Purely theoretically, let's look at a flaw in that logic.
If you ask a broker if they are selling IPs, they will always answer "yes." If you ask them if they sent the spam email, they will say "no," but will still try to close the deal.
This behavior applies to both:
  1. A legitimate broker (if someone tried to frame him, he still won't refuse a paying client).
  2. A spammer broker (he knows the spam is illegal, so he will deny sending it and pretend to be legitimate).
Therefore, receiving a reply is not proof of who sent the original spam.

On Thu, 2025-12-11 at 18:47 +0200, Mihail Fedorov wrote:
Spam issue can be partially solved by following logic:

1. Advertisement mail received from some IPv4 broker. At this point we do not know if it’s indeed sent by them - 99% it is, but we need proof.
2. We reply pretending we are interested.
3. When broker reply back we have proof it was indeed targeted spam from them.
4. We open ticket with RIPE providing all the details and RIPE implements punishment for LIRs involved in spam activity.

With this trap logic it seems doable.

On 11 Dec 2025, at 14:52, Lu Heng <h.lu@anytimechinese.com> wrote:

Michele,


Thank you for your message. The question is not whether rules exist, but whether the current structure for creating and enforcing them is adequate for a global system of this scale.


The “community” model in practice consists of only a few dozen active individuals. This small group is neither representative across regions nor accountable to any broader public, yet its decisions can affect networks operating in vastly different legal, cultural, and political environments. That lack of representation creates a structural risk of capture, bias, and instability.


This becomes even more pronounced when we consider the extreme diversity of national perspectives. From Saudi Arabia to the Netherlands, legal systems, societal values, regulatory expectations, and governance norms differ fundamentally. Expecting a small group of volunteers or industry participants to develop rules that all these jurisdictions should accept—and then enforce them as if they had sovereign authority—is simply unrealistic. No international body at continental scale can force uniform agreement on matters that are inherently rooted in law and national sovereignty.


This is why I argue for a clear separation of functions:


  1. Registration and transfer of registration — the registry’s core mandate.

    Its role must be limited to maintaining correct records and executing transfers accurately and neutrally.

  2. Anything beyond those administrative tasks — including questions of legitimacy, suitability, conduct, or compliance —

    belongs to sovereign authorities and legal systems, not to the registry or a small self-selected community around it.



When a registry attempts to go beyond its record-keeping role and act as an enforcement body, it oversteps into areas where it has neither the mandate nor the legitimacy—particularly in a world where countries do not and cannot agree on many fundamental issues.


In short:


• The registry must remain purely administrative.

• Enforcement belongs to sovereign powers.

• Critical infrastructure cannot depend on the opinions or decisions of a small, unrepresentative group.

• Decentralization and separation of powers are essential for long-term stability.


My position is not about ignoring rules, but about ensuring that the structures governing the Internet are legitimate, scalable, and sustainable in a globally diverse environment.


Regards,

Lu


On Thu, 11 Dec 2025 at 14:40, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Lu,

I understand your point about the historical role of registries and the importance of neutrality and non-discrimination. However, the reality is that RIPE NCC (and all RIRs) operate under a framework of community-developed policies and contractual obligations. These are not mere “internal sentiment” - they are binding rules agreed upon by the community and the members. If a member consistently fails to comply with these policies, the registry must have the means to enforce them, or the system collapses.

Neutrality means applying the agreed rules consistently, not ignoring breaches simply because the registry’s role is “administrative.” Without enforcement, the policies become meaningless, and trust in the system erodes far more than any action taken within the established framework.

The registry’s authority doesn’t come from “preference” or “pressure” - it comes from the policies and contracts that all parties have agreed to. Staying “within mandate” means enforcing those policies, not refusing to act whenever a dispute arises.

Regards

Michele

--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland  Company No.: 370845

 

I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours.

 

From: Lu Heng <h.lu@anytimechinese.com>
Date: Thursday, 11 December 2025 12:35
To: Michele Neylon - Blacknight <michele@blacknight.com>
Cc: Peering <peering@all-for-one.com>, Sergey Myasoedov via members-discuss <members-discuss@ripe.net>
Subject: Re: [members-discuss] Re: Systematic RIPE DB abuse

[EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources.

Hi Michele,

A registry cannot remove someone from the Internet simply because a small group of individuals believes they should not appear in the address book. Authority of that kind does not arise from community discussions or internal interpretations; it exists only within sovereign legal systems.

What began decades ago as a voluntary address book maintained by a small circle of technical collaborators has evolved into the documentation layer of the global Internet. In such a context, the old notion of “we can choose not to play with you because we don't like you” no longer applies. Universal, nondiscriminatory access principles govern essential infrastructure.

