May 2020 - members-discuss - mailman.ripe.net

Cooking Show
by Silvan Gebhardt 03 Jun '20

03 Jun '20

Hi Folks, not sure where it is the right place to request, but can we get another cooking show with Alastair? I would be surprised if we don't find enough people requesting it ;) that would be a nice intermittent past-time until next (virtual?) RIPE ;) who's in for that too? Silvan

6 7

Re: [members-discuss] [ncc-announce] [GM] RIPE NCC General Meeting May 2020
by Sergey Myasoedov 20 May '20

20 May '20

Dear Hans Petter, > A full voting report detailing the voting numbers and a link to vote > receipts that members can use to verify their votes is available: > https://www.ripe.net/participate/meetings/gm/meetings/may-2020/voting-report Unfortunately voting report is not full, cite: "There are fewer voting receipts than total votes because some voters represented more than one member and carried the voting rights for these members." What is the reason not to publish ballot/vote weight? This could be useful for reproducing algorithm work result. -- Kind regards, Sergey Myasoedov Hans Petter Holen wrote Friday, May 15, 2020, 12:54:38 PM: > Dear colleagues, > The RIPE NCC General Meeting (GM) was held from 13-15 May 2020. > An election took place to fill three seats on the RIPE NCC Executive > Board. There were eight candidates and the seats were filled by > Christian Kaufmann, Maria Häll and Raymond Jetten. > There were three resolutions to be voted on at the General Meeting. The > results of the voting on the resolutions are as follows: > Resolution 1: > "The General Meeting adopts the RIPE NCC Financial Report 2019.” > The resolution was approved. > Resolution 2: > "The General Meeting discharges the Executive Board with regard to its > actions as they appear from the Annual Report 2019 and Financial Report > 2019.” > The resolution was approved. > Resolution 3: > "The General Meeting approves the adoption of the RIPE NCC Charging > Scheme 2021.” > The resolution was approved. > I welcome Christian, Maria and Raymond to the Executive Board. > A full voting report detailing the voting numbers and a link to vote > receipts that members can use to verify their votes is available: > https://www.ripe.net/participate/meetings/gm/meetings/may-2020/voting-report > Information on the GM, including the supporting documents and > presentations, is available at: > https://ripe.net/gm/may-2020 > The RIPE NCC thanks its members for their feedback and participation. > Kind regards, > Hans Petter Holen > Managing Director > RIPE NCC

2 1

Re: [members-discuss] RIPE NCC Executive Board election
by Anthony Somerset 17 May '20

