In message <8A9C974B-FFA9-421C-B5ED-90E95624A8FE@a2b-internet.com>, Erik Bais <ebais@a2b-internet.com> wrote:

So the question that I have with all the information that you stated here. - Are they doing something (Other than 'probably' leasing IP space) wrong??

The answer to that question is a clear "yes" and indeed, the events that have followed in the wake of my posting of only a few days ago have actually proven that to be the case, beyond a reasonable doubt. There are two key facts that support this view. First, China is not in the habit of allowing mysterious Russians to route their IP space for them. Call it a matter of national pride, or a matter of national security, or something else. It doesn't matter. The Chinese simply don't allow this sort of thing. I challenge you to find an example, i.e. _any_ example, that will prove this assertion wrong. Second, and even more convincingly, someone somewhere (perhaps someone within RIPE NCC) clearly understood that some or all of the route objects that were in the data base as recently as last week, and that were associated with MNT-SERVERSGET were in fact fradulent, and as a result, _many_ of these route objects have now been quietly removed from the data base. In my prior posting, I specifically called out the following two route objects for special attention: ======================================================================== route: 27.103.192.0/19 origin: AS204895 mnt-by: MNT-SERVERSGET created: 2018-07-02T07:30:29Z last-modified: 2018-07-02T07:30:29Z source: RIPE ======================================================================== route: 36.0.192.0/19 origin: AS204895 mnt-by: MNT-SERVERSGET created: 2018-07-02T07:30:55Z last-modified: 2018-07-02T07:30:55Z source: RIPE ======================================================================== Since my posting, these routes objects, *and numerous others* (full list available upon request) have been withdrawn from the data base *by someone*. By your question Erik, are you attempting to deny that these objects existed in the data base, as recently as last week? By your question, are you attempting to deny that these routes have since been removed from the data base? By your question, are you attempting to assert that these routes... and the several others that have now also been quietly and mysteriously disappeared from the data base... were anything other than blatantly and obviously fradulent?

- Are the leased or used prefixes used to send out spam or host malware or do something else that is frowned upon ? or even illegal.. ( And is there proof of spam source or hijacking etc.. ? )

I believe that to be the case, and I could even marshall some compelling evidence of that, but as I am sure you know that is entirely irrelevant here. Do I really need to say what has already been said innumerable times in the past, i.e. that RIPE is not the Internet Police? The issue I have raised has nothing to do with spamming, which RIPE and all of its members have elected not to concern themselves with. The issue I have raised also has nothing to do with the hijacking of IP address space via the BGP announcement of fradulent routes. This is also a topic which, I am told, RIPE and all of its members have elected not to concern themselves with, because once again, RIPE is not the Internet Police. So, please Erik, do not attempt to confuse the issue by injecting these irrelevancies into the conversation. Let's try to stay focused. The one issue that RIPE and its membership _have_ generally asserted a serious interest in is the quality and accuracy of the data base. The clear evidence, from both last week and today, and particularly the comparison between the two, show quite clearly that *somebody* knows that one hell of a lot of fradulent route objects were inserted into the data base by the party or parties associated with the MNT-SERVERSGET handle. And as a direct result of my posting of last week, *someone* has now mysteriously "disappeared" most or all of the fradulent route objects that had been put into the data base by MNT-SERVERSGET aka Alexander Samuilov. (I say that these route objects have been "mysteriously disappeared" because whoever did that did not see fit to mention who was doing the disappearing or why it was being done, exactly, on any of the RIPE mailing lists to which I posted my message of last week. Nor have I received any private messages explaining why these route objects were being removed.) Try as you might Erik, you cannot make these inconvenient facts go away, e.g. just by introducing a bunch of irrelevancies into the conversation. People... even people here in the relevant RIPE mailing lists... are not all stupid. They can see for themselves that there were in fact *numerous* fradulent route objects in the RIPE data base last week that have mysterious disappeared since my posting of last week. (If anyone needs to have me generate a side-by-side comparison showing the set of fradulent MNT-SERVERSGET route objects that have been disappeared from the data base over just the past few days then I will try to create that sort of side-by-side listing so that any doubters may have a clear view and a clear understanding of what has happened, over just the past few days.) How do you explain this Erik? How does RIPE NCC explain all of these sudden disappearances of route objects from the data base? Does it not seem, even to you, that the rather sudden and unexplained disapperances, just since my posting last week, of so many of the MNT-SERVERSGET route objects may be somewhat more than just purely coincidental? Somebody somewhere knows that those route objects were unambiguously fradulent. Perhaps it was only the perpetrator, Mr. Alexander Samuilov. Perhaps it was some member of the technical staff inside RIPE NCC. Whoever it was, it cannot now be denied that the route objects in question were fradulent, or that this pollution was deliberately inserted into the data base by *some* RIPE member. So the only remaining question is: Is RIPE even willing or able to "police" its own data base? What sanctions, if any, are going to be imposed, by RIPE, on the crook who engineered all of this crap? RIPE has a bad habit of just looking the other way when its members spam massively, engage in massive hacking attacks, and even when they use BGP to hijack IP space that doesn't belong to them. Will RIPE also now look the other way and do nothing when the one and only thing that all RIPE members actually hold dear, i.e. the data base, is used like a toilet by certain specific and easily identifiable members?

