to read unnecessarily (and sometimes I believe deliberately) long responses. Whoever is planning to win a consensus through exhaustion is going to win that anyway. With that in mind, 1. As of now, the draft looks like a nice example of "document designed by a committee". It's too strict where there's no real need to be strict, and at the same time too weak where you don't expect it to be weak. E.g. 4 weeks to report + 4 weeks to investigate + 2 weeks for an appeal give us solid 10 weeks for an attack to stay there, which is, to put it gently, a substantial amount of time. Our intent is to "stop" the attack with the claim (not efficient at all), but to allow to be reviewed in order to avoid it, in the future, if possible from the same actors. The timing that we described is "maximum", may be need to add that word in every part of the text that talks about timing. I think this provides sufficient time to cover even complex cases. Now, if the community believe that 4 weeks is too much to investigate even a more complex case and 2 weeks too much for the hijacker response, I'm happy to drop both by half, if Carlos agree as well. 2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment. I mention this before in a couple of emails and I'm more and more convinced that a warning is needed, at least, in doubtful cases, before reporting for a membership cancellation. In fact in theory this policy could make things worse. Most of the ISPs are very slow in applying security updates to their equipment, including border routers. (Also, vendors themselves are not quite keeping up as well) Now, say, I'm an ISP who really wants to push my competitor out of business. With this policy here's a sequence of steps that will win you the market: - hire a script kiddie who will break into that company's Mikrotik; - announce roughly half of IPv4 address space through that breach just for it to be surely on the news; - relax and enjoy watching your competition disappearing in no later than 2,5 months. While I would, in my perfect dream, personally support the idea of cancelling an LIR membership for not updating one's devices at least on a weekly basis, I don't really think this is what the authors of the draft were going to propose, and I know quite a few people, Randy Bush for starters, whom the authors, to put it mildly, won't probably be able to convince. The example by Warren also deserves attention, and I personally don't really anticipate that "won't be too hard to figure out", because frankly we're in fact yet to see the hijacking attempts where an attacker would be deliberately trying hard to hide their identity. 3. If I were to design that process, I'd put it in a different way, e.g.: - 2 business days to find experts. Really, four weeks for that?! Yes, we know that NCC isn't the most dynamic organization out there, but with a pre-populated pool of experts at the current rate of hijacking incidents reported to public that shouldn't really be an issue. In the actual text there is no time to find the experts. The 4 first weeks are to select the experts (from a pool already known), and provide the report. - 3 business days to investigate and prepare a preliminary report. Another 5 business days to continue investigation if necessary, with another report at the end. Maybe a third iteration if necessary. Immediate membership suspension at the end if the experts decide it's necessary to do so now. So, it is in total up the here what I just said, about 2 weeks instead of 4. - A grace period of 8 weeks for the suspected hijacker to collect further evidence and provide additional arguments to justify their position. I think that's too much. He will get a notice once the case is being reported, so he got already the same time as the experts to collect whatever information, and then either 1 or 2 additional weeks after the expert's report. - An appeal phase of another 8 weeks with ultimate decision and, where necessary, membership termination in the end. We have now in total 6 weeks here (2 weeks to file an appeal, 4 more weeks for the next group or experts to reply) All the numbers above are rough estimations, they are only there to showcase the idea: - the reaction to *mitigate* should be immediate; - the reaction to *penalize* should allow for a large enterprise — or a large ISP! — to keep up. If once the report is filed the suspected hijacker get a notification, he has the chance (if the hijack is still "live") to mitigate it. -- Töma ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Fat fingers: Our intent is NOT to "stop" the attack with the claim (not efficient at all), but to allow to be reviewed in order to avoid it, in the future, if possible from the same actors. Regards, Jordi El 23/3/19 13:44, "anti-abuse-wg en nombre de JORDI PALET MARTINEZ via anti-abuse-wg" <anti-abuse-wg-bounces@ripe.net en nombre de anti-abuse-wg@ripe.net> escribió: Hi Töma, El 23/3/19 13:25, "anti-abuse-wg en nombre de Töma Gavrichenkov" <anti-abuse-wg-bounces@ripe.net en nombre de ximaera@gmail.com> escribió: Hi all, > A new RIPE Policy proposal, 2019-03, "BGP Hijacking is > a RIPE Policy Violation", is now available for discussion. Sorry