17 May '20

Respectfully there are only about 70-75 countries in RIPE as per https://www.nro.net/list-of-country-codes-in-the-ripe-ncc-region/ <https://www.nro.net/list-of-country-codes-in-the-ripe-ncc-region/> not over 100 thats some 25% or more difference - its important to be accurate with numbers and facts here. While I agree with your premise that a very small minority of countries are exercising their voting rights, its another thing altogether to say they are blanket controlling RIPE - it just means that LIR’s in other countries are either happy with the status quo or just not interested in exercising their democratic rights as members of RIPE, if other LIR’s don’t like the situation, the solution is very simple, they need to exercise those rights more actively - and because RIPE is a democratic organisation you can’t force people to get voting like say North Korea does…. > On 15 May 2020, at 18:41, Elad Cohen <elad(a)netstyle.io> wrote: > > --- > I’m curious to understand if there is any particular reason for this? Does one have something to hide? > --- > Yes, I'm invisible. > > > --- > I also find it exceptionally curious having now had the time to read all the profiles more carefully, to note that your Motivation and Background is the only one out of 8 candidates that attacks some other person and/or organisation as part of the motivation. All of the other candidates have the good graces and respect to focus on more positive aspects. I repeat that, You sir are the ONLYcandidate that has openly run on the basis of personal attacks? I also note that your background is 1 sentence of 2 lines, which is just a statement that doesn’t provide some reasonably traceable evidence of your actual technical and management experience. Again one is left asking the question, Does one have something to hide? > --- > Untrue, only my last part was related to Christian and Maria and I brought something to the attention of the community which I believe is important, lies and dishonest between themselves towards the community - if the community are accepting such standard then it is up for the community. I was personally attacked heavily by most of the candidates. Including a fake media report that included in it a sentence that I didn't do anything illegal (in order to try to avoid from a lawsuit) but no one reads the whole article and read only the title which was intended to damage my election and succeeded. That fake report was pumped in all *NOG groups by the messengers of some of the candidates. > > Actually I was the only one that came to member-discuss to answer any question and I could also answer any question about my background when asked in a respectful way. No other candidate did it - if that is the kind of elections the community wants it is up to you - if you decide to choose candidates based on what they are writing on themselves and not to have any interaction with them - it is up to you. > > At the end - 3 countries decided who will be the board members and 3 countries are controlling RIPE and giving the tone in RIPE - UK, Germany and France - when there are more than 100 countries in RIPE - I'm not against these countries, I only tried to make RIPE more reflecting for all the countries - the community decided and I respect it of course. I wish good luck to the chosen candidates. > > > --- > I am equally interested as to how you will technically achieve 0 RIPE fees yet at the same time improve SLA response time to 24 hours for RIPE tickets – on the surface they appear to be mutually exclusive targets. Don’t get me wrong I would love 0 fees to RIPE like all of us, but I am a realist – I just can’t see how you can reduce expenditure and increase other revenue outside of the fees all the same while improve response times (more staff). I am just failing to see how that would move the numbers by that large amount. I will also say good luck auditing every expense – you will fast learn that this is NOT the most efficient way to do things, and why a LOT of the “bureaucracy” exists in the first place. > --- > It was intended to be over a period of time, in stages over the whole 3 years period, to make RIPE more efficient organization - through it the expenses will be lowered and then some of the left over income will be invested correctly to generate high ROI while the other part of the left over income will be used in order to lower the yearly membership fees, gradually over time, until RIPE membership fees will be $0 and it can happen with a very efficient organization. > > > --- > To the other candidates – Kudos to you for taking the time to write out careful and reasoned motivations and providing some more useful insights into your real credentials – I wish you all the best of luck and may the best Man or Lady win and do RIPE proud! > --- > 10% of the total voters voted for me, they represent 10% of the whole RIPE community. More than the initial voters of the elected #3. You say that nobody personal attacked me - but you should check the *NOG groups and how the fake media report was pumped there. > > > > From: members-discuss <members-discuss-bounces(a)ripe.net> on behalf of anthony.somerset(a)cloudunboxed.net <anthony.somerset(a)cloudunboxed.net> > Sent: Thursday, May 14, 2020 10:06 PM > To: members-discuss(a)ripe.net <members-discuss(a)ripe.net> > Subject: Re: [members-discuss] Fw: RIPE NCC Executive Board election > > Mr Cohen > > I find it most interesting that your profile is the only one lacking a picture of the candidate - https://www.ripe.net/participate/meetings/gm/meetings/may-2020/candidate-bi… <https://www.ripe.net/participate/meetings/gm/meetings/may-2020/candidate-bi…> I’m curious to understand if there is any particular reason for this? Does one have something to hide? > > I also find it exceptionally curious having now had the time to read all the profiles more carefully, to note that your Motivation and Background is the only one out of 8 candidates that attacks some other person and/or organisation as part of the motivation. All of the other candidates have the good graces and respect to focus on more positive aspects. I repeat that, You sir are the ONLY candidate that has openly run on the basis of personal attacks? I also note that your background is 1 sentence of 2 lines, which is just a statement that doesn’t provide some reasonably traceable evidence of your actual technical and management experience. Again one is left asking the question, Does one have something to hide? > > I am equally interested as to how you will technically achieve 0 RIPE fees yet at the same time improve SLA response time to 24 hours for RIPE tickets – on the surface they appear to be mutually exclusive targets. Don’t get me wrong I would love 0 fees to RIPE like all of us, but I am a realist – I just can’t see how you can reduce expenditure and increase other revenue outside of the fees all the same while improve response times (more staff). I am just failing to see how that would move the numbers by that large amount. I will also say good luck auditing every expense – you will fast learn that this is NOT the most efficient way to do things, and why a LOT of the “bureaucracy” exists in the first place. > > To the other candidates – Kudos to you for taking the time to write out careful and reasoned motivations and providing some more useful insights into your real credentials – I wish you all the best of luck and may the best Man or Lady win and do RIPE proud! > > Best Regards > > Anthony Somerset > > From: members-discuss <members-discuss-bounces(a)ripe.net> On Behalf Of Elad Cohen > Sent: Wednesday, May 13, 2020 3:47 PM > To: members-discuss(a)ripe.net > Subject: [members-discuss] Fw: RIPE NCC Executive Board election > > Hello, > > My response below to "The Ronald Show" in Nanog, if you will post his intentional lies in member-dicuss then you show also post my reply below to his lies. > > Kind Regards, > Elad > > From: Elad Cohen <elad(a)netstyle.io <mailto:elad@netstyle.io>> > Sent: Wednesday, May 13, 2020 4:46 PM > To: Ronald F. Guilmette <rfg(a)tristatelogic.com <mailto:rfg@tristatelogic.com>>; nanog(a)nanog.org <mailto:nanog@nanog.org> <nanog(a)nanog.org <mailto:nanog@nanog.org>> > Subject: Re: RIPE NCC Executive Board election > > Hello Everyone, > > My apology for not providing an official response to the first "The Ronald Show" that took place here many months ago, I was out of hospital after full anesthesia and it took me months to get back to myself. > > What was done towards me and what being done to me by Ronald is an intentional personal attack against me and I will explain. > > I didn't agree to provide private business documents to the illegal anonymous organization "The Spamhaus Project" that they tried to extort from me - then I found out who are the real people behind the illegal anonymous organization "The Spamhaus Project" - and then they started to attack me (including here on Nanog, with false information, when I was out of hospital and wasn't in the condition to respond to them). > > "The Spamhaus Project" is an illegal anonymous organization according to their own words in their own following presentation: > > https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio… <https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio…> > > They wrote in it that they receive on a regular basis - massive amount of illegaly-obtained privacy data from their contacts in many internet companies and internet organizations - and then they share it in illegal way (without any warrant) with Law Enforcement Agencies - this is the reason that Law Enforcement Agencies are doing nothing regarding the illegal anonymous organization "The Spamhaus Project". > > Ronald Guilmette is the front person of the illegal anonymous organization "The Spamhaus Project". > > > ---- > and that said legal counsel has then > proceeded to threaten various officials of the City of Cape Town, > South Africa with possible legal action if they do not relinquish > to him their rights in and title to the 165.25.0.0/16 block > ---- > This is a complete lie, in order to shame CoCT I will not share their internal correspondences. Anyone interested to know more information can email me directly. > > > ---- > "I am assured that at no time did the City of Cape Town ever sell, trade, or barter away their rights to this valuable IPv4 block" > ---- > Ronald is "assured" exactly as he is "assured" that all Dutch people are criminals and all Colombian network oeprators are criminals and all Chicago citizens are criminals according to his statements in the following links: > https://imgur.com/AcmgwEX <https://imgur.com/AcmgwEX> > https://imgur.com/WUZvdNJ <https://imgur.com/WUZvdNJ> > https://imgur.com/a/Rzrbxkz <https://imgur.com/a/Rzrbxkz> > > Ronald was called an antisemitic and a racist person here on Nanog in the following two links, by people which are not related to me: > https://imgur.com/AQCmZlk <https://imgur.com/AQCmZlk> > https://imgur.com/a/Rzrbxkz <https://imgur.com/a/Rzrbxkz> > > > In the first "The Ronald Show" many months ago - Ronald called me in two antisemitic names that are being used to relate to Jews in Shakespeare literature (just like Ronald is relating to Shakespeare in https://imgur.com/AcmgwEX <https://imgur.com/AcmgwEX> ) - as part of his defamation campaign towards me - none of you raised a voice and not only that but some Nanog subscribers enjoyed his racism and antisemitism (without a single proof against me) as was written here by them (with a popcorn). > > The "source" in "The Spamhaus Project" that supported and pumped Ronald Imagination is the criminal of the anonymous twitter account: https://twitter.com/underthebreach <https://twitter.com/underthebreach> , that person according to his own words in his own criminal anonymous twitter account - is a master of cyber influence operations (meaning to influence people without a single proof) - that person is also an employee of the Israeli-based company GeoEdge and they are a direct competitor of a company that used the netblocks that Ronald attacked - not only that but Ronald also attacked another Israeli-based company called Divineworks (here in Nanog) and they are also a direct competitor of the Israeli-based company GeoEdge. What was done here is a cyber influence operation without a single proof because of a business competition. > > That criminal https://twitter.com/underthebreach <https://twitter.com/underthebreach> which is a member of "The Spamhaus Project" and pumped Ronald Imagination - is not the only person which is abusing the power of "The Spamhaus Project" for commericial goals, that are many many more people and companies behind the illegal anonymous organization "The Spamhaus Project" which are making profit from it, for example: > > - Vincent Schonau from Open-Xchange (AKA "Vincenet Hanna" of "The Spamhaus Project") that "The Spamhaus Project" is attacking the competitors of Open-Xchange. > - Laura Atkins from WordToTheWise which is selling a Spamhaus listing removal service (https://wordtothewise.com <https://wordtothewise.com/>) > > Real identities behind "The Spamhaus Project": > > "Mike Anderson" - Michael O'Reirdan (Chairman Emeritus of W3AAWG) and Professor Ross Anderson from Cambridge university (both known as "Mike Anderson" of "The Spamhaus Project") > "Rob Shultz" - Rob McEwen (https://www.invaluement.com/ <https://www.invaluement.com/>) > "Thomas Morrison" - Daniel R. Thomas (https://personal.cis.strath.ac.uk/d.thomas/ <https://personal.cis.strath.ac.uk/d.thomas/>) > "Pete Dawes" - Ildiko Pete (https://www.cl.cam.ac.uk/~ip358/ <https://www.cl.cam.ac.uk/~ip358/>) > "Vincent Hanna" - Vincent Schonau of Open-Xchange (https://www.linkedin.com/in/vincentschonau/ <https://www.linkedin.com/in/vincentschonau/>) > "Milly Fawcett" - Kelly Molloy of FarSight Security (https://www.linkedin.com/in/kelly-molloy-b886442/ <https://www.linkedin.com/in/kelly-molloy-b886442/>) > Among others. > > Companies behind the illegal anonymous organization "The Spamhaus Project": > ThreatSTOP > FarSight Security > Fastly > Dyn > Cymru > Abusix > Among others. > > > Regarding the article that Ronald shared, in it there is clearly written: > > "It must be noted that Cohen is not being accused of any illegal activity in this report." > > But it doesn't change the fact that the article was clearly written only for Ronald to be able to post it and to proceed with the illegal "cyber influence operation" to attack me without a single proof. The article was written by the instruction of the "The Spamhaus Project" mob and then Ronald made this post according to the instruction from "The Spamhaus Project" mob. A coordinated illegal "cyber influence operation" without a single proof. > > > Many