2019-04 New Policy Proposal (Validation of "abuse-mailbox")
Dear colleagues, A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion. This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04 As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal. We encourage you to review this proposal and send your comments to <anti-abuse-wg@ripe.net> before 14 June 2019. Kind regards, Marco Schmidt Policy Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum
Marco, Thanks for this, and thanks to Jordi for proposing it. We will be discussing this next week at RIPE 78, but time is tight and, of course, the important comments need to be on the mailing list, where the decision is made. As always the Co-Chairs hope for a respectful discussion on the proposal and we would ask everyone to be as clear as possible as to why they do or do not support it. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet@heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270
-----Original Message----- From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> On Behalf Of Marco Schmidt Sent: Thursday 16 May 2019 13:21 To: anti-abuse-wg@ripe.net Subject: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse- mailbox")
Dear colleagues,
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04
As per the RIPE Policy Development Process (PDP), the purpose of this four- week Discussion Phase is to discuss the proposal and provide feedback to the proposer.
At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal.
We encourage you to review this proposal and send your comments to <anti- abuse-wg@ripe.net> before 14 June 2019.
Kind regards,
Marco Schmidt Policy Officer RIPE NCC
Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum
Marco Schmidt writes:
Dear colleagues,
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04
(...) Looks good. A couple of notes. In addition to the first notice, it may be worth to add 'reminders' instead of escalating directly to the LIR, such as sending a reminder after one week (day 7), and another on the 14th day, prior to escalation. *This should not be necessary,* as the resource owner should have put the means so that emails received on the abuse-c are not lost, and someone actually reviews them, without having to insist on them. But I foresee that would improve the response process. Also, the resource holder should be able to manually request a new mailbox validation if the provided code is expired (eg. the main person in charge was on holiday and their backup did not handle it). RIPE should log the time taken by the different holders to validate their abuse-c, so that those statistics can be used in the future to better understand the effectivity of this process. Finally, I have been thinking how to improve the phrase «Commonly, if a ticket number has been generated, it should be kept (typically as part of the subject) through successive communications.» I came out with replacing it with this new paragraph: «It is quite common to have ticket numbers/identifiers associated to abuse reports in order to be able to differentiate them, which are typically included as part of the subject. Replies (either manual or automated) by the resource holder should maintain any identifiers used by the reporter, optionally adding their own one. And any reply by the abuse reporter should keep as well the identifier holding the ticket number on the resource holder system.» Best regards -- INCIBE-CERT - CERT of the Spanish National Cybersecurity Institute https://www.incibe-cert.es/ PGP Keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ======================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ========================================================================
Hi Angel, Thanks a lot for the inputs, see below in-line. Regards, Jordi El 16/5/19 16:36, "anti-abuse-wg en nombre de Ángel González Berdasco" <anti-abuse-wg-bounces@ripe.net en nombre de angel.gonzalez@incibe.es> escribió: Marco Schmidt writes: > Dear colleagues, > > A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", > is now available for discussion. > > This proposal aims to have the RIPE NCC validate "abuse-c:" > information more often, and introduces a new validation process that > requires manual input from resource holders. > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2019-04 > (...) Looks good. A couple of notes. In addition to the first notice, it may be worth to add 'reminders' instead of escalating directly to the LIR, such as sending a reminder after one week (day 7), and another on the 14th day, prior to escalation. My original proposal had many additional details and complexity, including warnings, blocking the account, etc., but conversations with the staff bring down some my original ideas as they are considered "operational details", in the expectation to discuss them in the list and re-add them if the community may think they must be explicitly part of the policy proposal. *This should not be necessary,* as the resource owner should have put the means so that emails received on the abuse-c are not lost, and someone actually reviews them, without having to insist on them. But I foresee that would improve the response process. Clearly, I fully agree. Also, the resource holder should be able to manually request a new mailbox validation if the provided code is expired (eg. the main person in charge was on holiday and their backup did not handle it). I think this is not needed, because the NCC, after the validation fails, will be in touch with the resource holder, again may be an operational issue, but again, if the community think that it should be explicit in the proposal, I'm also happy about that. RIPE should log the time taken by the different holders to validate their abuse-c, so that those statistics can be used in the future to better understand the effectivity of this process. Very good point. Again, I think it is an operational aspect. I will suggest the impact analysis to consider if they already do this by default, or we need to explicitly say this. Many of those aspects can be part of the policy proposal as "other information", not necessarily as policy text. Finally, I have been thinking how to improve the phrase «Commonly, if a ticket number has been generated, it should be kept (typically as part of the subject) through successive communications.» I came out with replacing it with this new paragraph: «It is quite common to have ticket numbers/identifiers associated to abuse reports in order to be able to differentiate them, which are typically included as part of the subject. Replies (either manual or automated) by the resource holder should maintain any identifiers used by the reporter, optionally adding their own one. And any reply by the abuse reporter should keep as well the identifier holding the ticket number on the resource holder system.» Fine for me. Let's see what others believe. Best regards -- INCIBE-CERT - CERT of the Spanish National Cybersecurity Institute https://www.incibe-cert.es/ PGP Keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ======================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ======================================================================== ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, On Thu, May 16, 2019 at 02:20:46PM +0200, Marco Schmidt wrote:
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
This will encourage me to build a robot that monitors our abuse mailbox and clicks on everything that comes in. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi, On Thu, May 16, 2019 at 04:53:25PM +0200, Gert Doering wrote:
This will encourage me to build a robot that monitors our abuse mailbox and clicks on everything that comes in.
In case this was not obvious: I oppose this policy proposal. It will have no positive effect whatsoever but it will create lots of extra process and red tape and procedures and false alerts and escalations due to the way normal ISPs operate, people change, mistakes happens, ticket systems eat mails with funky URLs, and so on. Which can, of couse, be handled by even more processes, escalation stages, etc. Which then will lead to "those that already *act* on their abuse mail will be annoyed because it has more extra costs, and those that already do not care about their abuse mail will honour this policy, and still *not act*". No positive effect, but lots of negative side-effects. Strong opposition. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Gert Doering wrote on 16/05/2019 21:47:
No positive effect, but lots of negative side-effects.
Abuse mailboxes are already checked. What matters for abuse management is whether reports are acted on. This policy doesn't address that. If the RIPE NCC is instructed to send 6-monthly reminders to all abuse contacts with the implicit threat that if they aren't acted on in the way specified in this policy, that the organisation in question can look forward to having their addressing resources vapourised, this will aggravate the RIPE NCC membership and corrode community trust in the organisation. The one thing it won't do is make abuse management better. Internet abuse management is not something that you're going to fix by beating LIRs with sticks, and if they don't react, that you threaten to beat them harder. Separate to this, it's inappropriate to micromanage the NCC in RIPE policy. It would be good if the RIPE working groups stopped trying to tell the RIPE NCC people how to do their jobs. Nick
Are they is the question For example - ARIN just reclaimed a large number of IPs from an actor that created a large number of shell companies. http://m.slashdot.org/story/355802 --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Nick Hilliard <nick@foobar.org> Sent: Friday, May 17, 2019 3:08 AM To: Gert Doering Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") Gert Doering wrote on 16/05/2019 21:47:
No positive effect, but lots of negative side-effects.
Abuse mailboxes are already checked. What matters for abuse management is whether reports are acted on. This policy doesn't address that. If the RIPE NCC is instructed to send 6-monthly reminders to all abuse contacts with the implicit threat that if they aren't acted on in the way specified in this policy, that the organisation in question can look forward to having their addressing resources vapourised, this will aggravate the RIPE NCC membership and corrode community trust in the organisation. The one thing it won't do is make abuse management better. Internet abuse management is not something that you're going to fix by beating LIRs with sticks, and if they don't react, that you threaten to beat them harder. Separate to this, it's inappropriate to micromanage the NCC in RIPE policy. It would be good if the RIPE working groups stopped trying to tell the RIPE NCC people how to do their jobs. Nick
Hi Nick, As it has been observed several times, the actual validation system is extremely weak and very easy to avoid, so 99% useless. If I put in my abuse-c your email (just an example). The validation will pass, and you will never notice that I've used your email to fake the system. So, clearly is the wrong way. If two validations are done per year, I don't think this is significant overhead for any resource holder vs the benefits of the time saving for the same resource holders that need to use the abuse mailbox of a counterparty that today is escaping from a real validation and creating troubles with abuse emails to someone else. Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west. Regards, Jordi El 16/5/19 23:38, "anti-abuse-wg en nombre de Nick Hilliard" <anti-abuse-wg-bounces@ripe.net en nombre de nick@foobar.org> escribió: Gert Doering wrote on 16/05/2019 21:47: > No positive effect, but lots of negative side-effects. Abuse mailboxes are already checked. What matters for abuse management is whether reports are acted on. This policy doesn't address that. If the RIPE NCC is instructed to send 6-monthly reminders to all abuse contacts with the implicit threat that if they aren't acted on in the way specified in this policy, that the organisation in question can look forward to having their addressing resources vapourised, this will aggravate the RIPE NCC membership and corrode community trust in the organisation. The one thing it won't do is make abuse management better. Internet abuse management is not something that you're going to fix by beating LIRs with sticks, and if they don't react, that you threaten to beat them harder. Separate to this, it's inappropriate to micromanage the NCC in RIPE policy. It would be good if the RIPE working groups stopped trying to tell the RIPE NCC people how to do their jobs. Nick ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Hi Nick,
[..]
Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west.