if the issues I'm raising were already addressed somewhere around the thread. As of now, I believe it's the size of an average fiction book, and I don't quite have enough time to read that. I also apologize now in advance for abstaining from the discussion at some point in future, because in quite the same fashion I won't be able to read unnecessarily (and sometimes I believe deliberately) long responses. Whoever is planning to win a consensus through exhaustion is going to win that anyway. With that in mind, 1. As of now, the draft looks like a nice example of "document designed by a committee". It's too strict where there's no real need to be strict, and at the same time too weak where you don't expect it to be weak. E.g. 4 weeks to report + 4 weeks to investigate + 2 weeks for an appeal give us solid 10 weeks for an attack to stay there, which is, to put it gently, a substantial amount of time. Our intent is to "stop" the attack with the claim (not efficient at all), but to allow to be reviewed in order to avoid it, in the future, if possible from the same actors. The timing that we described is "maximum", may be need to add that word in every part of the text that talks about timing. I think this provides sufficient time to cover even complex cases. Now, if the community believe that 4 weeks is too much to investigate even a more complex case and 2 weeks too much for the hijacker response, I'm happy to drop both by half, if Carlos agree as well. 2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment. I mention this before in a couple of emails and I'm more and more convinced that a warning is needed, at least, in doubtful cases, before reporting for a membership cancellation. In fact in theory this policy could make things worse. Most of the ISPs are very slow in applying security updates to their equipment, including border routers. (Also, vendors themselves are not quite keeping up as well) Now, say, I'm an ISP who really wants to push my competitor out of business. With this policy here's a sequence of steps that will win you the market: - hire a script kiddie who will break into that company's Mikrotik; - announce roughly half of IPv4 address space through that breach just for it to be surely on the news; - relax and enjoy watching your competition disappearing in no later than 2,5 months. While I would, in my perfect dream, personally support the idea of cancelling an LIR membership for not updating one's devices at least on a weekly basis, I don't really think this is what the authors of the draft were going to propose, and I know quite a few people, Randy Bush for starters, whom the authors, to put it mildly, won't probably be able to convince. The example by Warren also deserves attention, and I personally don't really anticipate that "won't be too hard to figure out", because frankly we're in fact yet to see the hijacking attempts where an attacker would be deliberately trying hard to hide their identity. 3. If I were to design that process, I'd put it in a different way, e.g.: - 2 business days to find experts. Really, four weeks for that?! Yes, we know that NCC isn't the most dynamic organization out there, but with a pre-populated pool of experts at the current rate of hijacking incidents reported to public that shouldn't really be an issue. In the actual text there is no time to find the experts. The 4 first weeks are to select the experts (from a pool already known), and provide the report. - 3 business days to investigate and prepare a preliminary report. Another 5 business days to continue investigation if necessary, with another report at the end. Maybe a third iteration if necessary. Immediate membership suspension at the end if the experts decide it's necessary to do so now. So, it is in total up the here what I just said, about 2 weeks instead of 4. - A grace period of 8 weeks for the suspected hijacker to collect further evidence and provide additional arguments to justify their position. I think that's too much. He will get a notice once the case is being reported, so he got already the same time as the experts to collect whatever information, and then either 1 or 2 additional weeks after the expert's report. - An appeal phase of another 8 weeks with ultimate decision and, where necessary, membership termination in the end. We have now in total 6 weeks here (2 weeks to file an appeal, 4 more weeks for the next group or experts to reply) All the numbers above are rough estimations, they are only there to showcase the idea: - the reaction to *mitigate* should be immediate; - the reaction to *penalize* should allow for a large enterprise — or a large ISP! — to keep up. If once the report is filed the suspected hijacker get a notification, he has the chance (if the hijack is still "live") to mitigate it. -- Töma ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it. ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
On Sat, Mar 23, 2019 at 1:48 PM JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Our intent is NOT to "stop" the attack with the claim (not efficient at all), but to allow to be reviewed in order to avoid it, in the future, if possible from the same actors.