subscribers of the Nanog list are members of the illegal anonymous organization "The Spamhaus Project" - Ronald Guilmette is just their front clown - expect many of them to jump now and to defame me here without a single proof (because this is how the illegal anonynous organization "The Spamhaus Project" works) - and you can ask them a simple single question - "show us a single proof" - and - "if you cannot show us a single proof then please stop spamming the mailing list". > > Ronald at the end of his post keep spreading lies and writing: > "less than honorable intent reach for power" > "to persons with an interest only in what is best for them personally, to the exclusion of all else" > "Democracy dies in darkness." > > When in reality I invented three new pantets for the best of the whole Internet community and I will work to implement them if I will be elected: > > IPv4+ that will mitigate the "IPv4 Exhaustion" problem and will add more 4,294,967,296 IPv4 addresses: (can be implemented with software updates and not all internet hosts in the world will have to be updated - home routers and home modems which are the vast majority of routing equipment in the world - will not need to be updated and will support more 4,294,967,296 IPv4 addresses with IPv4+ ) > https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003676.h… <https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003676.h…> > > Completely mitigating the global email spam problem in a clean and automatic way: (and also mitigating the illegal anonymous organization "The Spamhaus Project") > https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003778.h… <https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003778.h…> > > Completely mitigating spoofed ip amplification DDoS attacks and spoofed ip traffic with is a source for criminality: > https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003902.h… <https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003902.h…> > > They ("The Spamhaus Project" mob) wants to keep controlling RIPE and any other internet organizations - I want to liberate RIPE - I want to make sure that that illegal anonymous organization that violates any thing which is sacred in the Interent (freedom, free speech and connectivity) - will have no footprint in RIPE. > > My full agenda can be read here: > https://www.ripe.net/participate/meetings/gm/meetings/may-2020/candidate-bi… <https://www.ripe.net/participate/meetings/gm/meetings/may-2020/candidate-bi…> > > Ronald is afraid from me being elected because he knows that if I will be elected I will put an end to the illgal anonymous organization "The Spamhaus Project" which is intimidating and harassing many organizations and many businesses worldwide. > > Kind Regards, > Elad > From: NANOG <nanog-bounces(a)nanog.org <mailto:nanog-bounces@nanog.org>> on behalf of Ronald F. Guilmette <rfg(a)tristatelogic.com <mailto:rfg@tristatelogic.com>> > Sent: Wednesday, May 13, 2020 12:50 PM > To: nanog(a)nanog.org <mailto:nanog@nanog.org> <nanog(a)nanog.org <mailto:nanog@nanog.org>> > Subject: RIPE NCC Executive Board election > > Many of you here may be dues-paying members of both ARIN and RIPE. > > Those of you who are may wish to be aware of the fact that there will > be an election held on (I believe) May 14th, just a day or two from > now, for three open RIPE NCC Executive Board seats. > > I have it on good authority that one of the candidates running for > the open RIPE NCC board seats in this election has hired legal > counsel in South Africa, and that said legal counsel has then > proceeded to threaten various officials of the City of Cape Town, > South Africa with possible legal action if they do not relinquish > to him their rights in and title to the 165.25.0.0/16 block, a > block that all historical records, including even ARIN "WhoWas" > historical records show, clearly and unambiguously, has been > legally registered to the City of Cape Town for over twenty years. > (I am assured that at no time did the City of Cape Town ever sell, > trade, or barter away their rights to this valuable IPv4 block, > and that they are defending themselves, as best as they can, against > this attempt to extort them out of their rightful prooperty.) > > Where I come from, this kind of thing is called barratry, but you > be the judge. > > In any case, prior to the RIPE election, I wanted to let you all > know these facts about the candidate in question, as well as a > number of additional startling facts relating to the people who > nominated this candidate for a RIPE NCC Executive board seat, as > documented by my friend, South African journalist Jan Vermeulen: > > https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-… <https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-…> > > I could go into more detail about many of the nominators mentioned > in the above article, but I don't want to make this email too long, > so I'll await some explict request for that additional info. For now > it should suffice to make at least some of the basic facts more widely > available, a task which is accomplished just by sharing the above link, > IMHO. > > > Regards, > rfg > > > P.S. I have been specifically and explicitly enjoined and constrained > from posting here anything at all that might smack of being either > partisan or of an even vaguely "political" nature, and thus, I will > refrain from doing so. I would be remiss hoever if I did not at least > note in passing that history records that in times such as these, when > people of good character and good intent are, as they rightly should be, > focused on the health and safety of themselves, their loved ones, and > their professional collegues, and when the gaze of the world is elsewhere, > persons of less than honorable intent reach for power and, with unfortunate > regularity, obtain it. > > I cannot and do not ask that those of you who have been saddled with > personal or local crises during this sad time turn away from those > responsibilities to give attention to matters of Internet governance, > however urgent those may appear at the moment. For all of us, our first- > order duty lies nearby, with family, friends, and collegues. But for > those of you who still have a few cycles to spare, I do ask that you > consider carefully the newfound and critical importance of this tool, > this Internet, in the lives of so many millions, all around the world, > and the self-evident risks of its governance being handed over, by default > or otherwise, to persons with an interest only in what is best for them > personally, to the exclusion of all else. > > P.P.S. I would be posting this info and the above link also to the > very relevant RIPE members-discuss mailing list, but as I am not a > due-paying member of RIPE, I have no ability to do so. Separately, > due in no small part to the candidate's own recent and manifest on-list > transgressions on that very list, that list has recently been switched > to a heavy-handed moderation, under which, it seems, even discussion of > the pros and cons of candidates in the upcoming RIPE NCC Executive Board > election are now categorized as "too controversial" and thus, themselves, > are now entirely off-limits. > > I cannot help but be reminded of a catch-phrase that I saw somewhere, > not too long ago: > > "Democracy dies in darkness." > -- anon