It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case) Cheers, Alex
This "proportionality" test you speak of, has as much relevance to the regulating of internet resources, as "freedom of speech" does to regulating internet forum membership (no relevance at all). --------- Original Message --------- Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") From: "Alex de Joode" <alex@idgara.nl> Date: 5/16/19 4:56 pm To: "JORDI PALET MARTINEZ" <jordi.palet@consulintel.es> Cc: anti-abuse-wg@ripe.net On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote: Hi Nick, [..] Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west. It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case) Cheers, Alex
I beg to differ. The ripe membership set's the policy; Ripe enforces the policy; If a ripe member has it's resources withdrawn due the policy and the enforcement of the policy, the ripe member can go to court in The Netherlands (see contact between member and ripe); The Amsterdam court will apply the proportionality test to a case where the resources are withdrawn based only on the fact there was no reply to the abuse-mailbox validation email; The Amsterdam court will find this action is unreasonable; The Amsterdam court will force ripe to re-instate the resources; The Amsterdam court will be liable for any and all damages the ripe member suffered. -- IDGARA | Alex de Joode | +31651108221 On Fri, 17-05-2019 4h 49min, Fi Shing <phishing@storey.xxx> wrote:
This "proportionality" test you speak of, has as much relevance to the regulating of internet resources, as "freedom of speech" does to regulating internet forum membership (no relevance at all).
--------- Original Message ---------
Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox")
From: "Alex de Joode" <alex@idgara.nl> Date: 5/16/19 4:56 pm To: "JORDI PALET MARTINEZ" <jordi.palet@consulintel.es> Cc: anti-abuse-wg@ripe.net
On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Hi Nick,
[..]
Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west.
It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case) Cheers, Alex
How was ARIN able to reclaim 750k IPs showing fraud including shell company setup then? The USA is if anything even more litigious than Europe is. You also go to court with "clean hands", so if the invalid abuse contact is also accompanied by a proliferation of malware etc a judge may not react the same way they would when faced with a situation where the ripe contact was sick, on vacation or just plain negligent. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Alex de Joode <alex@idgara.nl> Sent: Friday, May 17, 2019 11:02 AM To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") I beg to differ. The ripe membership set's the policy; Ripe enforces the policy; If a ripe member has it's resources withdrawn due the policy and the enforcement of the policy, the ripe member can go to court in The Netherlands (see contact between member and ripe); The Amsterdam court will apply the proportionality test to a case where the resources are withdrawn based only on the fact there was no reply to the abuse-mailbox validation email; The Amsterdam court will find this action is unreasonable; The Amsterdam court will force ripe to re-instate the resources; The Amsterdam court will be liable for any and all damages the ripe member suffered. -- IDGARA | Alex de Joode | +31651108221 On Fri, 17-05-2019 4h 49min, Fi Shing <phishing@storey.xxx> wrote: This "proportionality" test you speak of, has as much relevance to the regulating of internet resources, as "freedom of speech" does to regulating internet forum membership (no relevance at all). --------- Original Message --------- Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") From: "Alex de Joode" <alex@idgara.nl> Date: 5/16/19 4:56 pm To: "JORDI PALET MARTINEZ" <jordi.palet@consulintel.es> Cc: anti-abuse-wg@ripe.net On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote: Hi Nick, [..] Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west. It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case) Cheers, Alex
"a case where the resources are withdrawn based only on the fact there was no reply to the abuse-mailbox validation email" You should high light the word 'only'. The ARIN case has nothing to do with -only- not answering the validation mail. It actually attacks a business model build on providing a cybercrime infrastructure. The proposed policy will not be able to accomplish this. -- IDGARA | Alex de Joode | +31651108221 On Fri, 17-05-2019 7h 47min, Suresh Ramasubramanian <ops.lists@gmail.com> wrote:
How was ARIN able to reclaim 750k IPs showing fraud including shell company setup then? The USA is if anything even more litigious than Europe is.
You also go to court with "clean hands", so if the invalid abuse contact is also accompanied by a proliferation of malware etc a judge may not react the same way they would when faced with a situation where the ripe contact was sick, on vacation or just plain negligent.
--srs From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Alex de Joode <alex@idgara.nl>
Sent: Friday, May 17, 2019 11:02 AM
To: anti-abuse-wg@ripe.net
Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") I beg to differ.
The ripe membership set's the policy; Ripe enforces the policy; If a ripe member has it's resources withdrawn due the policy and the enforcement of the policy, the ripe member can go to court in The Netherlands (see contact between member and ripe); The Amsterdam court will apply the proportionality test to a case where the resources are withdrawn based only on the fact there was no reply to the abuse-mailbox validation email; The Amsterdam court will find this action is unreasonable; The Amsterdam court will force ripe to re-instate the resources; The Amsterdam court will be liable for any and all damages the ripe member suffered.
-- IDGARA | Alex de Joode | +31651108221
On Fri, 17-05-2019 4h 49min, Fi Shing <phishing@storey.xxx> wrote:
This "proportionality" test you speak of, has as much relevance to the regulating of internet resources, as "freedom of speech" does to regulating internet forum membership (no relevance at all).
--------- Original Message --------- Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox")
From: "Alex de Joode" <alex@idgara.nl>
Date: 5/16/19 4:56 pm
To: "JORDI PALET MARTINEZ" <jordi.palet@consulintel.es>
Cc: anti-abuse-wg@ripe.net
On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Hi Nick,
[..]
Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west. It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case) Cheers, Alex
But if a policy asking ripe ncc to investigate fraud and withdraw resources were to be proposed we would again hear the "we are not the internet police" trope :( --srs ________________________________ From: Alex de Joode <alex@idgara.nl> Sent: Friday, May 17, 2019 11:32 AM To: Suresh Ramasubramanian Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") "a case where the resources are withdrawn based only on the fact there was no reply to the abuse-mailbox validation email" You should high light the word 'only'. The ARIN case has nothing to do with -only- not answering the validation mail. It actually attacks a business model build on providing a cybercrime infrastructure. The proposed policy will not be able to accomplish this. -- IDGARA | Alex de Joode | +31651108221 On Fri, 17-05-2019 7h 47min, Suresh Ramasubramanian <ops.lists@gmail.com> wrote: How was ARIN able to reclaim 750k IPs showing fraud including shell company setup then? The USA is if anything even more litigious than Europe is. You also go to court with "clean hands", so if the invalid abuse contact is also accompanied by a proliferation of malware etc a judge may not react the same way they would when faced with a situation where the ripe contact was sick, on vacation or just plain negligent. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Alex de Joode <alex@idgara.nl> Sent: Friday, May 17, 2019 11:02 AM To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") I beg to differ. The ripe membership set's the policy; Ripe enforces the policy; If a ripe member has it's resources withdrawn due the policy and the enforcement of the policy, the ripe member can go to court in The Netherlands (see contact between member and ripe); The Amsterdam court will apply the proportionality test to a case where the resources are withdrawn based only on the fact there was no reply to the abuse-mailbox validation email; The Amsterdam court will find this action is unreasonable; The Amsterdam court will force ripe to re-instate the resources; The Amsterdam court will be liable for any and all damages the ripe member suffered. -- IDGARA | Alex de Joode | +31651108221 On Fri, 17-05-2019 4h 49min, Fi Shing <phishing@storey.xxx> wrote: This "proportionality" test you speak of, has as much relevance to the regulating of internet resources, as "freedom of speech" does to regulating internet forum membership (no relevance at all). --------- Original Message --------- Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") From: "Alex de Joode" <alex@idgara.nl> Date: 5/16/19 4:56 pm To: "JORDI PALET MARTINEZ" <jordi.palet@consulintel.es> Cc: anti-abuse-wg@ripe.net On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote: Hi Nick, [..] Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west. It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case) Cheers, Alex
On Fri, 17 May 2019, Alex de Joode wrote:
??I beg to differ. The ripe membership set's the policy; Ripe enforces the policy; If a ripe member has it's resources withdrawn due the policy and the enforcement of the policy, the ripe member can go to court in The Netherlands (see contact between member and ripe); The Amsterdam court will apply the proportionality test to a case where the resources are withdrawn based only on the fact there was no reply to the abuse-mailbox validation email; The Amsterdam court will find this action is unreasonable; The Amsterdam court will force ripe to re-instate the resources; The Amsterdam court will be liable for any and all damages the ripe member suffered.
Hi, You mean "The Amsterdam court will rule RIPE NCC is liable for any and all damages the ripe member suffered." ??? ps: is there any jurisprudence about what you are describing...? Carlos
?-- IDGARA | Alex de Joode | +31651108221
On Fri, 17-05-2019 4h 49min, Fi Shing <phishing@storey.xxx> wrote: This "proportionality" test you speak of, has as much relevance to the regulating of internet resources, as "freedom of speech" does to regulating internet forum membership (no relevance at all). --------- Original Message --------- Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") From: "Alex de Joode" <alex@idgara.nl> Date: 5/16/19 4:56 pm To: "JORDI PALET MARTINEZ" <jordi.palet@consulintel.es> Cc: anti-abuse-wg@ripe.net
?On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote: Hi Nick,
[..]
Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west.
It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case) Cheers, Alex
Alex, On 17/05/2019 01.56, Alex de Joode wrote:
On Fri, 17-05-2019 1h 45min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Hi Nick,
[..]
Anyone failing in repetitive ocassions to comply with policies is subjected to further NCC scrutiny, including account closure. This is a different policy already in place. If we don't like that, we should change that policy, but then we don't need policies anymore. Policies are the rules for the community to be respected by all, and not having an administrative enforcement by the NCC is the wilde west.