Not efficient at all. As demonstrated above in the thread, the same actors would then apply for a next LIR with a totally new commercial entity. At that point I don't understand anymore the problem you're trying to solve. -- Töma
All, can I ask every participant in this discussion to PLEASE, PLEASE quote properly. It's becoming absolutely impossible to ascertain who wrote what and who made a statement and who answered it. To brass tacks: On Sat, Mar 23, 2019 at 01:44:21PM +0100, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
Immediate membership suspension at the end if the experts decide it's necessary to do so now.
This is not possible under the SSA/ripe-697. Section 1.2.1.1 of ripe-697 states clearly the grounds for termination of membership. "BGP hijacking" is not one of them. While it is presumably possible to add additional reasons, it will be, TTBOMK, only by membership vote. I did at the start decide to give this proposal the benefit of the doubt but I am now convinced that its intent is the subversion of the RIPE NCC in order to force it to abuse its dominant market position to remove from (internet) existence, members who exhibit behaviour that, while arguably legal, elements of this community don't like. Moreover, the proposal aims at doing this while largely excluding the RIPE NCC itself from the decision-making process, instead using some panel of "experts" to decide who should live and who should die. Whence the authority of these "experts" comes is not explained. The NCC Board is then, or so I surmise, tasked with giving this decision an air of legitimacy by ratifying it. Why the (unpaid) Board would even accept such a questionable honour, I don't know, especially in light of the potential liabilities. Further, the danger exists that this community is not done yet. Once a mechanism to terminate unwelcome behaviour is established, it is relatively easy to plug in any other behaviour that this community, or elements thereof, would like to see removed from the internet. In conclusio, this proposal has the potential to irredeemably damage the relationship the NCC has with its members and I would even argue that it has the potential to threaten the very existence of the NCC if the powers that be decide that it is abusing its power as a monopoly provider. For the avoidance of doubt, I remain in opposition, SL
On Sat, Mar 23, 2019 at 21:54 Sascha Luck [ml] <aawg@c4inet.net> wrote:
All,
can I ask every participant in this discussion to PLEASE, PLEASE quote properly. It's becoming absolutely impossible to ascertain who wrote what and who made a statement and who answered it.
To brass tacks:
On Sat, Mar 23, 2019 at 01:44:21PM +0100, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
Immediate membership suspension at the end if the experts decide it's necessary to do so now.
This is not possible under the SSA/ripe-697. Section 1.2.1.1 of ripe-697 states clearly the grounds for termination of membership. "BGP hijacking" is not one of them. While it is presumably possible to add additional reasons, it will be, TTBOMK, only by membership vote.
I did at the start decide to give this proposal the benefit of the doubt but I am now convinced that its intent is the subversion of the RIPE NCC in order to force it to abuse its dominant market position to remove from (internet) existence, members who exhibit behaviour that, while arguably legal, elements of this community don't like.
Moreover, the proposal aims at doing this while largely excluding the RIPE NCC itself from the decision-making process, instead using some panel of "experts" to decide who should live and who should die. Whence the authority of these "experts" comes is not explained. The NCC Board is then, or so I surmise, tasked with giving this decision an air of legitimacy by ratifying it. Why the (unpaid) Board would even accept such a questionable honour, I don't know, especially in light of the potential liabilities.
Further, the danger exists that this community is not done yet. Once a mechanism to terminate unwelcome behaviour is established, it is relatively easy to plug in any other behaviour that this community, or elements thereof, would like to see removed from the internet.
In conclusio, this proposal has the potential to irredeemably damage the relationship the NCC has with its members and I would even argue that it has the potential to threaten the very existence of the NCC if the powers that be decide that it is abusing its power as a monopoly provider.
Very well said, +1
For the avoidance of doubt, I remain in opposition,
SL
--
-- Kind regards. Lu
In message <20190323135406.GO99066@cilantro.c4inet.net>, "Sascha Luck [ml]" <aawg@c4inet.net> wrote:
Further, the danger exists that this community is not done yet. Once a mechanism to terminate unwelcome behaviour is established, it is relatively easy to plug in any other behaviour that this community, or elements thereof, would like to see removed from the internet.