If you want to get the exec-board to take action to a listed broker, that should be take up with the exec-board and the NCC. It is my experience that they are very responsive

Your experience is apparently unique. Since my posting of last week, which was CC'd to exec-board@ripe.net, and which clearly and unambiguously called for the investigation of, and the expulsion of several very specific RIPE members (and also the deletion of certain entities from RIPE's list of officially recognized IP brokers), I have had not a single response of any kind from *any* board member. None of them have even had the courtesy to send me a FOAD message in response. Their silence on these matters is deafening. Regards, rfg

In message <07e92bc3-2856-a40c-4b4e-c248b941dbd3@foobar.org>, Nick Hilliard <nick@foobar.org> wrote:

Ronald F. Guilmette via db-wg wrote on 14/08/2018 21:53:

...

None of them have even had the courtesy to send me a FOAD message in response.

Their silence on these matters is deafening.

Yes, and there is not a problem with this. The RIPE NCC board of directors are not involved in day-to-day operations...

Wait a minute. Didn't Erik Bais just -advise- me that I -should- be contacting the board? Wouldn't he qualify as an authority, given that he is a chair of a RIPE working group? More to the point, since when has it become a routine part of "day to day operations" to have RIPE members flooding the RIPE data base with blatant bovine excrement? I -do- see, and I -have- reported on an inordinate amount of exactly such deliberate hanky panky being perpetrated within the RIPE region, and within the RIPE data base of late, but I was not aware, until now, that this sort of behavior is nowadays considered, within the RIPE region at least, to be nothing more than "another day at the office". When exactly did the RIPE membership come around to this bland and careless acceptance of the clearly unacceptable? Or has it just always been like this?

If you need to submit a complaint to the RIPE NCC about problem registrations in the RIPE IRRDB...

I see that you have not understood my points at all. Please allow me to try again. The issue I have, and that I have tried to raise, is -not- merely the existance, in the data base, of this one deliberately fradulent entry or that one deliberately fradulent entry. Nor is the real issue even any given *collection* of deliberately fradulent entries that have been placed into the data base by any one specific member. Rather, the real issue I have raised is the question of what, if anything, RIPE is either willing or able to do to disipline any member that has demonstratably engaged in this exact pattern of repeated frauds. Removal of the fradulent data base entries that I have already identified, or that I may in the future identify, is a good thing, but it does not even begin to address the underlying issue: Why does this keep on happening, specifically and, it seems, -exclusively- within the RIPE region? What is RIPE doing, or not doing, that seems to engourage so many RIPE members to try their hand at this exact type of fraud? Could it perhaps be the case that since no one is ever sanctioned in any way for such activities, there is no real downside to giving it a try?