It is an illusion to think ripe can suspend/withdraw resources if an organisation does not reply to a abuse validation request. That simply will not pass the proportionality test needed under Dutch law. So you will have no recourse. (Only if you can prove the entity has registered with false creditials (Due Diligence by new members takes care of this) -and- the entity is active in a criminal enterprise, you might have a case)
(Please read all 3 paragraphs before answering the first one!) It seems like the RIPE NCC could legitimately claim that being able to handle abuse reports is a requirement for receiving any number resources. If the procedure for verifying this is reasonable, then I don't see why revocation of those resources would be considered disproportional. In any case, any policy proposal receives feasibility feedback from the RIPE NCC, who has excellent legal staff. Further, the RIPE NCC has resources for external consultation if their in-house legal staff is not sufficient to answer any questions about a given proposal. I don't think we need to be amateur lawyers for this or any other proposal. Cheers, -- Shane
Alex, On 17/05/2019 09.15, Shane Kerr wrote:
I don't think we need to be amateur lawyers for this or any other proposal.
I have been informed that you are an actual lawyer and not an amateur one. Color me embarrassed! My sincere apologies. All I can say is that the law is stupid then, and it SHOULD allow the proposed policy. 😉 Cheers, -- Shane
Shane Kerr wrote on 17/05/2019 08:45:
All I can say is that the law is stupid then, and it SHOULD allow the proposed policy. 😉
fundamentally, it shouldn't. Proportionality is a cornerstone of most legal systems - if you don't have proportionality, you end up with tyranny. The idea of threatening to cut off a LIR because they haven't updated an abuse contact is completely disproportionate to the scale of the policy infraction. Nick
On Fri, 17 May 2019, Nick Hilliard wrote:
Shane Kerr wrote on 17/05/2019 08:45:
All I can say is that the law is stupid then, and it SHOULD allow the proposed policy. ?
fundamentally, it shouldn't. Proportionality is a cornerstone of most legal systems - if you don't have proportionality, you end up with tyranny. The idea of threatening to cut off a LIR because they haven't updated an abuse contact is completely disproportionate to the scale of the policy infraction.
Hi, It's probably not "haven't updated" but instead "haven't created". Ideally this would also cover cases where company X deliberately inserts an e-mail address from someone which has nothing to do with the numbering resource... at least the legitimate owner of such mailbox should be able to resort to someone (hopefully not a court!) to have that corrected in the registry....... We had that with our postal address from an ARIN member some years ago. :/ Carlos
Nick
As I read the proposal cutting off bogus LIRs seems to be the goal rather than cutting off a legitimate but careless player. There seem to be quite a few such given the coming wg meeting has a preso on just this topic. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Carlos Friaças via anti-abuse-wg <anti-abuse-wg@ripe.net> Sent: Friday, May 17, 2019 3:08 PM To: Nick Hilliard Cc: Shane Kerr; anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] Legality of proposal (apologies) On Fri, 17 May 2019, Nick Hilliard wrote:
Shane Kerr wrote on 17/05/2019 08:45:
All I can say is that the law is stupid then, and it SHOULD allow the proposed policy. ?
fundamentally, it shouldn't. Proportionality is a cornerstone of most legal systems - if you don't have proportionality, you end up with tyranny. The idea of threatening to cut off a LIR because they haven't updated an abuse contact is completely disproportionate to the scale of the policy infraction.
Hi, It's probably not "haven't updated" but instead "haven't created". Ideally this would also cover cases where company X deliberately inserts an e-mail address from someone which has nothing to do with the numbering resource... at least the legitimate owner of such mailbox should be able to resort to someone (hopefully not a court!) to have that corrected in the registry....... We had that with our postal address from an ARIN member some years ago. :/ Carlos
Nick
On May 17, 2019, at 12:40, Suresh Ramasubramanian <ops.lists@gmail.com> wrote:
Hi all,
As I read the proposal cutting off bogus LIRs seems to be the goal rather than cutting off a legitimate but careless player. There seem to be quite a few such given the coming wg meeting has a preso on just this topic.
I saw a lot of cases when visible goals after accepting have been converted to awful applying. There should be always considered the worst way of the policy applying. And when it is accepted people will find yet worse.
--srs
-- Best regards Taras Heichenko tasic@hostmaster.ua
Hi, On Fri, May 17, 2019 at 01:45:19AM +0200, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
If two validations are done per year, I don't think this is significant overhead for any resource holder vs the benefits of the time saving for the same resource holders that need to use the abuse mailbox of a counterparty that today is escaping from a real validation and creating troubles with abuse emails to someone else.
Please do not speak for a LIR's abuse contact here. These are (usually) good guys that have too much work and too little time to actually *work on fixing abuse in their network*. Your proposal steals life time from these guys, while not helping at all with folks that just ignore mails sent to their (working and verified!) abuse mail address. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Abuse mailboxes are already checked. What matters for abuse management is whether reports are acted on. This policy doesn't address that.
If the RIPE NCC is instructed to send 6-monthly reminders to all abuse contacts with the implicit threat that if they aren't acted on in the way specified in this policy, that the organisation in question can look forward to having their addressing resources vapourised, this will aggravate the RIPE NCC membership and corrode community trust in the organisation. The one thing it won't do is make abuse management better.
Internet abuse management is not something that you're going to fix by beating LIRs with sticks, and if they don't react, that you threaten to beat them harder.
Separate to this, it's inappropriate to micromanage the NCC in RIPE policy. It would be good if the RIPE working groups stopped trying to tell the RIPE NCC people how to do their jobs.
spot on, sad to say. randy
Hi Agree with this policy, all management and membership need more tight policies. The relation from Ripe with everyone it's to loosy, my vote to every rule that bring more responsibility to members. Like in every country any region, rules are important to avoid abuses. Exist lots of organizations that abuse because the lack of policies, rules and consequences. -----Original Message----- From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Nick Hilliard Sent: Thursday, May 16, 2019 22:39 PM To: Gert Doering <gert@space.net> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") Gert Doering wrote on 16/05/2019 21:47:
No positive effect, but lots of negative side-effects.
Abuse mailboxes are already checked. What matters for abuse management is whether reports are acted on. This policy doesn't address that. If the RIPE NCC is instructed to send 6-monthly reminders to all abuse contacts with the implicit threat that if they aren't acted on in the way specified in this policy, that the organisation in question can look forward to having their addressing resources vapourised, this will aggravate the RIPE NCC membership and corrode community trust in the organisation. The one thing it won't do is make abuse management better. Internet abuse management is not something that you're going to fix by beating LIRs with sticks, and if they don't react, that you threaten to beat them harder. Separate to this, it's inappropriate to micromanage the NCC in RIPE policy. It would be good if the RIPE working groups stopped trying to tell the RIPE NCC people how to do their jobs. Nick
Peace, On Thu, May 16, 2019 at 3:21 PM Marco Schmidt <mschmidt@ripe.net> wrote:
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
I support the proposal. Assuming the implementation by NCC would be carried out in a way when verification emails won't land in our abuse mailbox more frequently than ordinary proper abuse reports do (which is approximately a couple times in a quarter), I don't see how it can add any significant complexity to the way we handle those requests now. OTOH some benefits of the proposal could possibly be observed. -- Töma
* Marco Schmidt <mschmidt@ripe.net> [2019-05-16 14:21]:
Dear colleagues,
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
I oppose this proposal. We are doing a lot of work already to provide valid and helpful contact information and even now I'm already annoyed as hell about the current validation method. I'm getting mails with subjects like: SECOND REMINDER - ACTION REQUIRED: Confirm Abuse Contact Information for your End Users' IP Resources Apparently because "There was a transient network fault on the path to the mail server.". When I asked the RIPE NCC what that means and what we should do about it I got told that I should do nothing and that I should not contact them about single addresses being validated. So I get mails every week with increasing CAPS RATE and being told I should do nothing about it. I'm already on the brink of just filtering all mails with "ACTION REQUIRED" from the RIPE NCC. So no, any proposal that causes even more time and effort on our end will probably have a converse effect to what this proposal is going to achieve. Validating abuse mailboxes will not make the bad guys go away. Regards Sebastian -- GPG Key: 0x58A2D94A93A0B9CE (F4F6 B1A3 866B 26E9 450A 9D82 58A2 D94A 93A0 B9CE) 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE. -- Terry Pratchett, The Fifth Elephant
On Thu, May 16, 2019 at 02:20:46PM +0200, Marco Schmidt wrote:
https://www.ripe.net/participate/policies/proposals/2019-04
As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer.
I have a hard time understanding what _policy_ this text actually proposes. It goes into significant detail describing a compliance evaluation process. If that's policy, it is inappropriate to defer changes to the RIPE NCC. If that's not policy, the PDP is the wrong tool. It remains unclear what actual problem should be addressed by the text and why six month intervals would mitigate any such problem better than the current procedure. The text remains unclear who the actual addressees of the policy are.
5.0 Escalation to the RIPE NCC
Fraudulent behaviour (for example, an "abuse-mailbox" that only replies to the RIPE NCC's emails or to messages with a specific subject or content), or failure to comply with the remaining aspects of this policy (incorrect or lack of response to cases of abuse) can be reported to the RIPE NCC for a re-validation as per section 4.0.