For that reason, the registry’s role is strictly administrative:

to maintain accurate records and apply clearly defined procedures solely for that purpose.

It is not empowered to impose penalties, revoke resources, or exclude parties except where actions are explicitly grounded in law.

Operational policies support coordination, but they are not legal authority—and they cannot justify shutting a network down because a handful of participants in a working group believe an organisation should not have an address. When a registry moves beyond its administrative mandate and begins treating essential Internet resources as leverage based on internal sentiment or discretionary judgment, it introduces instability rather than accountability.

Enforcement, when appropriate, belongs to courts, regulators, and governments.

The registry must remain neutral, predictable, and tightly bound to its documented processes, without expanding its powers based on preference, pressure, or interpretation.

That is the central point:

administrative bodies must stay within their mandate, and critical infrastructure must never depend on the opinions of a few individuals, however well-intentioned they may be.


On Thu, 11 Dec 2025 at 14:00, Michele Neylon - Blacknight <michele@blacknight.com> wrote:
Lu,

If I take your position at face value, it implies that anyone, no matter how often they ignore the rules or breach the obligations they agreed to, should still have uninterrupted access to registry services simply because the registry is administrative.

That is not realistic.

RIPE NCC, like every RIR, operates under policies and contractual terms the community itself created. These rules govern how resources are requested, registered, maintained and transferred. They exist for a reason and they only work if they can be enforced.

If a registry cannot act when members repeatedly disregard those obligations, then the policies become optional. A system where rules are optional is not neutral or stable. It is unworkable.

Neutrality does not mean the registry has no authority. It means the registry applies the established framework consistently and without bias.

That is not punishment. It is basic operational responsibility.

The idea that a registry must continue providing services even when a member openly refuses to follow the agreed rules would undermine trust far more than any action taken within the policy and contractual framework.


Regards,
Michele


--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland  Company No.: 370845

 

I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours.
From: Lu Heng <h.lu@anytimechinese.com>
Date: Thursday, 11 December 2025 at 10:48
To: Peering <peering@all-for-one.com>
Cc: Michele Neylon - Blacknight <michele@blacknight.com>, Sergey Myasoedov via members-discuss <members-discuss@ripe.net>
Subject: Re: [members-discuss] Re: Systematic RIPE DB abuse

[EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources.

You are mixing two fundamentally different things:


1. Community-platform rules (like mailing lists)

2. Number-resource administration (the registry function)


A registry absolutely may moderate its mailing list or remove someone from a community forum.

That is not the issue.

That is not resource governance.

That is not number administration.


The problem arises when you conflate the mailing list with the registry function and assume the same “ban power” applies to number resources. It does not.


A registry’s authority over number resources is administrative, not discretionary:


• It has no sovereign power.

• It cannot impose penalties outside the law.

• It cannot “ban” someone from holding number resources because it dislikes their actions.

• It cannot create new enforcement powers through internal rules.


Mailing-list rules are internal community guidelines.

Number-resource allocation is part of global critical infrastructure.


These are not equivalent domains.


The fact that a registry can enforce behavior on a mailing list does not grant it the authority to punish a member by altering or revoking their number resources. The two functions exist on different legal, operational, and governance layers.


If you do not separate these layers, you end up with exactly the instability we see today: registries treating essential resource administration as if it were a social-media moderation problem.


A registry is allowed to moderate conversations.

A registry is not allowed to weaponize the address book.


That is the distinction you must not blur.


On Thu, 11 Dec 2025 at 12:33, Peering <peering@all-for-one.com> wrote:

This is not about punishing or violating laws but violating the rules of usage of the registry. While doing so, it should be normal to get banned from that registry and the usage of the abused resources like the Mailing list. So far fully fits in your position, as the rules of usage are given by the registry it’s also the only given authority that can enforce them.

 

Von: Lu Heng <h.lu@anytimechinese.com>
Gesendet: Mittwoch, 10. Dezember 2025 21:49
An: Michele Neylon - Blacknight <michele@blacknight.com>
Cc: Sergey Myasoedov via members-discuss <members-discuss@ripe.net>
Betreff: [members-discuss] Re: Systematic RIPE DB abuse

 

Michele,

 

Let me clarify, because this is not a question of “no rules.”

 

My position is straightforward:

 

A registry is a registry.

Its mandate is to maintain accurate records—nothing more.

You do not use an address book as an instrument of punishment.

 

When a registry begins using essential administrative functions to reward or punish individuals, the system becomes unpredictable and open to abuse. This is, in fact, a major reason the RIR environment has struggled with instability and governance issues: registries have, at times, stepped outside their neutral role and attempted to use resource administration as leverage.

 

Rules absolutely must exist, and compliance is essential.