Also, could you kindly not cc: your emails to so many working groups? No doubt people appreciate how important your reports are, but spamming your emails across three working groups is, in all fairness, a bit much.

Let me see if I have understood you. I've sent my recent messages to exactly and only three mailing lists for three clearly relevant working working groups, namely the data base working group, the routing working group and the (arguably mis-named) "anti-abuse" working group. Are you asserting that my points have nothing whatever to do with the RIPE data base? Are you asserting that my points have nothing whatever to do with routing? Does the deliberate pollution of the data base not constitute a type of "abuse" in your opinion? Just to make sure that I understand, you are apparently asserting that it is now just ordinary "day to day" activity for RIPE to permit the creation, in its data base, of numerous deliberately fradulent entries which then serve to legitimize the hijacking of various IP address blocks, right? And because RIPE "is not the Internet Police" it is also true that nobody on any RIPE mailing list cares about the fact that any of this hijacked IP space... space which RIPE has effectively legitimized... has been or is being sub-leased out to various high-end professional snowshoe spanmmers, who have then proceeded to pump out millions or tens of millions of -actual- spams, right? And yet you have the unmitigated audacity to accuse -me- of "spamming" for the unforgivable act of posting the three clearly relevant WG mailing lists? The gentleman doth protest too much, methinks. That having been said, I am at least pleased to learn that there exists one more member of the RIPE community who evinces at least some concern about the global problem of spam. And I look forward to seeing your concern translated into action with respect to the real and primary issue I have raised, which is the sanctioning of clearly misbehaving members, or rather, the apparently abundant current lack thereof. Regards, rfg

I think it will be a good idea if we can have a better understanding of what's going on with these route objects registered under MNT-SERVERSGET. That can perhaps allows us to clarify what's the condition of the "dubious" 3/4 of IP addresses. This is perhaps a way to deal with hijacking. Vivien

Mr. Titley, Thanks for responding. My comments are included inline below. In message <cf0758bb-88e7-faa6-8b29-11af41c75f8f@titley.com>, Nigel Titley <nigel@titley.com> wrote:

The RIPE community has repeatedly reminded the RIPE NCC that it has no role to play in policing routing and no mandate to make judgments on whether the route objects people create correspond to legitimate BGP announcements.

But that's not really or entirely an accurate statement is it? It is my understanding that RIPE disallows the creation of route objects in the data base that make reference to RIPE issued IP space in the absence of proper permission/endorsement from the actual registrant of the relevant IP space. Is that not so? If it is so, then isn't this quite obviously one way that RIPE is actually and materially -regulating- the creation of route objects in the data base? If this isn't a regulation (or limitation) that RIPE is applying to the creation of route objects then what is it? Likewise and simuilarly it is also my understanding that as of September 4th, less than three weeks from now, RIPE will -additionally- begin enforcing a new regulation preventing the creation, in the data base, of -any- new route objects for out-of-region IP space. Is that not so? So, it seems that RIPE -is- already regulating the creation of such objects in the data base, and it seems that it already been doing so for some time. It is just highly unfortunate that it has been doing it very very badly indeed, as clearly evidenced by the several reports that I've made public this summer alone.

Given this lack of a mandate, it's hard to imagine that the community would support the RIPE NCC unilaterally sanctioning members for incorrect/malicious route announcements.