2 1

Fw: RIPE NCC Executive Board election
by Elad Cohen 15 May '20

15 May '20

Hello, My response below to "The Ronald Show" in Nanog, if you will post his intentional lies in member-dicuss then you show also post my reply below to his lies. Kind Regards, Elad ________________________________ From: Elad Cohen <elad(a)netstyle.io> Sent: Wednesday, May 13, 2020 4:46 PM To: Ronald F. Guilmette <rfg(a)tristatelogic.com>; nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: RIPE NCC Executive Board election Hello Everyone, My apology for not providing an official response to the first "The Ronald Show" that took place here many months ago, I was out of hospital after full anesthesia and it took me months to get back to myself. What was done towards me and what being done to me by Ronald is an intentional personal attack against me and I will explain. I didn't agree to provide private business documents to the illegal anonymous organization "The Spamhaus Project" that they tried to extort from me - then I found out who are the real people behind the illegal anonymous organization "The Spamhaus Project" - and then they started to attack me (including here on Nanog, with false information, when I was out of hospital and wasn't in the condition to respond to them). "The Spamhaus Project" is an illegal anonymous organization according to their own words in their own following presentation: https://www.scribd.com/document/445894312/Spamhaus-Illegal-Private-Data-Vio… They wrote in it that they receive on a regular basis - massive amount of illegaly-obtained privacy data from their contacts in many internet companies and internet organizations - and then they share it in illegal way (without any warrant) with Law Enforcement Agencies - this is the reason that Law Enforcement Agencies are doing nothing regarding the illegal anonymous organization "The Spamhaus Project". Ronald Guilmette is the front person of the illegal anonymous organization "The Spamhaus Project". ---- and that said legal counsel has then proceeded to threaten various officials of the City of Cape Town, South Africa with possible legal action if they do not relinquish to him their rights in and title to the 165.25.0.0/16 block ---- This is a complete lie, in order to shame CoCT I will not share their internal correspondences. Anyone interested to know more information can email me directly. ---- "I am assured that at no time did the City of Cape Town ever sell, trade, or barter away their rights to this valuable IPv4 block" ---- Ronald is "assured" exactly as he is "assured" that all Dutch people are criminals and all Colombian network oeprators are criminals and all Chicago citizens are criminals according to his statements in the following links: https://imgur.com/AcmgwEX https://imgur.com/WUZvdNJ https://imgur.com/a/Rzrbxkz Ronald was called an antisemitic and a racist person here on Nanog in the following two links, by people which are not related to me: https://imgur.com/AQCmZlk https://imgur.com/a/Rzrbxkz In the first "The Ronald Show" many months ago - Ronald called me in two antisemitic names that are being used to relate to Jews in Shakespeare literature (just like Ronald is relating to Shakespeare in https://imgur.com/AcmgwEX ) - as part of his defamation campaign towards me - none of you raised a voice and not only that but some Nanog subscribers enjoyed his racism and antisemitism (without a single proof against me) as was written here by them (with a popcorn). The "source" in "The Spamhaus Project" that supported and pumped Ronald Imagination is the criminal of the anonymous twitter account: https://twitter.com/underthebreach , that person according to his own words in his own criminal anonymous twitter account - is a master of cyber influence operations (meaning to influence people without a single proof) - that person is also an employee of the Israeli-based company GeoEdge and they are a direct competitor of a company that used the netblocks that Ronald attacked - not only that but Ronald also attacked another Israeli-based company called Divineworks (here in Nanog) and they are also a direct competitor of the Israeli-based company GeoEdge. What was done here is a cyber influence operation without a single proof because of a business competition. That criminal https://twitter.com/underthebreach which is a member of "The Spamhaus Project" and pumped Ronald Imagination - is not the only person which is abusing the power of "The Spamhaus Project" for commericial goals, that are many many more people and companies behind the illegal anonymous organization "The Spamhaus Project" which are making profit from it, for example: - Vincent Schonau from Open-Xchange (AKA "Vincenet Hanna" of "The Spamhaus Project") that "The Spamhaus Project" is attacking the competitors of Open-Xchange. - Laura Atkins from WordToTheWise which is selling a Spamhaus listing removal service (https://wordtothewise.com) Real identities behind "The Spamhaus Project": "Mike Anderson" - Michael O'Reirdan (Chairman Emeritus of W3AAWG) and Professor Ross Anderson from Cambridge university (both known as "Mike Anderson" of "The Spamhaus Project") "Rob Shultz" - Rob McEwen (https://www.invaluement.com/) "Thomas Morrison" - Daniel R. Thomas (https://personal.cis.strath.ac.uk/d.thomas/) "Pete Dawes" - Ildiko Pete (https://www.cl.cam.ac.uk/~ip358/) "Vincent Hanna" - Vincent Schonau of Open-Xchange (https://www.linkedin.com/in/vincentschonau/) "Milly Fawcett" - Kelly Molloy of FarSight Security (https://www.linkedin.com/in/kelly-molloy-b886442/) Among others. Companies behind the illegal anonymous organization "The Spamhaus Project": ThreatSTOP FarSight Security Fastly Dyn Cymru Abusix Among others. Regarding the article that Ronald shared, in it there is clearly written: "It must be noted that Cohen is not being accused of any illegal activity in this report." But it doesn't change the fact that the article was clearly written only for Ronald to be able to post it and to proceed with the illegal "cyber influence operation" to attack me without a single proof. The article was written by the instruction of the "The Spamhaus Project" mob and then Ronald made this post according to the instruction from "The Spamhaus Project" mob. A coordinated illegal "cyber influence operation" without a single proof. Many subscribers of the Nanog list are members of the illegal anonymous organization "The Spamhaus Project" - Ronald Guilmette is just their front clown - expect many of them to jump now and to defame me here without a single proof (because this is how the illegal anonynous organization "The Spamhaus Project" works) - and you can ask them a simple single question - "show us a single proof" - and - "if you cannot show us a single proof then please stop spamming the mailing list". Ronald at the end of his post keep spreading lies and writing: "less than honorable intent reach for power" "to persons with an interest only in what is best for them personally, to the exclusion of all else" "Democracy dies in darkness." When in reality I invented three new pantets for the best of the whole Internet community and I will work to implement them if I will be elected: IPv4+ that will mitigate the "IPv4 Exhaustion" problem and will add more 4,294,967,296‬ IPv4 addresses: (can be implemented with software updates and not all internet hosts in the world will have to be updated - home routers and home modems which are the vast majority of routing equipment in the world - will not need to be updated and will support more 4,294,967,296 IPv4 addresses with IPv4+ ) https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003676.h… Completely mitigating the global email spam problem in a clean and automatic way: (and also mitigating the illegal anonymous organization "The Spamhaus Project") https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003778.h… Completely mitigating spoofed ip amplification DDoS attacks and spoofed ip traffic with is a source for criminality: https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003902.h… They ("The Spamhaus Project" mob) wants to keep controlling RIPE and any other internet organizations - I want to liberate RIPE - I want to make sure that that illegal anonymous organization that violates any thing which is sacred in the Interent (freedom, free speech and connectivity) - will have no footprint in RIPE. My full agenda can be read here: https://www.ripe.net/participate/meetings/gm/meetings/may-2020/candidate-bi… Ronald is afraid from me being elected because he knows that if I will be elected I will put an end to the illgal anonymous organization "The Spamhaus Project" which is intimidating and harassing many organizations and many businesses worldwide. Kind Regards, Elad ________________________________ From: NANOG <nanog-bounces(a)nanog.org> on behalf of Ronald F. Guilmette <rfg(a)tristatelogic.com> Sent: Wednesday, May 13, 2020 12:50 PM To: nanog(a)nanog.org <nanog(a)nanog.org> Subject: RIPE NCC Executive Board election Many of you here may be dues-paying members of both ARIN and RIPE. Those of you who are may wish to be aware of the fact that there will be an election held on (I believe) May 14th, just a day or two from now, for three open RIPE NCC Executive Board seats. I have it on good authority that one of the candidates running for the open RIPE NCC board seats in this election has hired legal counsel in South Africa, and that said legal counsel has then proceeded to threaten various officials of the City of Cape Town, South Africa with possible legal action if they do not relinquish to him their rights in and title to the 165.25.0.0/16 block, a block that all historical records, including even ARIN "WhoWas" historical records show, clearly and unambiguously, has been legally registered to the City of Cape Town for over twenty years. (I am assured that at no time did the City of Cape Town ever sell, trade, or barter away their rights to this valuable IPv4 block, and that they are defending themselves, as best as they can, against this attempt to extort them out of their rightful prooperty.) Where I come from, this kind of thing is called barratry, but you be the judge. In any case, prior to the RIPE election, I wanted to let you all know these facts about the candidate in question, as well as a number of additional startling facts relating to the people who nominated this candidate for a RIPE NCC Executive board seat, as documented by my friend, South African journalist Jan Vermeulen: https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-… I could go into more detail about many of the nominators mentioned in the above article, but I don't want to make this email too long, so I'll await some explict request for that additional info. For now it should suffice to make at least some of the basic facts more widely available, a task which is accomplished just by sharing the above link, IMHO. Regards, rfg P.S. I have been specifically and explicitly enjoined and constrained from posting here anything at all that might smack of being either partisan or of an even vaguely "political" nature, and thus, I will refrain from doing so. I would be remiss hoever if I did not at least note in passing that history records that in times such as these, when people of good character and good intent are, as they rightly should be, focused on the health and safety of themselves, their loved ones, and their professional collegues, and when the gaze of the world is elsewhere, persons of less than honorable intent reach for power and, with unfortunate regularity, obtain it. I cannot and do not ask that those of you who have been saddled with personal or local crises during this sad time turn away from those responsibilities to give attention to matters of Internet governance, however urgent those may appear at the moment. For all of us, our first- order duty lies nearby, with family, friends, and collegues. But for those of you who still have a few cycles to spare, I do ask that you consider carefully the newfound and critical importance of this tool, this Internet, in the lives of so many millions, all around the world, and the self-evident risks of its governance being handed over, by default or otherwise, to persons with an interest only in what is best for them personally, to the exclusion of all else. P.P.S. I would be posting this info and the above link also to the very relevant RIPE members-discuss mailing list, but as I am not a due-paying member of RIPE, I have no ability to do so. Separately, due in no small part to the candidate's own recent and manifest on-list transgressions on that very list, that list has recently been switched to a heavy-handed moderation, under which, it seems, even discussion of the pros and cons of candidates in the upcoming RIPE NCC Executive Board election are now categorized as "too controversial" and thus, themselves, are now entirely off-limits. I cannot help but be reminded of a catch-phrase that I saw somewhere, not too long ago: "Democracy dies in darkness." -- anon