It is only here, very much in passing, that the text expresses an expectation regarding responses to messages sent to "abuse-mailbox" from third parties, again without being explicit. That said, I do not believe the RIPE community is in a position to define how network operators run their networks and even less so in a position to make any such definition enforcable through the NCC. On a broader scale, I am tired of the repeated attempts to re-purpose the registry database slice by slice. We can have _that_ debate, but neither is the PDP the right instrument for this, nor is this WG the appropriate venue. And just that nobody claims a doubt: I am opposed to 2019-04. -Peter
Hi All, I'm not sure about the 6 month period (vs. 12 months), and probably some details can be improved in further versions, but i do support this proposal, which is clearly in the path of "anti-abuse". My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%. Maybe when we start to send out (automated) abuse reports about spam, the percentage will increase. We also send messages, globally, so solving the issue only in RIPEland will have limited impact. I've read this is already under implementation in another region, and proposed in the remaining 3 -- great! I also think some reference to the ARC (Assisted Registry Check) could be included in the proposal, and could work as a primary step well before going into other actions which can carry more impact. Regards, Carlos On Thu, 16 May 2019, Marco Schmidt wrote:
Dear colleagues,
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04
As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer.
At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal.
We encourage you to review this proposal and send your comments to <anti-abuse-wg@ripe.net> before 14 June 2019.
Kind regards,
Marco Schmidt Policy Officer RIPE NCC
Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum
Hi, On Fri, May 17, 2019 at 09:41:24AM +0100, Carlos Friaças via anti-abuse-wg wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
But this means the existing efforts from the RIPE NCC are showing an effect, and we do *NOT NEED* a new policy with lots of extra complications. We do have abuse-mailbox verification, and we do have ARCs. Why do we need more process? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
On Fri, 17 May 2019, Gert Doering wrote:
Hi,
On Fri, May 17, 2019 at 09:41:24AM +0100, Carlos Friaças via anti-abuse-wg wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
But this means the existing efforts from the RIPE NCC are showing an effect, and we do *NOT NEED* a new policy with lots of extra complications.
We do have abuse-mailbox verification, and we do have ARCs.
Why do we need more process?
Hi, We might not need more processes, but hopefully improved processes :-) Carlos
Gert Doering -- NetMaster -- have you enabled IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi, On Fri, May 17, 2019 at 11:43:46AM +0100, Carlos Friaças wrote:
On Fri, May 17, 2019 at 09:41:24AM +0100, Carlos Friaças via anti-abuse-wg wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
But this means the existing efforts from the RIPE NCC are showing an effect, and we do *NOT NEED* a new policy with lots of extra complications.
We do have abuse-mailbox verification, and we do have ARCs.
Why do we need more process?
We might not need more processes, but hopefully improved processes :-)
There is no indication that the complications Jordi is proposing are an actual improvement in any metric, except "human life time wasted". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
On Fri, 17 May 2019, Gert Doering wrote: (...)
Why do we need more process?
We might not need more processes, but hopefully improved processes :-)
There is no indication that the complications Jordi is proposing are an actual improvement in any metric, except "human life time wasted".
Hi, Starting with "complications" is really not that constructive. If the process is too complex let's work on it, and make it simpler where it is possible. Trying to build a softer approach, maybe the NCC doesn't need to send _everyone_ a message twice a year, but if someone finds an abuse-mailbox to be unresponsive, then if it is mandatory to have a working contact/mailbox, the NCC could only get into the picture when someone detects that is not in place. Or is _that_ already in place...? Regards, Carlos
Gert Doering -- NetMaster -- have you enabled IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi, On Sat, May 18, 2019 at 12:02:48AM +0100, Carlos Friaças wrote:
There is no indication that the complications Jordi is proposing are an actual improvement in any metric, except "human life time wasted".
Starting with "complications" is really not that constructive.
If the process is too complex let's work on it, and make it simpler where it is possible.
We have an existing process that is the result of a PDP discussed in this very working group, reflecting community consensus on the balance between checking and annoyance. Nobody has made a convincing argument why this needs to be made stricter and more time consuming.
Trying to build a softer approach, maybe the NCC doesn't need to send _everyone_ a message twice a year, but if someone finds an abuse-mailbox to be unresponsive, then if it is mandatory to have a working contact/mailbox, the NCC could only get into the picture when someone detects that is not in place.
Or is _that_ already in place...?
We *HAVE* a process to check abuse contacts. We *HAVE* ARCs. So, please state *first* what is wrong or insufficient with the current process, and why these added complications would improve the end goal: abuse reports sent to ISPs are handled "better" (in a to-be-defined metric). Note: taking away lifetime from the people doing abuse mail handling is not going to make them more enthusiastic about doing their job. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
El 18/5/19 9:56, "anti-abuse-wg en nombre de Gert Doering" <anti-abuse-wg-bounces@ripe.net en nombre de gert@space.net> escribió: Hi, On Sat, May 18, 2019 at 12:02:48AM +0100, Carlos Friaças wrote: > > There is no indication that the complications Jordi is proposing are > > an actual improvement in any metric, except "human life time wasted". > > Starting with "complications" is really not that constructive. > > If the process is too complex let's work on it, and make it simpler where > it is possible. We have an existing process that is the result of a PDP discussed in this very working group, reflecting community consensus on the balance between checking and annoyance. Nobody has made a convincing argument why this needs to be made stricter and more time consuming. > Trying to build a softer approach, maybe the NCC doesn't need to send > _everyone_ a message twice a year, but if someone finds an abuse-mailbox > to be unresponsive, then if it is mandatory to have a working > contact/mailbox, the NCC could only get into the picture when someone > detects that is not in place. > > Or is _that_ already in place...? We *HAVE* a process to check abuse contacts. We *HAVE* ARCs. So, please state *first* what is wrong or insufficient with the current process, and why these added complications would improve the end goal: abuse reports sent to ISPs are handled "better" (in a to-be-defined metric). A process that allows to use emails from other random people is not a *real validation* it looks closer to a joke. Note: taking away lifetime from the people doing abuse mail handling is not going to make them more enthusiastic about doing their job. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, On Sat, May 18, 2019 at 10:28:45AM +0200, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
So, please state *first* what is wrong or insufficient with the current process, and why these added complications would improve the end goal: abuse reports sent to ISPs are handled "better" (in a to-be-defined metric).
A process that allows to use emails from other random people is not a *real validation* it looks closer to a joke.
If the NCC's existing abuse mail validation mails hit other people's mailboxes, those can report back, and the NCC will surely follow up with the LIR that did this incorrect entry. I have an idea. I will set up a service where everyone can have an e-mail address which will totally follow everything you propose as validation mechanism - like, click on tokes, report back in 10 minutes (even in the middle of the night), etc. - LIRs that want to be spared this annoyance can just pay me 50 EUR/month, and I'll handle all these chores for them. So, this would totally fulfill your proposed policy, and not help in any bit with *abuse handling*. Can you now see why your proposal is useless in achieving it (not very clearly stated) goal? And if something is not useful towards the goal, but has lots of drawbacks, it should not be followed. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
El 18/5/19 10:35, "Gert Doering" <gert@space.net> escribió: Hi, On Sat, May 18, 2019 at 10:28:45AM +0200, JORDI PALET MARTINEZ via anti-abuse-wg wrote: > So, please state *first* what is wrong or insufficient with the current > process, and why these added complications would improve the end goal: > abuse reports sent to ISPs are handled "better" (in a to-be-defined > metric). > > A process that allows to use emails from other random people is not a *real validation* it looks closer to a joke. If the NCC's existing abuse mail validation mails hit other people's mailboxes, those can report back, and the NCC will surely follow up with the LIR that did this incorrect entry. I have an idea. I will set up a service where everyone can have an e-mail address which will totally follow everything you propose as validation mechanism - like, click on tokes, report back in 10 minutes (even in the middle of the night), etc. - LIRs that want to be spared this annoyance can just pay me 50 EUR/month, and I'll handle all these chores for them. So, this would totally fulfill your proposed policy, and not help in any bit with *abuse handling*. That automated system will be against the policy. I've already worded it out in such way that is not possible this type of "work-around the policy", at least it was my original intent to avoid it. If I've broken something across more than 20 versions that I edited internally since started, I will make sure to fix it in the next version. Can you now see why your proposal is useless in achieving it (not very clearly stated) goal? And if something is not useful towards the goal, but has lots of drawbacks, it should not be followed. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
On 18 May 2019, at 9:38, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
El 18/5/19 10:35, "Gert Doering" <gert@space.net> escribió:
I have an idea.
I will set up a service where everyone can have an e-mail address which will totally follow everything you propose as validation mechanism - like, click on tokes, report back in 10 minutes (even in the middle of the night), etc. - LIRs that want to be spared this annoyance can just pay me 50 EUR/month, and I'll handle all these chores for them.
So, this would totally fulfill your proposed policy, and not help in any bit with *abuse handling*.
That automated system will be against the policy. I've already worded it out in such way that is not possible this type of "work-around the policy", at least it was my original intent to avoid it.
I wonder how words can make anything impossible. I also wonder how to implement a dependable Turing Test for distinguishing between what Gert suggests ( a kind of "Mechanical Turk") and a real human. Just saying. Niall
El 18/5/19 18:49, "anti-abuse-wg en nombre de Niall O'Reilly" <anti-abuse-wg-bounces@ripe.net en nombre de niall.oreilly@ucd.ie> escribió: On 18 May 2019, at 9:38, JORDI PALET MARTINEZ via anti-abuse-wg wrote: > El 18/5/19 10:35, "Gert Doering" <gert@space.net> escribió: > > I have an idea. > > I will set up a service where everyone can have an e-mail address > which > will totally follow everything you propose as validation mechanism > - like, > click on tokes, report back in 10 minutes (even in the middle of > the > night), etc. - LIRs that want to be spared this annoyance can just > pay > me 50 EUR/month, and I'll handle all these chores for them. > > So, this would totally fulfill your proposed policy, and not help > in any > bit with *abuse handling*. > > That automated system will be against the policy. I've already worded > it out in such way that is not possible this type of "work-around the > policy", at least it was my original intent to avoid it. I wonder how words can make anything impossible. I also wonder how to implement a dependable Turing Test for distinguishing between what Gert suggests ( a kind of "Mechanical Turk") and a real human. Obviously all what we have in our policies is not bullet proof (and you could fake almost every rule that we have), but that doesn't mean that if you don't follow policies and it is discovered you're not violating them. Same in law. Nobody is looking that you follow law at 100%, but if you don't do, is your own decision and may have consequences. I said this already several times. Don't having agreed reasonable rules that need to be followed will be like not need for having RIRs and being in the wild-west. Just saying. Niall ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, On Sat, May 18, 2019 at 10:38:46AM +0200, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
I have an idea.