I understand this reasonable concern, but I think that in this instance it is misplaced. Quite certainly, there would be, and rightly should be, many hard questions asked if the proposal on the table were to suspend RIPE memberships in response to, say, failure to pay court-ordered child support, or smoking in a crowded theater, or any of a million other things that some people might deem worthy of punishment but that have nothing at all directly to do with RIPE or its activities. I would completely agree that even the suggestion that RIPE should in any way involve itself in any such clearly unrelated matters would be a bridge too far. But that is not the nature of the proposal on the table. The proposal on the table has to do with Internet number resoures and ONLY Internet number resources, their allocation, their use, and their misuse. This, it seems to me, is a fairly tight ring-fence. Sascha Luck is concerned that in future there might be some outbreak of infectious moral outrage... about this, that, or the other unrelated thing... and that the present proposal sets a precedent that might in future allow social do-gooders to deploy RIPE as a weapon in some largely unrelated moral crusade. This is not an entirely unreasonable concern, and it would indeed be very bad if it happened. But as long as we confine ourselves to the ring-fence of *only* allowing RIPE to take note of events with respect to Internet number resources, I don't see there as being any real possibility that RIPE, in its official capacity, will be energized or employed to address the epidemic of violence in schools, or free needle exchange for addicts, or the preservation of the Brazillian rain forrest. Those are all entirely valid social concerns, but I don't believe that it takes any deep intellectual capacity to notice that, unlike the present proposal, they have nothing specifically to do with Internet number resources. Regards, rfg
Hi Jordi, On Sat, Mar 23, 2019 at 1:44 PM JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Hi Töma,
- You have ignored the argument No. 2; - And, I'm really not convinced by your computations in the paragraph No 4. I'm so glad to see that all the actions I've managed to outline in an e-mail message sum up to the numbers in the policy. Could we please then see that breakdown in the policy proposal please? I'm personally sorta tired by all those one pager policies where the authors just seem to believe that common sense would make it. it just never seems to. -- Töma
On Sat, 23 Mar 2019, Töma Gavrichenkov wrote:
Hi all,
Hi, (will try to keep it short) (...)
1. As of now, the draft looks like a nice example of "document designed by a committee".
It's too strict where there's no real need to be strict, and at the same time too weak where you don't expect it to be weak. E.g. 4 weeks to report + 4 weeks to investigate + 2 weeks for an appeal give us solid 10 weeks for an attack to stay there, which is, to put it gently, a substantial amount of time.
Just two co-authors. The set will grow for proposals in other RIRs. And we'll gladly accept help, as Jordi is doing the most of heavy lifting. If your issue is timescales they can be adapted in subsequent versions. What we tried to design here was "due process" with enough "checks & balances" embedded. (...)
2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment.
In fact in theory this policy could make things worse.
The scenarios you and others mentioned should be run through the process and what you call "the ultimate result" should only happen if there is absolutely no doubt about the intent and about the 'who'. If company A takes control of company B's router (or hires someone to do it) is already doing something which in most jurisdictions could fall onto "crime". If company A could be identified, then they could/should be the 'who', and not company B. I won't expect this proposal will stop *all* intentional hijackers. Firstly it will depend on a complaint/report, then it must be crystal clear (with all the checks & balances in place) that is was intentional, and the hijack was made by person/org X. So if you see bogus routes from <big company name here>'s ASN coming from somewhere in the world where they have no business, that's because someone else is (ab)using their ASN... (I would also like to hear Randy's take on 2019-03, even now before version 2) (...)
3. If I were to design that process, I'd put it in a different way, e.g.:
It's not explicitely written down, but yes, the idea was to have a (pre-existing) worldwide pool of experts. The timescales were mostly designed expecting it would be possible to build that pool on a voluntary basis. So 4 weeks was for a set of experts to agree on the report, possibly on their own free time... :-) Best Regards, Carlos
On Sat, Mar 23, 2019 at 2:39 PM Carlos Friaças <cfriacas@fccn.pt> wrote:
1. As of now, the draft looks like a nice example of "document designed by a committee".
Just two co-authors.