3 3

Board elections voting report
by Töma Gavrichenkov 15 May '20

15 May '20

Peace, This is not a complaint, but I just wonder why it usually takes around a week for the NCC to publish the voting report. That's just an export from some database, right? Why doesn't it just show up right after the elections end? -- Töma

5 4

Re: [members-discuss] Board elections voting report
by Terrence Koeman 15 May '20

15 May '20

You can find it here: https://www.ripe.net/participate/meetings/gm/meetings/may-2020/voting-report -- Regards, Terrence Koeman, PhD/MTh/BPsy Darkness Reigns (Holding) B.V. Please quote relevant replies. Spelling errors courtesy of my 'smart'phone. ________________________________ From: Töma Gavrichenkov <ximaera(a)gmail.com> Sent: Friday, 15 May 2020 16:20 To: members-discuss(a)ripe.net Subject: [members-discuss] Board elections voting report > Peace, > > This is not a complaint, but I just wonder why it usually takes around > a week for the NCC to publish the voting report. That's just an > export from some database, right? Why doesn't it just show up right > after the elections end? > > -- > Töma > > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/terrence%40darkness-…

1 0

FW: RIPE NCC Executive Board election
by Terrence Koeman 13 May '20

13 May '20

I believe the below message (posted to the NANOG list) and news article linked therein is of concern to RIPE members, especially those that are voting. -- Regards, Terrence Koeman, PhD/MTh/BPsy Darkness Reigns (Holding) B.V. Please quote relevant replies. Spelling errors courtesy of my 'smart'phone. ________________________________ From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Sent: Wednesday, 13 May 2020 11:51 To: nanog(a)nanog.org Subject: RIPE NCC Executive Board election > Many of you here may be dues-paying members of both ARIN and RIPE. > > Those of you who are may wish to be aware of the fact that there will > be an election held on (I believe) May 14th, just a day or two from > now, for three open RIPE NCC Executive Board seats. > > I have it on good authority that one of the candidates running for > the open RIPE NCC board seats in this election has hired legal > counsel in South Africa, and that said legal counsel has then > proceeded to threaten various officials of the City of Cape Town, > South Africa with possible legal action if they do not relinquish > to him their rights in and title to the 165.25.0.0/16 block, a > block that all historical records, including even ARIN "WhoWas" > historical records show, clearly and unambiguously, has been > legally registered to the City of Cape Town for over twenty years. > (I am assured that at no time did the City of Cape Town ever sell, > trade, or barter away their rights to this valuable IPv4 block, > and that they are defending themselves, as best as they can, against > this attempt to extort them out of their rightful prooperty.) > > Where I come from, this kind of thing is called barratry, but you > be the judge. > > In any case, prior to the RIPE election, I wanted to let you all > know these facts about the candidate in question, as well as a > number of additional startling facts relating to the people who > nominated this candidate for a RIPE NCC Executive board seat, as > documented by my friend, South African journalist Jan Vermeulen: > > https://mybroadband.co.za/news/internet/350973-man-connected-to-african-ip-… > > I could go into more detail about many of the nominators mentioned > in the above article, but I don't want to make this email too long, > so I'll await some explict request for that additional info. For now > it should suffice to make at least some of the basic facts more widely > available, a task which is accomplished just by sharing the above link, > IMHO. > > > Regards, > rfg > > > P.S. I have been specifically and explicitly enjoined and constrained > from posting here anything at all that might smack of being either > partisan or of an even vaguely "political" nature, and thus, I will > refrain from doing so. I would be remiss hoever if I did not at least > note in passing that history records that in times such as these, when > people of good character and good intent are, as they rightly should be, > focused on the health and safety of themselves, their loved ones, and > their professional collegues, and when the gaze of the world is elsewhere, > persons of less than honorable intent reach for power and, with unfortunate > regularity, obtain it. > > I cannot and do not ask that those of you who have been saddled with > personal or local crises during this sad time turn away from those > responsibilities to give attention to matters of Internet governance, > however urgent those may appear at the moment. For all of us, our first- > order duty lies nearby, with family, friends, and collegues. But for > those of you who still have a few cycles to spare, I do ask that you > consider carefully the newfound and critical importance of this tool, > this Internet, in the lives of so many millions, all around the world, > and the self-evident risks of its governance being handed over, by default > or otherwise, to persons with an interest only in what is best for them > personally, to the exclusion of all else. > > P.P.S. I would be posting this info and the above link also to the > very relevant RIPE members-discuss mailing list, but as I am not a > due-paying member of RIPE, I have no ability to do so. Separately, > due in no small part to the candidate's own recent and manifest on-list > transgressions on that very list, that list has recently been switched > to a heavy-handed moderation, under which, it seems, even discussion of > the pros and cons of candidates in the upcoming RIPE NCC Executive Board > election are now categorized as "too controversial" and thus, themselves, > are now entirely off-limits. > > I cannot help but be reminded of a catch-phrase that I saw somewhere, > not too long ago: > > "Democracy dies in darkness." > -- anon

1 0

Re: [members-discuss] Mass emailing towards LIRs contacts, from a Board candidate
by Terrence Koeman 13 May '20

13 May '20

First of all, RIPE doesn't own the IP addresses allocated to it. Why would you just assume they do? Somehow you've decided that RIPE owns the IP ranges and we (LIRs) just get to borrow them from RIPE and therefore leasing a legitimately acquired block to someone else that needs it is forbidden or something. All that is completely false. Please educate yourself by reading the relevant policies before doling out wrong advice and unnecessarily burdening RIPE with your emails (which is probably why they ignore or trash them). -- Regards, Terrence Koeman, PhD/MTh/BPsy Darkness Reigns (Holding) B.V. Please quote relevant replies. Spelling errors courtesy of my 'smart'phone. ________________________________ From: "Stuart Willet (primary)" <stu(a)safehosts.co.uk> Sent: Wednesday, 13 May 2020 06:15 To: Bill Lewis; members-discuss(a)ripe.net Subject: Re: [members-discuss] Mass emailing towards LIRs contacts, from a Board candidate > I have a default reply for these... > > Hi, > > If you have unused IPv4 it should be returned to the pool. > RIPE own the IP addresses, not you. > > I have informed RIPE of your position. > > Best regards, > > > I then forward the email off to RIPE. > Nothing ever seems to happen though, which is odd given that RIPE are the actual owners of the IP addresses it should be simple for them to reclaim any listed as for sale or lease? > > > Best, > > Stuart Willet > > > -----Original Message----- > From: members-discuss [mailto:members-discuss-bounces@ripe.net] On Behalf Of Bill Lewis > Sent: 08 May 2020 19:59 > To: members-discuss(a)ripe.net > Subject: Re: [members-discuss] Mass emailing towards LIRs contacts, from a Board candidate > > Hi, > > Not getting this at least but have had an email from a company that leases IP4 space, sent to the email address used for our Ripe account (not on any of our IP records). > > Apparently has /22 blocks they would like to rent out, surely unused blocks should be in Ripe's hands, not profiteers? > > just a thought and how they gained the email address too. Anybody else had this? > > Bill > > On 08/05/2020 07:53, Benjamin Collet wrote: > > On Thu, May 07, 2020 at 08:57:28AM +0200, Clement Cavadore wrote: > >> I have received multiple times (to many of the LIRs I manage contact > >> emails), this night, an e-mail coming from a RIPE NCC Board > >> candidate, who promotes his candidacy. Be his candidacy admissible > >> and decent or not, is not the point. But, is that kind of mass-mailing correct ? > > I also got this email (have a guess whom it was from…). I believe this > > kind of mass-mailing is in direct violation of article 4 - section 4 > > of RIPE DB terms and conditions > > (https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms) > > > > > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/ripe%40metroswitch.c… > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/terrence%40darkness-…

1 0

Re: [members-discuss] Mass emailing towards LIRs contacts, from a Board candidate
by Terrence Koeman 13 May '20

13 May '20

Since ipv4 will run out one way or another, the short version is that RIPE/membership has decided not to waste resources aggressively reclaiming ipv4 (and only stay certain execution a short time), but to put those towards getting ipv6 adopted. Ipv4 is left to the market (the profiteers), so buying/selling & renting/leasing space one has acquired legitimately is allowed. -- Regards, Terrence Koeman, PhD/MTh/BPsy Darkness Reigns (Holding) B.V. Please quote relevant replies. Spelling errors courtesy of my 'smart'phone. ________________________________ From: Bill Lewis <Bill.lewis(a)kijoma.co.uk> Sent: Wednesday, 13 May 2020 05:11 To: members-discuss(a)ripe.net Subject: Re: [members-discuss] Mass emailing towards LIRs contacts, from a Board candidate > Hi, > > Not getting this at least but have had an email from a company that leases IP4 space, sent to the email address used for our Ripe account (not on any of our IP records). > > Apparently has /22 blocks they would like to rent out, surely unused blocks should be in Ripe's hands, not profiteers? > > just a thought and how they gained the email address too. Anybody else had this? > > Bill > > On 08/05/2020 07:53, Benjamin Collet wrote: > > On Thu, May 07, 2020 at 08:57:28AM +0200, Clement Cavadore wrote: > >> I have received multiple times (to many of the LIRs I manage contact > >> emails), this night, an e-mail coming from a RIPE NCC Board candidate, > >> who promotes his candidacy. Be his candidacy admissible and decent or > >> not, is not the point. But, is that kind of mass-mailing correct ? > > I also got this email (have a guess whom it was from…). I believe this > > kind of mass-mailing is in direct violation of article 4 - section 4 of > > RIPE DB terms and conditions > > (https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms) > > > > > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/terrence%40darkness-…

1 0

Re: [members-discuss] Mass emailing towards LIRs contacts, from a Board candidate
by Stuart Willet (primary) 11 May '20