I will set up a service where everyone can have an e-mail address which will totally follow everything you propose as validation mechanism - like, click on tokes, report back in 10 minutes (even in the middle of the night), etc. - LIRs that want to be spared this annoyance can just pay me 50 EUR/month, and I'll handle all these chores for them.
So, this would totally fulfill your proposed policy, and not help in any bit with *abuse handling*.
That automated system will be against the policy. I've already worded it out in such way that is not possible this type of "work-around the policy", at least it was my original intent to avoid it. If I've broken something across more than 20 versions that I edited internally since started, I will make sure to fix it in the next version.
Who said that this is automated? If enough LIRs give me 50 EUR/month, I can hire a few students who will sit there all day waiting for confirmation requests and dutifully do (as humans) what they are expected to do. You do not seem to be willing to listen: what you propose is sheer and uncalled-for extra annoyance for the vast majority of LIRs, and will do *nothing* to improve abuse handling. All it will do is ensure that someone wastes a few minutes of human lifetime on your challenge. And *that* can be nicely outsourced. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi Gert, I'm fine if it is outsourced to comply with the policy, of course, but not to circumvent it. I think any way to comply with policies is just fine if acting in good faith. Regards, Jordi El 18/5/19 19:03, "Gert Doering" <gert@space.net> escribió: Hi, On Sat, May 18, 2019 at 10:38:46AM +0200, JORDI PALET MARTINEZ via anti-abuse-wg wrote: > I have an idea. > > I will set up a service where everyone can have an e-mail address which > will totally follow everything you propose as validation mechanism - like, > click on tokes, report back in 10 minutes (even in the middle of the > night), etc. - LIRs that want to be spared this annoyance can just pay > me 50 EUR/month, and I'll handle all these chores for them. > > So, this would totally fulfill your proposed policy, and not help in any > bit with *abuse handling*. > > That automated system will be against the policy. I've already > worded it out in such way that is not possible this type of > "work-around the policy", at least it was my original intent to > avoid it. If I've broken something across more than 20 versions > that I edited internally since started, I will make sure to fix it > in the next version. Who said that this is automated? If enough LIRs give me 50 EUR/month, I can hire a few students who will sit there all day waiting for confirmation requests and dutifully do (as humans) what they are expected to do. You do not seem to be willing to listen: what you propose is sheer and uncalled-for extra annoyance for the vast majority of LIRs, and will do *nothing* to improve abuse handling. All it will do is ensure that someone wastes a few minutes of human lifetime on your challenge. And *that* can be nicely outsourced. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, you cannot know if someone complies with the policy in good faith or not. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi Gert, El 21/5/19 14:37, "Gert Doering" <gert@space.net> escribió: Hi, you cannot know if someone complies with the policy in good faith or not. And this is exactly the same for any other policies that we have adopted, and that doesn't preclude us to adopt them, because in any membership organization, we presume good faith from members? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, the whole point of your policy is the underlying assumption that people are *not* acting in good faith, so why all of a sudden assume they are? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
El 21/5/19 15:32, "Gert Doering" <gert@space.net> escribió: Hi, the whole point of your policy is the underlying assumption that people are *not* acting in good faith, so why all of a sudden assume they are? Is in the other way around. If you're acting in good faith, you should not have a problem to have a validation. The time you invest in a couple of validations per year, will be *much less* than the time that you *now* invest in unusable abuse contacts. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Any abuse / acceptable use policy presupposes that while the vast majority of your users are legitimate a non trivial percentage of them are bad actors who need to be dealt with appropriately. Making that call on which customer to apply which policy on is something any abuse desk does literally all the time. For the rest of this predictable and recurring discussion there's always the past 25+ years of news.admin.net-abuse.email once you have filtered out the flame wars, pun cascades, cat stories and such. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> Sent: Tuesday, May 21, 2019 9:06 PM To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") El 21/5/19 15:32, "Gert Doering" <gert@space.net> escribió: Hi, the whole point of your policy is the underlying assumption that people are *not* acting in good faith, so why all of a sudden assume they are? Is in the other way around. If you're acting in good faith, you should not have a problem to have a validation. The time you invest in a couple of validations per year, will be *much less* than the time that you *now* invest in unusable abuse contacts. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, indeed, and this is why we should just not go there. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Abuse desks don't have the option not to. The usual responses to their using these reasons not to act involve blocking and null routing. Some ccTLD managers figured that out too, the hard way - hkdnr for the hk cctld sometime in like 2008 when they ended up with more botnet cc and spam domains than legitimate ones and only reacted after extensive blocking and media attention began to kick in. I remember but can't find a preso from Bonnie Chun of hkdnr at an apwg cecos event around then. --srs ________________________________ From: Gert Doering <gert@space.net> Sent: Tuesday, May 21, 2019 9:37 PM To: Suresh Ramasubramanian Cc: JORDI PALET MARTINEZ; anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") Hi, indeed, and this is why we should just not go there. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi, you are comparing the claimed cost savings on the side of the reporters with the very real extra costs incurred on the side of the abuse handlers. You can't do that, and come up with a positive result. (Well, you can, but that approach is very one-side and flawed at that) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi Gert, El 21/5/19 16:07, "Gert Doering" <gert@space.net> escribió: Hi, you are comparing the claimed cost savings on the side of the reporters with the very real extra costs incurred on the side of the abuse handlers. You can't do that, and come up with a positive result. The cost of TWO human validations per year, is negligible compared with the cost of TWO manual processes to report abuses when the abuse contact is not valid. (Well, you can, but that approach is very one-side and flawed at that) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, it's nice how you can decide on your own how the (very real) extra costs incurred to *15.000+* LIR abuse desks plus the RIPE NCC are "negilible", claiming that the (unfounded) saving on the costs on the side of abuse reporters would outweigh that. Please back with actual numbers. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
If a single spammer (for example), once in the year, sends 50.000 spams messages (with is a ridiculous number in a single campaign, and we know that there are thousands of them every year), the cost for all the *15.000+* LIRs abuse desks is already compensated vs the cost of the TWO-yearly validations. Note that the proposal is not telling that you must do a manual validation, only that even if you have your abuse-desk automated, you should make sure that after all the automation, if something can't be handled by the automated process, it should go to a human. El 21/5/19 16:20, "Gert Doering" <gert@space.net> escribió: Hi, it's nice how you can decide on your own how the (very real) extra costs incurred to *15.000+* LIR abuse desks plus the RIPE NCC are "negilible", claiming that the (unfounded) saving on the costs on the side of abuse reporters would outweigh that. Please back with actual numbers. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, your math is fundamentally flawed, and this is the last comment I'll do on that matter. You cannot balance costs put on the shoulder of 15.000 people with costs caused by a customer of *one* of them, and come out with a net profit. @chairs: I'll repeat the counter arguments if this should hit review phase (since it's the proposer's decision, this is to be expected), and I consider them to be not sufficiently addressed yet. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
On May 21, 2019, at 18:35, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
El 21/5/19 15:32, "Gert Doering" <gert@space.net> escribió:
Hi,
the whole point of your policy is the underlying assumption that people are *not* acting in good faith, so why all of a sudden assume they are?
Is in the other way around. If you're acting in good faith, you should not have a problem to have a validation. The time you invest in a couple of validations per year, will be *much less* than the time that you *now* invest in unusable abuse contacts.
If you're acting in good faith you do not need the validation. So other people do not need to validate your abuse contact. It just works. If you're acting in bad faith then additional validation will not change your behavior. You just check your mailbox to reply to the validation. Nothing more. But the people who are acting in good faith will have additional headache to not miss the validation to make all good.
Gert Doering -- NetMaster -- have you enabled IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company
This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
-- Best regards Taras Heichenko tasic@hostmaster.ua
Hi Tarass, El 21/5/19 16:18, "Taras Heichenko" <tasic@hostmaster.ua> escribió: > On May 21, 2019, at 18:35, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote: > > > > El 21/5/19 15:32, "Gert Doering" <gert@space.net> escribió: > > Hi, > > the whole point of your policy is the underlying assumption that people > are *not* acting in good faith, so why all of a sudden assume they are? > > Is in the other way around. If you're acting in good faith, you should not have a problem to have a validation. The time you invest in a couple of validations per year, will be *much less* than the time that you *now* invest in unusable abuse contacts. If you're acting in good faith you do not need the validation. So other people do not need to validate your abuse contact. It just works. If you're acting in bad faith then additional validation will not change your behavior. You just check your ---->>> Right, but those folks *then* are violating the policy. mailbox to reply to the validation. Nothing more. But the people who are acting in good faith will have additional headache to not miss the validation to make all good. > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 > > > > > ********************************************** > IPv4 is over > Are you ready for the new Internet ? > http://www.theipv6company.com > The IPv6 Company > > This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it. > > > > > -- Best regards Taras Heichenko tasic@hostmaster.ua ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Jordi, On Tue, May 21, 2019 at 04:31:24PM +0000, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
If you're acting in good faith you do not need the validation. So other people do not need to validate your abuse contact. It just works. If you're acting in bad faith then additional validation will not change your behavior. You just check your
---->>> Right, but those folks *then* are violating the policy.
the proposal does describe a compliance measurement. Gert's example is serving that by the letter and you claim "policy" is violated that way. Where exactly is the "policy" written down in 2019-04? -Peter
On May 21, 2019, at 19:31, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Hi Tarass,
El 21/5/19 16:18, "Taras Heichenko" <tasic@hostmaster.ua> escribió:
On May 21, 2019, at 18:35, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
El 21/5/19 15:32, "Gert Doering" <gert@space.net> escribió:
Hi,
the whole point of your policy is the underlying assumption that people are *not* acting in good faith, so why all of a sudden assume they are?