But those rules are defined and enforced by sovereign law—courts, regulators, and proper authorities—not by a voluntary address book. A registry cannot impose its own rules above nations, nor can it act as police, prosecutor, and judge.

 

Punishment, when warranted, must come through established legal channels. A registry that assumes enforcement powers beyond its mandate ultimately undermines its own legitimacy and the trust of the global community.

 

That is the core of my position.

 

Regards,

Lu

 
 
 
 

On Wed, Dec 10, 2025 at 16:19 Michele Neylon - Blacknight <michele@blacknight.com> wrote:

Lu 

 

Sorry but I cannot agree with your position on this. 

 

By your logic RIPE NCC would have zero right to take action against a member who was in breach of the policies, rules etc., 

 

Trust in the system is only possible when the system is stable and predictable, which you seem to agree with, however if there are no rules then any system will be abused by somebody at some point. 

 

Regards

 

Michele

 
--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland  Company No.: 370845

 

I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours.

From: Lu Heng <h.lu@anytimechinese.com>
Date: Wednesday, 10 December 2025 at 13:15
To: Brett Sheffield <ripe@gladserv.com>
Cc: Sergey Myasoedov via members-discuss <members-discuss@ripe.net>
Subject: [members-discuss] Re: Systematic RIPE DB abuse

[EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources.

Hi

 

I agree entirely NCC should not do anything. A registry’s role is administrative, not enforcement. Asking a bookkeeping-type institution to police behavior is simply outside its mandate and purpose.

 

There are countless legitimate ways to address concerns or resolve disputes. But withholding a fundamental registry service—such as assigning an address—because someone “did or did not do X” is irrational and unprecedented. It is the equivalent of a government refusing to give a home an address instead of contacting law enforcement or using proper legal channels. No responsible system operates that way, and no credible governance framework treats essential registry functions as a tool for punishment or leverage.

 

A registry should remain neutral, predictable, and strictly procedural. Using it as an enforcement mechanism undermines trust in the entire system.

 
 

--
Kind regards.
Lu

 
 

On Wed, Dec 10, 2025 at 14:38 Brett Sheffield <ripe@gladserv.com> wrote:

On 2025-12-08 12:57, Sergey Myasoedov via members-discuss wrote:
> Dear RIPE NCC members,
>
> I’d like to raise the topic of introducing and applying administrative anti-spam measures against RIPE NCC members who deliberately violate Article 4 of the RIPE Database Terms and Conditions.
>
> RIPE NCC requires members to publish up-to-date contact email addresses in the RIPE DB. However, these publicly listed addresses are actively harvested and used for spam by IPv4 brokers and address traders, while RIPE NCC does not take any measures to protect members from this type of abuse.
>
> This issue has been around since the IPv4 market appeared, and although it’s well known, at some point the RIPE NCC staff chose not to act against members who don’t follow the RIPE Database T&C.
>
> My proposal is to freeze transfer operations for members who are repeatedly abusing the RIPE Database.
>
> I’d be glad to hear your thoughts and discuss this further.

Compared to other sources, our RIPE contact address gets a tiny amount of spam,
and all of it from IPv4 brokers.

I've now received more emails in this single thread in the past 24 hours than I
have spam to our RIPE contact address in the past 5 years. No action from RIPE
is required here.

Tighten your spam controls if this is a problem for you, and lets move on.

Cheers,


Brett
--
Brett Sheffield (he/him)
Gladserv
To unsubscribe or manage your subscription, log in to the LIR Portal with your
RIPE NCC Access account and go to the LIR Account page:
https://my.ripe.net/#/account-details.

Scroll down to Membership Mailing Lists to update your 'members-discuss' subscription.

Having issues unsubscribing? More information about managing your subscription
can be found at: https://www.ripe.net/s/members-discuss-subscription-options/



--
--
Kind regards.
Lu



--
--
Kind regards.
Lu



-- 
--
Kind regards.
Lu

To unsubscribe or manage your subscription, log in to the LIR Portal with your
RIPE NCC Access account and go to the LIR Account page:
https://my.ripe.net/#/account-details.

Scroll down to Membership Mailing Lists to update your 'members-discuss' subscription.

Having issues unsubscribing? More information about managing your subscription
can be found at: https://www.ripe.net/s/members-discuss-subscription-options/

To unsubscribe or manage your subscription, log in to the LIR Portal with your
RIPE NCC Access account and go to the LIR Account page:
https://my.ripe.net/#/account-details.

Scroll down to Membership Mailing Lists to update your 'members-discuss' subscription.

Having issues unsubscribing? More information about managing your subscription
can be found at: https://www.ripe.net/s/members-discuss-subscription-options/