11 May '20

I have a default reply for these... Hi, If you have unused IPv4 it should be returned to the pool. RIPE own the IP addresses, not you. I have informed RIPE of your position. Best regards, I then forward the email off to RIPE. Nothing ever seems to happen though, which is odd given that RIPE are the actual owners of the IP addresses it should be simple for them to reclaim any listed as for sale or lease? Best, Stuart Willet -----Original Message----- From: members-discuss [mailto:members-discuss-bounces@ripe.net] On Behalf Of Bill Lewis Sent: 08 May 2020 19:59 To: members-discuss(a)ripe.net Subject: Re: [members-discuss] Mass emailing towards LIRs contacts, from a Board candidate Hi, Not getting this at least but have had an email from a company that leases IP4 space, sent to the email address used for our Ripe account (not on any of our IP records). Apparently has /22 blocks they would like to rent out, surely unused blocks should be in Ripe's hands, not profiteers? just a thought and how they gained the email address too. Anybody else had this? Bill On 08/05/2020 07:53, Benjamin Collet wrote: > On Thu, May 07, 2020 at 08:57:28AM +0200, Clement Cavadore wrote: >> I have received multiple times (to many of the LIRs I manage contact >> emails), this night, an e-mail coming from a RIPE NCC Board >> candidate, who promotes his candidacy. Be his candidacy admissible >> and decent or not, is not the point. But, is that kind of mass-mailing correct ? > I also got this email (have a guess whom it was from…). I believe this > kind of mass-mailing is in direct violation of article 4 - section 4 > of RIPE DB terms and conditions > (https://www.ripe.net/manage-ips-and-asns/db/support/documentation/terms) > _______________________________________________ members-discuss mailing list members-discuss(a)ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/ripe%40metroswitch.c…

1 0

Re: [members-discuss] Placing Members-Discuss in Moderation
by Terrence Koeman 11 May '20

11 May '20

"freedom of expression" and not having "censorship" are not just legal issues restraining governments, but principles that we should strive for at any level of communication in a free society. That "most counties" have places limits on it is in no way an argument for whether it's a good idea to do so by governments or elsewhere (nor of whether they had the right to do it or if even had the intended effect). That there is no legal right to not be censored "on some mailinglist" (by RIPE or anyone else) doesn't mean there's not a moral right or that it isn't a good idea in general to allow maximum free expression. Consider that the fact that Elad had the opportunity to show us all what kind of person he is almost certainly caused people (including me) to register to vote to prevent him from getting any kind of power in RIPE. This is free expression directly leading to more democracy, the fact that some people may have been annoyed, offended or hurt doesn't, in my opinion, weigh up to that result at all. Reacting to free expression functioning as intended by applying censorship is the exact wrong thing to do, both morally and practically. -- Regards, Terrence Koeman, PhD/MTh/BPsy Darkness Reigns (Holding) B.V. Please quote relevant replies. Spelling errors courtesy of my 'smart'phone. ________________________________ From: Sebastian Wiesinger <sebastian.wiesinger(a)noris.net> Sent: Thursday, 7 May 2020 17:33 To: members-discuss(a)ripe.net Subject: Re: [members-discuss] Placing Members-Discuss in Moderation > > > > On 4. May 2020, at 10:06, Chris Izzard <chris.izzard(a)imcisland.is> wrote: > > > > Dear Piotr, > > Reading this it sounds great at first but whatever you do to stop such huge email chains will always look like censorship whatever you like to call it. Such email lists do depend on the behaviour of everyone to follow a code but in practice this is usually not 100% possible. > > Yes it seemed that the email list was mostly in favour of censoring one person but the reality is that the vast majority just watched on and said nothing. In practice censoring damages the democratic credentials of this group because a small number of people have made the decision to do this and an even smaller number of people will police it. > > This action has put the Executive Board in a dangerous position open to all kinds of criticism and the email chain contained some pretty bad claims like Anti-Semitism. > > > > Hello, > > I see no dangerous position right now. > > 1) The moderation is for a limited time > 2) You can still see all moderated mails at https://www.ripe.net/ripe/mail/archives/members-discuss-unmoderated/ <https://www.ripe.net/ripe/mail/archives/members-discuss-unmoderated/> so there is no censorship > 3) Multiple calls to adhere to the code of conduct and the topic of the mailinglist were completely ignored on purpose (in my opinion with malicious intent) > 4) The "small group of people" is the executive board that we democratically voted on, so I don't see how this is undemocratic. I would even say this is exactly the type of issue that the board should decide > > On the contrary I (and expect other people) did not say anything as to not contribute to the flood of mails. I'm very grateful that this list is now moderated and I hope that this can be lifted after the election. > > Also, just make to make it clear: "freedom of expression" should prevent the government from censoring you, it does not prevent you from getting moderated on some mailinglist. On the contrary most countries have rules that limit freedom of expression and this mailinglist has rules as well. > > > Best Regards > > Sebastian > >

2 1

Mass emailing towards LIRs contacts, from a Board candidate
by Clement Cavadore 10 May '20

10 May '20

Fellow members, I have received multiple times (to many of the LIRs I manage contact emails), this night, an e-mail coming from a RIPE NCC Board candidate, who promotes his candidacy. Be his candidacy admissible and decent or not, is not the point. But, is that kind of mass-mailing correct ? Is there an abuse contact for such a behaviour ? Thanks ! -- Clément Cavadore

13 13

Placing Members-Discuss in Moderation
by Piotr Strzyżewski 08 May '20

08 May '20

Dear members, Today, the Executive Board held a formal meeting in order to officially resolve the appointment of Hans Petter Holen as Managing Director of the RIPE NCC. In light of recent activity on the members-discuss mailing list, we also resolved to place the members-discuss mailing list in moderation until 1 June. This follows numerous complaints that have been made about mails that are off-topic and/or contain material that does not show tolerance or respect for fellow members of the list. The resolution and accompanying text is contained in the draft minutes: https://www.ripe.net/about-us/executive-board/minutes/2020/minutes-134th-ex… With this resolution, the principles of the RIPE Mailing List/RIPE Forum Code of Conduct will be applied to the members-discuss list. Emails that do not meet the requirements of that code of conduct will not be approved to be posted to the list. Mails that do not meet the intended purpose of providing members with a means to discuss membership issues among themselves will also not be approved to be posted to the list. The moderators of the list will be the Executive Board Secretary and one senior member of RIPE NCC staff. Mails will be moderated during office hours. A separate archive of all mails including those rejected by the moderators is available for all members to view should they wish to do so: https://www.ripe.net/ripe/mail/archives/members-discuss-unmoderated/ The Board is obviously aware that there is an election taking place at the General Meeting and there are also matters of importance to discuss such as the RIPE NCC Financial Report 2019 and the RIPE NCC Charging Scheme 2021. We are determined to ensure that we remain neutral in facilitating this membership discussion list, and we also hope that members will abide by the purpose of the list and the principles of the code of conduct. Regards, Piotr Strzyżewski RIPE NCC Executive Board Secretary

10 11

Technical solution to resolve ELAD-19 related spam and harassment in mailboxes
by Dominic Schallert 01 May '20