Is in the other way around. If you're acting in good faith, you should not have a problem to have a validation. The time you invest in a couple of validations per year, will be *much less* than the time that you *now* invest in unusable abuse contacts.
If you're acting in good faith you do not need the validation. So other people do not need to validate your abuse contact. It just works. If you're acting in bad faith then additional validation will not change your behavior. You just check your
---->>> Right, but those folks *then* are violating the policy.
They are _already_ acting in bad faith. Do you really think that it is reason for them to go to the good path? Do you have any way to prove that they are violating policy when you look at the address outside of the abuse mailbox owner, from RIPE NCC point of view?
mailbox to reply to the validation. Nothing more. But the people who are acting in good faith will have additional headache to not miss the validation to make all good.
Gert Doering -- NetMaster -- have you enabled IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company
This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
-- Best regards
Taras Heichenko tasic@hostmaster.ua
********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company
This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
-- Best regards Taras Heichenko tasic@hostmaster.ua
On 21 May 2019, at 16:35, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
The time you invest in a couple of validations per year, will be *much less* than the time that you *now* invest in unusable abuse contacts.
It's not because I correct my abuse contacts that I can even hope save time as you suggest. The putative benefits aren't aligned with the effort. L'Enfer, c'est les autres. /N
A case can be made that lax "not the internet police" policies that earlier allowed a single shady LIR to get multiple /14s and now, as per Furio, allows serial registration of bogus LIRs to gather up IP space is actually making abuse and security teams worldwide expend rather more man hours than they would spend in a lifetime of engaging in this sort of occasional compliance. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg@ripe.net> Sent: Saturday, May 18, 2019 1:59 PM To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") El 18/5/19 9:56, "anti-abuse-wg en nombre de Gert Doering" <anti-abuse-wg-bounces@ripe.net en nombre de gert@space.net> escribió: Hi, On Sat, May 18, 2019 at 12:02:48AM +0100, Carlos Friaças wrote:
There is no indication that the complications Jordi is proposing are an actual improvement in any metric, except "human life time wasted".
Starting with "complications" is really not that constructive.
If the process is too complex let's work on it, and make it simpler where it is possible.
We have an existing process that is the result of a PDP discussed in this very working group, reflecting community consensus on the balance between checking and annoyance. Nobody has made a convincing argument why this needs to be made stricter and more time consuming.
Trying to build a softer approach, maybe the NCC doesn't need to send _everyone_ a message twice a year, but if someone finds an abuse-mailbox to be unresponsive, then if it is mandatory to have a working contact/mailbox, the NCC could only get into the picture when someone detects that is not in place.
Or is _that_ already in place...?
We *HAVE* a process to check abuse contacts. We *HAVE* ARCs. So, please state *first* what is wrong or insufficient with the current process, and why these added complications would improve the end goal: abuse reports sent to ISPs are handled "better" (in a to-be-defined metric). A process that allows to use emails from other random people is not a *real validation* it looks closer to a joke. Note: taking away lifetime from the people doing abuse mail handling is not going to make them more enthusiastic about doing their job. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, On Sat, May 18, 2019 at 08:47:28AM +0000, Suresh Ramasubramanian wrote:
A case can be made that lax "not the internet police" policies that earlier allowed a single shady LIR to get multiple /14s and now, as per Furio, allows serial registration of bogus LIRs to gather up IP space is actually making abuse and security teams worldwide expend rather more man hours than they would spend in a lifetime of engaging in this sort of occasional compliance.
You, again, fail to even *try* to make an argument on why this sort of extra process would help in the least with the case you bring forward. If someone is fraudulently heaping up LIRs but has a nicely responsive abuse desk (and individual mails for each LIR) - how is "have all the other LIRs do more work" going to help in this case? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
On May 17, 2019, at 11:41, Carlos Friaças via anti-abuse-wg <anti-abuse-wg@ripe.net> wrote:
Hi All,
Hi all,
I'm not sure about the 6 month period (vs. 12 months), and probably some details can be improved in further versions, but i do support this proposal, which is clearly in the path of "anti-abuse".
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
Did you calculate percentage of deliberate reactions to your abuse reports? What is main purpose to deliver letter without problem or to get deliberate reaction to it?
Maybe when we start to send out (automated) abuse reports about spam, the percentage will increase. We also send messages, globally, so solving the issue only in RIPEland will have limited impact. I've read this is already under implementation in another region, and proposed in the remaining 3 -- great!
I also think some reference to the ARC (Assisted Registry Check) could be included in the proposal, and could work as a primary step well before going into other actions which can carry more impact.
Regards, Carlos
On Thu, 16 May 2019, Marco Schmidt wrote:
Dear colleagues,
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04
As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer.
At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal.
We encourage you to review this proposal and send your comments to <anti-abuse-wg@ripe.net> before 14 June 2019.
Kind regards,
Marco Schmidt Policy Officer RIPE NCC
Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum
-- Best regards Taras Heichenko tasic@hostmaster.ua
On Fri, 17 May 2019, Taras Heichenko wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
Did you calculate percentage of deliberate reactions to your abuse reports?
No, not yet.
What is main purpose to deliver letter without problem or to get deliberate reaction to it?
We assume some of the nasty stuff we see comes from infected devices. If legitimate owners care to desinfect, it's possible we will receive less events... i.e. everyone should be sending out more notices. Some people are really thankful when they receive a notice and they understand they have something to fix. :-) Carlos
We belong to this group: " Some people are really thankful when they receive a notice and they understand they have something to fix. :-)" And we would be more happy if we have sure that all the abuse contacts are real, at least in RIPE region. Sérgio Rocha -----Original Message----- From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Carlos Friaças via anti-abuse-wg Sent: Friday, May 17, 2019 23:52 PM To: Taras Heichenko <tasic@hostmaster.ua> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") On Fri, 17 May 2019, Taras Heichenko wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
Did you calculate percentage of deliberate reactions to your abuse reports?
No, not yet.
What is main purpose to deliver letter without problem or to get deliberate reaction to it?
We assume some of the nasty stuff we see comes from infected devices. If legitimate owners care to desinfect, it's possible we will receive less events... i.e. everyone should be sending out more notices. Some people are really thankful when they receive a notice and they understand they have something to fix. :-) Carlos
On Sat, 18 May 2019, Sérgio Rocha wrote:
We belong to this group: " Some people are really thankful when they receive a notice and they understand they have something to fix. :-)" And we would be more happy if we have sure that all the abuse contacts are real, at least in RIPE region.
About the "at least in RIPE region", there is text on 2019-04 about that: ===== c. Alignment with other RIRs: A similar proposal has been accepted in APNIC (being implemented) and is under discussion in the LACNIC, AFRINIC and ARIN regions. ===== i.e. 1 region on track, 4 still to go (RIPE included here). Cheers, Carlos
Sérgio Rocha
-----Original Message----- From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Carlos Friaças via anti-abuse-wg Sent: Friday, May 17, 2019 23:52 PM To: Taras Heichenko <tasic@hostmaster.ua> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox")
On Fri, 17 May 2019, Taras Heichenko wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
Did you calculate percentage of deliberate reactions to your abuse reports?
No, not yet.
What is main purpose to deliver letter without problem or to get deliberate reaction to it?
We assume some of the nasty stuff we see comes from infected devices. If legitimate owners care to desinfect, it's possible we will receive less events... i.e. everyone should be sending out more notices. Some people are really thankful when they receive a notice and they understand they have something to fix. :-)
Carlos
===== c. Alignment with other RIRs: A similar proposal has been accepted in APNIC (being implemented) and is under discussion in the LACNIC, AFRINIC and ARIN regions. =====
i.e. 1 region on track, 4 still to go (RIPE included here).
So it looks that this proposal it's not so avant-garde, since the other regions are having the same needs and one of them already include this policy -----Original Message----- From: Carlos Friaças [mailto:cfriacas@fccn.pt] Sent: Saturday, May 18, 2019 0:06 AM To: Sérgio Rocha <sergio.rocha@makeitsimple.pt> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") On Sat, 18 May 2019, S�rgio Rocha wrote:
We belong to this group: " Some people are really thankful when they receive a notice and they understand they have something to fix. :-)" And we would be more happy if we have sure that all the abuse contacts are real, at least in RIPE region.
About the "at least in RIPE region", there is text on 2019-04 about that: ===== c. Alignment with other RIRs: A similar proposal has been accepted in APNIC (being implemented) and is under discussion in the LACNIC, AFRINIC and ARIN regions. ===== i.e. 1 region on track, 4 still to go (RIPE included here). Cheers, Carlos
S�rgio Rocha
-----Original Message----- From: anti-abuse-wg [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of Carlos Fria�as via anti-abuse-wg Sent: Friday, May 17, 2019 23:52 PM To: Taras Heichenko <tasic@hostmaster.ua> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox")
On Fri, 17 May 2019, Taras Heichenko wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
Did you calculate percentage of deliberate reactions to your abuse reports?