If your issue is timescales they can be adapted in subsequent versions.
The scenarios you and others mentioned should be run through the process
Firstly it will depend on a complaint/report, then it must be crystal clear (with all the checks & balances in place) that is was intentional
That rant wasn't about the process but rather the result ;-) Next: 1. 2. 3. 4. (!!)
It's not explicitely written down, but yes, [..]
May we, for once, have a policy proposal that's not a "common sense will prevail"-style one pager that explicitly covers all the topics it proposes (such as the role and the responsibility of the team of "experts" mentioned above), all of the glossary it uses, the timeline, and all the corner cases, and discuss the proposal only after all those are in place? -- Töma
Hi Töma, All, I believe that's a matter of preference, but thank you, it's valuable input for version 2.0 (which will probably be a lot longer and less prone to be read by a larger set of people). This (really long) discussion is useful and it's just one phase in the PDP. Cheers, Carlos On Sun, 24 Mar 2019, Töma Gavrichenkov wrote:
On Sat, Mar 23, 2019 at 2:39 PM Carlos Friaças <cfriacas@fccn.pt> wrote:
1. As of now, the draft looks like a nice example of "document designed by a committee".
Just two co-authors.
That rant wasn't about the process but rather the result ;-)
Next:
If your issue is timescales they can be adapted in subsequent versions.
The scenarios you and others mentioned should be run through the process
Firstly it will depend on a complaint/report, then it must be crystal clear (with all the checks & balances in place) that is was intentional
1. 2. 3. 4. (!!)
It's not explicitely written down, but yes, [..]
May we, for once, have a policy proposal that's not a "common sense will prevail"-style one pager that explicitly covers all the topics it proposes (such as the role and the responsibility of the team of "experts" mentioned above), all of the glossary it uses, the timeline, and all the corner cases, and discuss the proposal only after all those are in place?
-- Töma
Peace, On Sun, Mar 24, 2019, 2:10 PM Carlos Friaças <cfriacas@fccn.pt> wrote:
I believe that's a matter of preference, but thank you, it's valuable input for version 2.0 (which will probably be a lot longer and less prone to be read by a larger set of people).
Alright. Just for the sake of simplicity, you may assume that my current reaction is "object". Having said that, I really appreciate your effort, support your initial intentions and am really looking forward to seeing the next revision right after the problem statement is clarified. -- Töma
In message <CALZ3u+bpTu+R63s_O_Fqr-Qz3DaFh1e9N+7dD1WbzSn028cDHA@mail.gmail.com> =?UTF-8?Q?T=C3=B6ma_Gavrichenkov?= <ximaera@gmail.com> wrote:
2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment.
Did you have some particular alternative in mind that you wanted to propose? Sending the miscreant hijacker to bed without supper perhaps?
- hire a script kiddie who will break into that company's Mikrotik; - announce roughly half of IPv4 address space through that breach just for it to be surely on the news; - relax and enjoy watching your competition disappearing in no later than 2,5 months.