I did not ask about route announcements. I asked what the RIPE policy is with respect to members who are caught repeatedly, deliberately, and maliciously creating clearly fradulent route objects in the data base. This is a very different matter, as I am sure you must appreciate. With all due respect, you appear to be deftly trying to dodge my actual question, which has nothing to do with route announcements and everything to do with route objects in the data base. I have every reason to believe that you -do- fully appreciate and understand the distinction between these two things, so I ask my question again. What is the RIPE policy with respect to members that are caught red handed, repeatedly, deliberately, and maliciously entering fradulent route objects into the RIPE data base? If you prefer, I would be just as happy if you instead answered my more colloquial formulation of this question: Who exactly does one need to kill, maim, or seriously wound in order to get kicked out of this organization (RIPE)? It seems that there are very nearly no limits on the scope or breadth of the travesties that your members are permitted to engage in, even when it comes to polluting your own data base with easily recognized rubbish. But there -are- apparently at least -some- acts that are so over-the-top egregious that even RIPE can no longer turn a blind eye. This was verified previously by a member of your legal staff who previously reported that there have been at least four separate non-person entities that have actually been kicked out of RIPE, just in the last few years, for reasons other than the non-payment of fees due. So what did these four specific and extra special crooks do, exactly, that was so horrifically bad that even RIPE couldn't turn a blind eye anymore? What could have been so magnificently malevolent that it causes even RIPE, which apparently tolerates very nearly every kind of mischief that can be perpetrated on the Internet, to kick these four entities out? I am reminded of a famous line from the movie Casablanca: "I've often speculated on why you don't return to America. Did you abscond with the church funds? Did you run off with a Senator's wife? I like to think that you killed a man. It's the romantic in me." I ask yet again, what does it take to get kicked out of this organization?

Despite your request, the RIPE NCC doesn't comment on its members or the investigations it undertakes.

I am not asking you to. I am asking you to identify for me *any* form or kind of malfeasance, any kind of travesty, any kind of crime, even one perpetrated against your own data base, that would result in RIPE actually opening its legendary blind eye and taking action for once. Does RIPE even happily tolerate the utter pollution and prostitution of its own data base? As of now, the answer seems to be yes.

If you find inaccurate information in the RIPE Database, please use the report form to let the RIPE NCC know. I fully trust that the RIPE NCC staff will follow up on all cases that are properly reported and take appropriate action.

Well, that makes one of us, at least. I myself have no such faith. Mind you, it is *not* that they aren't perfectly capable of doing their jobs, however those jobs are defined for them. The problem is that -your- definition of "appropriate action" in the cases that I have publically reported on this summer seems to come down to just winking and nodding and otherwise doing nothing whatsoever.

On the other hand if you think that the RIPE NCC should get involved in policing route object creation, that's a different discussion.

See above. RIPE NCC already -is- quite clearly involved in regulating the creation of route objects in the data base, and has been for quite some time already. It is just being done very very badly in cases relating to out-of-region objects. That's not the fault of the engineers. It's clearly the fault of the politicians, including yourself. If you had even a small amount of either foresight or leadership, then you would have put a stop to all of this nonsense years ago. Instead this problem was allowed to grow and fester without limits, and even as we speak is still permitted within the RIPE region. (September 3rd, will be a busy day indeed for the various crooks in the RIPE region.) Lastly, I see that even as you deftly attempted to avoid answering my real question, by trying to change the subject from route objects to route announcements, you didn't even make any pretense at answering my other question, which was abouit what it might take for someone to get kicked out of the club of RIPE "Recognized IP Brokers". Perhaps, instead of asking you what, if anything, it might take for RIPE to kick someone -out- of this totally separate exclusive club, I should instead be asking you what sorts of scoundrels, murders, and rapists RIPE, in its infinite wisdom, is allowing -in- to its club of "Recognized IP brokers" in the first place. Is there -any- party who RIPE would -not- allow to join this club, as long as they can produce the required cash payment to RIPE? Would Bernie Madoff be allowed to be a RIPE-recognized IP broker? How about Charles Ponzi? Are there -any- qualifications needed to become a RIPE-recognized IP broker, other than have a pulse and a bag full of cash (to give to RIPE)? I look forward to your clarifications. Regards, rfg