No, not yet.
What is main purpose to deliver letter without problem or to get deliberate reaction to it?
We assume some of the nasty stuff we see comes from infected devices. If legitimate owners care to desinfect, it's possible we will receive less events... i.e. everyone should be sending out more notices. Some people are really thankful when they receive a notice and they understand they have something to fix. :-)
Carlos
On Sat, May 18, 2019 at 12:37:07AM +0100, Sérgio Rocha wrote:
i.e. 1 region on track, 4 still to go (RIPE included here).
So it looks that this proposal it's not so avant-garde, since the other regions are having the same needs and one of them already include this policy
The fact that the authori has proposed the same idea in all regions doesn't mean that "other regions are having the same needs". Piotr -- Piotr Strzyżewski Silesian University of Technology, Computer Centre Gliwice, Poland
There are only one internet, the abuse problem its worldwide, the challenges for better management are the same, that's why all region are looking for the similar responses for the same problems. I support this proposals and other that give more capacity for RIPE deal with abuses. Sérgio Rocha -----Original Message----- From: Piotr Strzyzewski [mailto:Piotr.Strzyzewski@polsl.pl] Sent: Wednesday, May 22, 2019 18:32 PM To: Sérgio Rocha <sergio.rocha@makeitsimple.pt> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") On Sat, May 18, 2019 at 12:37:07AM +0100, Sérgio Rocha wrote:
i.e. 1 region on track, 4 still to go (RIPE included here).
So it looks that this proposal it's not so avant-garde, since the other regions are having the same needs and one of them already include this policy
The fact that the authori has proposed the same idea in all regions doesn't mean that "other regions are having the same needs". Piotr -- Piotr Strzyżewski Silesian University of Technology, Computer Centre Gliwice, Poland
Hi, On Wed, May 22, 2019 at 06:40:28PM +0100, Sérgio Rocha wrote:
There are only one internet, the abuse problem its worldwide, the challenges for better management are the same, that's why all region are looking for the similar responses for the same problems. I support this proposals and other that give more capacity for RIPE deal with abuses.
This proposal takes *away* resources from people that actually deal with abuse cases. Now they would have to deal with clicking on response forms and filling in tokens, instead of handling actual abuse complaints. Folks, the process we have in the RIPE region for abuse contact validation is the result of a *consensus based process* that happend *in this working group*. Before you all argue for "we need to have more paperwork!" please take a step back and explain a) what is wrong with the current validation process, and b) why this proposal would improve this. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
On 22 May 2019, at 22:38, Gert Doering <gert@space.net> wrote:
Before you all argue for "we need to have more paperwork!" please take a step back and explain a) what is wrong with the current validation process, and b) why this proposal would improve this.
What Gert said - at the very least these need to be answered before this policy can gain consensus. I oppose the policy as written and proposed. Thanks f
As do I -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 23/05/2019, 01:10, "anti-abuse-wg on behalf of Fearghas McKay" <anti-abuse-wg-bounces@ripe.net on behalf of fearghas@gmail.com> wrote: > On 22 May 2019, at 22:38, Gert Doering <gert@space.net> wrote: > > Before you all argue for "we need to have more paperwork!" please take > a step back and explain a) what is wrong with the current validation > process, and b) why this proposal would improve this. What Gert said - at the very least these need to be answered before this policy can gain consensus. I oppose the policy as written and proposed. Thanks f
On Thu, 23 May 2019 00:38:00 +0200 Gert Doering <gert@space.net> wrote:
On Wed, May 22, 2019 at 06:40:28PM +0100, Sérgio Rocha wrote:
There are only one internet, the abuse problem its worldwide, the challenges for better management are the same, that's why all region are looking for the similar responses for the same problems. I support this proposals and other that give more capacity for RIPE deal with abuses.
+1
This proposal takes *away* resources from people that actually deal with abuse cases. Now they would have to deal with clicking on response forms and filling in tokens, instead of handling actual abuse complaints.
few minutes a year, very reasonable.
Folks, the process we have in the RIPE region for abuse contact validation is the result of a *consensus based process* that happend *in this working group*. Before you all argue for "we need to have more paperwork!" please take a step back and explain a) what is wrong with the current validation process, and b) why this proposal would improve this. Gert Doering -- NetMaster
because, IRL (in real life) things do not remain "static" we are all sitting on a spinning ball in the middle of nowhere and there is vast chaos out there on which we are trying to enforce patterns in order to create fake stability. basically, I am saying that, over time, things change. the whole point of having data is to have current, working and "real" data otherwise we may as well not even parse the email address format for abuse-c why not propose then just to remove the resource completely? your very forceful and multiple emails arguing very hard against and all your emails, attacking each and every +1 simply serves to illustrate that you really want to enforce your opinion on the group in this regard. So, again, I ask: Why not propose to remove the abuse contact resource completely? Is this where you are going with your very strong and continuing and ongoing objections? Andre
So I don't know about other regions not having the same needs. APNIC has adopted this for example. https://www.apnic.net/community/policy/proposals/prop-125 --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Sérgio Rocha <sergio.rocha@makeitsimple.pt> Sent: Wednesday, May 22, 2019 11:10 PM To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") There are only one internet, the abuse problem its worldwide, the challenges for better management are the same, that's why all region are looking for the similar responses for the same problems. I support this proposals and other that give more capacity for RIPE deal with abuses. Sérgio Rocha -----Original Message----- From: Piotr Strzyzewski [mailto:Piotr.Strzyzewski@polsl.pl] Sent: Wednesday, May 22, 2019 18:32 PM To: Sérgio Rocha <sergio.rocha@makeitsimple.pt> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") On Sat, May 18, 2019 at 12:37:07AM +0100, Sérgio Rocha wrote:
i.e. 1 region on track, 4 still to go (RIPE included here).
So it looks that this proposal it's not so avant-garde, since the other regions are having the same needs and one of them already include this policy
The fact that the authori has proposed the same idea in all regions doesn't mean that "other regions are having the same needs". Piotr -- Piotr Strzyżewski Silesian University of Technology, Computer Centre Gliwice, Poland
As for simple graylisting why use a even back then not terribly effective 2000s era technique at all? Also - waiting for a 5xx smtp return code is ideal when deciding that a validation test has failed. You could actually have an email problem that isn't of the shoot yourself in the foot by deploying unsuitable anti spam measures category and have to delay accepting mail. --srs ________________________________ From: Suresh Ramasubramanian <ops.lists@gmail.com> Sent: Thursday, May 23, 2019 4:18 AM To: Sérgio Rocha; anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") So I don't know about other regions not having the same needs. APNIC has adopted this for example. https://www.apnic.net/community/policy/proposals/prop-125 --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Sérgio Rocha <sergio.rocha@makeitsimple.pt> Sent: Wednesday, May 22, 2019 11:10 PM To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") There are only one internet, the abuse problem its worldwide, the challenges for better management are the same, that's why all region are looking for the similar responses for the same problems. I support this proposals and other that give more capacity for RIPE deal with abuses. Sérgio Rocha -----Original Message----- From: Piotr Strzyzewski [mailto:Piotr.Strzyzewski@polsl.pl] Sent: Wednesday, May 22, 2019 18:32 PM To: Sérgio Rocha <sergio.rocha@makeitsimple.pt> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") On Sat, May 18, 2019 at 12:37:07AM +0100, Sérgio Rocha wrote:
i.e. 1 region on track, 4 still to go (RIPE included here).
So it looks that this proposal it's not so avant-garde, since the other regions are having the same needs and one of them already include this policy
The fact that the authori has proposed the same idea in all regions doesn't mean that "other regions are having the same needs". Piotr -- Piotr Strzyżewski Silesian University of Technology, Computer Centre Gliwice, Poland
On May 18, 2019, at 01:52, Carlos Friaças <cfriacas@fccn.pt> wrote:
Hi!
On Fri, 17 May 2019, Taras Heichenko wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
Did you calculate percentage of deliberate reactions to your abuse reports?
No, not yet.
What is main purpose to deliver letter without problem or to get deliberate reaction to it?
We assume some of the nasty stuff we see comes from infected devices. If legitimate owners care to desinfect, it's possible we will receive less events... i.e. everyone should be sending out more notices. Some people are really thankful when they receive a notice and they understand they have something to fix. :-)
Yes, of course. I am also thankful if someone points me the problem that I have but don't see. But I wrote that you chose wrong criteria when you check the result.
Carlos
-- Best regards Taras Heichenko tasic@hostmaster.ua
El 17/5/19 10:41, "anti-abuse-wg en nombre de Carlos Friaças via anti-abuse-wg" <anti-abuse-wg-bounces@ripe.net en nombre de anti-abuse-wg@ripe.net> escribió: Hi All, I'm not sure about the 6 month period (vs. 12 months), and probably some details can be improved in further versions, but i do support this proposal, which is clearly in the path of "anti-abuse". My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%. I guess that means that it is increasing. 2.5% is only for 5 first months of this year, so it may end up in 2019 you have 5-6% ? I've looked at my own network and the situation is even worst. Major number of abuse reports for me are intrusion attempts, attempts to use our SIP and SPAM. In total, the average number of abuse reports per month is about 3.800 (99% are automated). Bounces increase from previous year, average, is 23%. Maybe when we start to send out (automated) abuse reports about spam, the percentage will increase. We also send messages, globally, so solving the issue only in RIPEland will have limited impact. I've read this is already under implementation in another region, and proposed in the remaining 3 -- great! I also think some reference to the ARC (Assisted Registry Check) could be included in the proposal, and could work as a primary step well before going into other actions which can carry more impact. Regards, Carlos On Thu, 16 May 2019, Marco Schmidt wrote: > Dear colleagues, > > A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion. > > This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders. > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2019-04 > > As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer. > > At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal. > > We encourage you to review this proposal and send your comments to <anti-abuse-wg@ripe.net> before 14 June 2019. > > Kind regards, > > Marco Schmidt > Policy Officer > RIPE NCC > > Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum > ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Hi, On Sat, May 18, 2019 at 10:43:11AM +0200, JORDI PALET MARTINEZ via anti-abuse-wg wrote:
My team has nearly sent out 6000 abuse reports (only about intrusion attempts and brute force attacks) since Jan 1st this year. I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%.