I do believe that the main idea here was *not* to have the nuclear missles on a hair-trigger *or* to launch them within a few minutes of the beginning of a hijacking event, but rather to *notify* the party responsible, and then, if and ONLY IF absolutely NO ACTION is taken to resolve the problem after some reasonable period of time, then, and only then, it would *begin* to be a real possibility that sanctions would be applied. Believe me, none of the sponsors or proponents of this proposal wants to see the nuclear missles launched mistakenly, for example, in response to a falling meteor or a volcanic eruption somewhere. Any such premature over-reaction would quite obviously be Bad, and that passage of time usually serves to clarify intent. Regards, rfg
El 23/3/19 22:33, "anti-abuse-wg en nombre de Ronald F. Guilmette" <anti-abuse-wg-bounces@ripe.net en nombre de rfg@tristatelogic.com> escribió: In message <CALZ3u+bpTu+R63s_O_Fqr-Qz3DaFh1e9N+7dD1WbzSn028cDHA@mail.gmail.com> =?UTF-8?Q?T=C3=B6ma_Gavrichenkov?= <ximaera@gmail.com> wrote: >2. OTOH the ultimate result (membership cancellation) may be seen as a >very heavy punishment. Did you have some particular alternative in mind that you wanted to propose? Sending the miscreant hijacker to bed without supper perhaps? >- hire a script kiddie who will break into that company's Mikrotik; >- announce roughly half of IPv4 address space through that breach just >for it to be surely on the news; >- relax and enjoy watching your competition disappearing in no later >than 2,5 months. I do believe that the main idea here was *not* to have the nuclear missles on a hair-trigger *or* to launch them within a few minutes of the beginning of a hijacking event, but rather to *notify* the party responsible, and then, if and ONLY IF absolutely NO ACTION is taken to resolve the problem after some reasonable period of time, then, and only then, it would *begin* to be a real possibility that sanctions would be applied. Believe me, none of the sponsors or proponents of this proposal wants to see the nuclear missles launched mistakenly, for example, in response to a falling meteor or a volcanic eruption somewhere. Any such premature over-reaction would quite obviously be Bad, and that passage of time usually serves to clarify intent. I think is very obvious that the experts (and the board as the last instance) will make sure that when a warning is sufficient (specially first time even for a clear hijack if there are no *very clear* evidences that it is intentional), but if the same organization or the same people hiding behind another organization, is repeating once and against, then it is time to stop it. We can have more explicit text about that, but I think we must trust the experts judgement, and that's why there is an appeal chance and a final ratification step. As you said, and thanks for that, *IT IS OUR MORAL AND ETHICAL RESPONSIBILITY*. Regards, rfg ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
On Sat, Mar 23, 2019 at 10:42 PM JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
I think is very obvious that the experts [..] will make sure that when a warning is sufficient
NO IT'S NOT The process is not clear. No guidelines for the "experts" are defined. No selection process for "experts" is drafted. That's just wishful thinking as of now, where the best candidate for the experts' panel is probably Albus Dumbledore himself. -- Töma
On Sun, Mar 24, 2019 at 01:16:59AM +0100, Töma Gavrichenkov wrote:
On Sat, Mar 23, 2019 at 10:42 PM JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
I think is very obvious that the experts [..] will make sure that when a warning is sufficient
NO IT'S NOT
The process is not clear. No guidelines for the "experts" are defined. No selection process for "experts" is drafted. That's just wishful thinking as of now, where the best candidate for the experts' panel is probably Albus Dumbledore himself.
Well said. +1 Piotr -- Piotr Strzyżewski Silesian University of Technology, Computer Centre Gliwice, Poland
On Sat, Mar 23, 2019 at 10:33 PM Ronald F. Guilmette <rfg@tristatelogic.com> wrote:
2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment.
Did you have some particular alternative in mind that you wanted to propose?
Yes, the message you're replying to featured the word "suspension".
Sending the miscreant hijacker to bed without supper perhaps?
This line of characters is a pathetic statement which carries no additional useful information, please refrain from doing that again.
I do believe that the main idea here was *not* to have the nuclear missles on a hair-trigger *or* to launch them within a few minutes of the beginning of a hijacking event
Me too, what's the point?
but rather [the main idea here was] to *notify* the party responsible, and then, if and ONLY IF absolutely NO ACTION is taken to resolve the problem after some reasonable period of time, then, and only then, it would *begin* to be a real possibility that sanctions would be applied.
This is not stated in the text. I don't care what's the "main idea" was wherever and whenever it was. Either it's in the text or it's absent, and that's it.
Believe me, none of the sponsors or proponents of this proposal wants to see the nuclear missles launched mistakenly, for example, in response to a falling meteor or a volcanic eruption somewhere.
This line of characters is a pathetic statement which carries no additional useful information, please refrain from doing that again. -- Töma
participants (7)
-
Carlos Friaças -
JORDI PALET MARTINEZ -
Lu Heng -
Piotr Strzyzewski -
Ronald F. Guilmette -
Sascha Luck [ml] -
Töma Gavrichenkov