I guess that means that it is increasing. 2.5% is only for 5 first months of this year, so it may end up in 2019 you have 5-6% ?
Learn math. Percentages are not added up. Absolutes numbers are, but there is no indication why the *relative* number would be any different in the second half of 2019. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hi Gert, Yeah, I definitively should go to school, never went when I was a child. However, this is not a matter of math's, it is just a matter of responding too fast while sleeping only a couple of hours. Anyway, nobody knows how much will be the % at the end of the year, as this is not necessarily linear. Regards, Jordi El 18/5/19 19:07, "Gert Doering" <gert@space.net> escribió: Hi, On Sat, May 18, 2019 at 10:43:11AM +0200, JORDI PALET MARTINEZ via anti-abuse-wg wrote: > My team has nearly sent out 6000 abuse reports (only about intrusion > attempts and brute force attacks) since Jan 1st this year. > I've just checked, and only 2.5% bounced. 2018's bounces were around 4.5%. > > I guess that means that it is increasing. 2.5% is only for 5 first months of this year, so it may end up in 2019 you have 5-6% ? Learn math. Percentages are not added up. Absolutes numbers are, but there is no indication why the *relative* number would be any different in the second half of 2019. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
I think the proposed policy tightens things up well to markedly improve the chance of abuse reports being appropriately handled. As such I am in favour of 2019-04 and feel that a slightly more detailed but not too onerous process will mean less work for abuse handlers in the long run rather than leaving things as they are. Liam Glover National Cyber Crime Unit
On 16 May 2019, at 12:20, Marco Schmidt <mschmidt@ripe.net> wrote:
Dear colleagues,
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04
As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer.
At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal.
We encourage you to review this proposal and send your comments to <anti-abuse-wg@ripe.net> before 14 June 2019.
Kind regards,
Marco Schmidt Policy Officer RIPE NCC
Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum
This is a bad idea and should be abandoned. The goal is fine: everyone/everything should have a valid abuse@ address per RFC 2142, decades of best practices, and inherent accountability to the entire Internet community. Everybody should pay attention to what shows up there, conduct investigations, mitigate problems, report/apologize as necessary, and so on. I've been on the record for a long time supporting this goal and that hasn't changed. However: 1. Sending UBE to abuse mailboxes is bad. Think about it. 2. Expecting people to follow URLs contained in messages to abuse mailboxes is a horrible idea. Penalizing them for not doing it is worse. (Best practice for abuse handlers is to not use a mail client that parses HTML or a mail client with a GUI, for what I trust are obvious reasons.) 3. Whatever response mechanism is devised, it WILL be automated. I note the reference to "captchas" and suggest reading my recent comment on those in another recent thread here: briefly, they have long since been quite thoroughly beaten. They are worthless, and anyone using them or suggesting their use is woefully ignorant. 4. Knowing that abuse reports are accepted and read is nice, but not terribly useful. What matters is what's done with them, and that ranges from "investigated promptly and acted on decisively if they're shown to be accurate" to "ignored and discarded" to "forwarded to the abusers". And we (for a vague value of "we") already know this: we know because we've submitted abuse reports and observed outcomes for years. We know which operations never respond in any way and we know which ones hand data over to abusers (or *are* the abusers). We know this by practice and experience -- it's not something that can be automated. It takes time and effort and expertise to figure out. 5. This approach fails the "what if everybody did it?" test quite badly. 6. Of course, the moment something like this is deployed -- if not before -- bad actors will realize that copycatting it may well be an effective tactic to directly attack abuse desk operations and/or gather intelligence on them and/or compromise them. ---rsk
Hi Rich, El 21/5/19 9:31, "anti-abuse-wg en nombre de Rich Kulawiec" <anti-abuse-wg-bounces@ripe.net en nombre de rsk@gsp.org> escribió: This is a bad idea and should be abandoned. The goal is fine: everyone/everything should have a valid abuse@ address per RFC 2142, decades of best practices, and inherent accountability to the entire Internet community. Everybody should pay attention to what shows up there, conduct investigations, mitigate problems, report/apologize as necessary, and so on. I've been on the record for a long time supporting this goal and that hasn't changed. However: 1. Sending UBE to abuse mailboxes is bad. Think about it. We have no other way, unless we have a standard widely adopted. Is also something being done today, with most of the abuse cases. What is wrong is to have a different form for every possible LIR/end-user in the world. Not workable. 2. Expecting people to follow URLs contained in messages to abuse If you read the example procedure in the proposal, this has been sorted out. mailboxes is a horrible idea. Penalizing them for not doing it is worse. Penalizing member of an RIR that don't follow policies, is the right thing to do. (Best practice for abuse handlers is to not use a mail client that parses HTML or a mail client with a GUI, for what I trust are obvious reasons.) 3. Whatever response mechanism is devised, it WILL be automated. I note the reference to "captchas" and suggest reading my recent comment on those in another recent thread here: briefly, they have long since been quite thoroughly beaten. They are worthless, and anyone using them or suggesting their use is woefully ignorant. It is up to the implementation to decide what is best, and I guess it will evolve along the time. 4. Knowing that abuse reports are accepted and read is nice, but not terribly useful. What matters is what's done with them, and that ranges from "investigated promptly and acted on decisively if they're shown to be accurate" to "ignored and discarded" to "forwarded to the abusers". I've preferred not to go into the fine line if there must be properly investigated and properly acted on, but this is something that the community can decide as well. I don't think is coherent to have a business providing Internet services and not have an AUP, or even worst, having an AUP not acting against that. This is a business that doesn't impact only in your own customers if you allow criminals in your network, it impacts the rest of the world, very different level of responsibility than any other business. And we (for a vague value of "we") already know this: we know because we've submitted abuse reports and observed outcomes for years. We know which operations never respond in any way and we know which ones hand data over to abusers (or *are* the abusers). We know this by practice and experience -- it's not something that can be automated. It takes time and effort and expertise to figure out. As indicated already several times, ideally, we have a standard, and then open source or commercial tools that take care of that as much as possible. However, meanwhile we need to act. 5. This approach fails the "what if everybody did it?" test quite badly. Sorry, not sure to understand your point here. 6. Of course, the moment something like this is deployed -- if not before -- bad actors will realize that copycatting it may well be an effective tactic to directly attack abuse desk operations and/or gather intelligence on them and/or compromise them. Again, if you read the policy there is an example of things that can be done to avoid that, such as periodically changing domains, subjects, etc. ---rsk ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
Marco Schmidt(mschmidt@ripe.net) on 2019.05.16 14:20:46 +0200:
Dear colleagues,
A new RIPE Policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion.
This proposal aims to have the RIPE NCC validate "abuse-c:" information more often, and introduces a new validation process that requires manual input from resource holders.
You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04
As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer.
At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, decides how to proceed with the proposal.
We encourage you to review this proposal and send your comments to <anti-abuse-wg@ripe.net> before 14 June 2019.
Last month i witnessed that the current verification method failed when trying to contact a abuse account on a mailserver doing simple graylisting - creating useless work for my collegues and the NCC. I think that the current system should work better before being burdened with more work. Basically this policy makes the NCC spend money for not much gain. So at this time, i'm against it. /Benno
I'm subscribing to the list specifically to also position not in favour of this policy. This will generate work for the NCC that just wastes their time following up on lots of false positives. It will have _zero_ impact on the handling of abuse requests, in-fact I predict that perhaps even make response time worse. I urge the community to reject this proposal. Neil. -- Neil J. McRae neil.mcrae@BT.COM Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum
It is not for RIPE to abandon a policy proposal simply because a resource holder is too cheap to implement it. --------- Original Message --------- Subject: Re: [anti-abuse-wg] 2019-04 New Policy Proposal (Validation of "abuse-mailbox") From: "Neil McRae" <neil.mcrae@bt.com> Date: 5/31/19 12:05 am To: anti-abuse-wg@ripe.net I'm subscribing to the list specifically to also position not in favour of this policy. This will generate work for the NCC that just wastes their time following up on lots of false positives. It will have _zero_ impact on the handling of abuse requests, in-fact I predict that perhaps even make response time worse. I urge the community to reject this proposal. Neil. -- Neil J. McRae neil.mcrae@BT.COM Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum
participants (26)
-
ac -
Alex de Joode -
Brian Nisbet -
Carlos Friaças -
Fearghas Mckay -
Fi Shing -
Gert Doering -
JORDI PALET MARTINEZ -
Liam Glover -
Marco Schmidt -
Michele Neylon - Blacknight -
Neil McRae -
Niall O'Reilly -
Nick Hilliard -
Peter Koch -
Piotr Strzyzewski -
Randy Bush -
Rich Kulawiec -
Sebastian Benoit -
Sebastian Wiesinger -
Shane Kerr -
Suresh Ramasubramanian -
Sérgio Rocha -
Taras Heichenko -
Töma Gavrichenkov -
Ángel González Berdasco