01 May '20

Dear community, today I want to present you with our technical solution to prevent ELAD-19 related spam and harassment from flooding inboxes. This technical solution is minimal invasive and can be implemented on all mail servers running spamassassin with ease. Please find the following spamassassin header and body rules below: header SC_HEADER_100 From =~ /Elad Cohen/ describe SC_HEADER_100 ELAD-19 Campagin score SC_HEADER_100 100 header SC_HEADER_101 From =~ /elad\(a)netstyle.io/ describe SC_HEADER_101 ELAD-19 Campagin score SC_HEADER_101 100 body SC_BODY_102 /Elad Cohen/i describe SC_BODY_102 ELAD-19 Campagin score SC_BODY_102 100 While I really appreciate encouraged people coming up with innovative ideas and proposals within the network operators community, this particular discussion including repeated harassment against members of the community - from my personal point of view - is just not the culture we should establish within this community. Please note that the solution presented above is just our new way of dealing with this matter, it’s neither a proposal nor a recommendation for others. All the best and wish you a happy (and hopefully spam free) weekend!

4 5

Re: [members-discuss] Elad / His Ideas ?
by Ali Vargonen 01 May '20

01 May '20

* Sorry to take anyone's valuable time, but I think this is necessary. Hello Elad, Please read my email carefully I would be very happy if you can answer my questions, this way it would be much clear for everyone in the list to understand, what you are trying to achieve. 1) VERY Important, I am not attacking you. I am going to ask questions to learn more about your idea and yourself. 2) I don't support any candidate so I am not voting for anyone else or you. So; don't tell me that I will support someone else, thus I am asking you questions. 3) I don't have a hidden agenda about IP V4 or V6, and I personally don't sell them. Let's start with questions; I will share your answers with my friends who work in the network field. We have a small group of 40 people and our total experince in routing is 650 years. - You have an idea, OK. 1) Did you make any research about to implement your idea, in regards to economics, and adaptation rates around the globe? 2) Do you personally or worked with a team of people who designed the chips on the routers or the software runs on them, I want to learn this very much, maybe you have designed a software which we don't know, that is running currently and you want to improve it. 3) Do you personally own or work with a team of people who have patents for the current protocols including the ones you mention and try to improve? 4) Do you have a team to implement your idea work together, if yes please share their names with details on a website, so we could understand how good you structure your team to make your ideas true? 5) Do you or your "maybe" existing team know how routers work, if you wish we can choose cisco, juniper, extreme, brocade anything you wish, I want to learn did you studied about their current working software setup dealing with BGP and how they manage the traffic and do you have a blueprint of the changes that you want to be implemented in regards to packet processing and cam/fib tables? 6) Did you contact any vendor about your idea before implementing your changes to their equipment via hardware or software solution? 7) If you contacted them what kind of replies did you get? ( You tell us nobody understands your idea, maybe they understand, so I want to learn) or did they attack you also? 8) Did you ever worked in a network ecosystem with more than 5+ BGP peers and also 100G + network traffic before, if yes could you please explain me how does your idea fit with the ack of the source in this amount of traffic, you can calculate the number of packets per seconds yourself if you know. 9) How do you plan to run the backend do you have any kind of blueprint, design or project about that, let us see that also? It can be just your notes, can you give an URL that we can read about it? 10) Do you have a working model of this "idea" in any kind of test lab you have or rented that works on software-based routing devices? Virtual Routers? What are the results you get there? Any information on this? I am asking all these questions to you to learn more about you and your project. My notes for you; - You don't need to be a ripe chair if you want to change the world in regards to networking to a better place, you don't need titles Elad, you just need really good ideas that people respect and which you could provide with more detailed information. - Also please don't tell everyone is attacking you, if you think they are, why you are saying this" they are attacking me because of"; instead fight with your ideas, bright thoughts, what you bring on the table? But also please don't forget that, as a leader or a chair, whatever you call, you must; - Respect people, if they agree or disagree with you; - Listen and understand why they are reacting to you that way; - Always try to be co-operative, and you may answer them like this, "I respect your answer but we don't agree on this topic." This is better than writing "They are attacking me 100x times" If you want to be successful in your campaign, you must not do it over member's forum, you can lunch a website, do it over twitter, create a blog, or what you think fits you; fill it with content, and share as much as possible information. Please let us know you and your ideas more. If we have questions about it we could ask it over there, don't take people's valuable time with these arguments. Respecting your community must be your rule number one if you plan to lead them. Don't worry, If people have an interest in your ideas they will contact you. As I told you while starting this email, I am not attacking you, just trying to know more about yourself and your idea. IF; You answer this email with; 1) You are attacking me. 2) I don't have to provide any detailed information about my idea. 3) I don't have to respect anyone and will just answer like before. 4) I don't need to explain anything you will see how I achive them when I am the chair of RIPE. Sorry, but as lots of people do I will choose not to answer you back again. Please think 2-3 times and then answer. Show us that why we must vote for you because of your intelligence, personality, interpersonal skills, leadership and also way you communicate with your community? Regards, Ali.

1 0

Mailing List Purpose and Request for Consideration
by Piotr Strzyżewski 01 May '20

01 May '20

Dear all, I would like to remind you of the purpose of this list. It is to allow members to discuss matters of importance relating to their membership of the RIPE NCC. All other topics should be considered not relevant for this list. The Board is always pleased to see good discussion on the list, and we realise this can become heated at times. However, thousands of members are subscribed to the list and receive these emails. Therefore, I ask you to be considerate of your fellow members in terms of both content and frequency of mails. For those who wish to unsubscribe, please read the information available at: https://www.ripe.net/participate/member-support/membership-mailing-lists/su… Kind regards, Piotr Strzyżewski RIPE NCC Executive Board Secretary

2 1

Good to know
by ivaylo 01 May '20

01 May '20

Hello, Even all of us to seeing this discussion as spam. I think it is useful and all candidates for election must write their ideas and point of views too. Now I can clearly make my judgment if to give my vote for mr Elad Khoen or not. PS: The spamming come from all who try to respond to these technical ideas. So please stop ! Just read make your mind and lets hear the others candidates.

8 14

Re: [members-discuss] Technical solution to resolve Spoofed IP traffic, Spoofed amplification DDoS attacks, BGP&RIR hijacking, IoT botnet infections and Botnet C&Cs
by Melchior Aelmans 01 May '20

01 May '20

LOL On Fri, May 1, 2020 at 1:08 AM Thilo <inbox(a)tmo.sh> wrote: > IAB is also having open chair positions if this is something out of > interest. > > Am Fr., 1. Mai 2020 um 00:53 Uhr schrieb Melchior Aelmans < > melchior(a)aelmans.eu>: > >> As this idea is talking about BGP implementations I think this would >> belong in the IDR WG in IETF? >> >> On Thu, Apr 30, 2020 at 10:32 PM Elad Cohen <elad(a)netstyle.io> wrote: >> >>> Hello Ripe Members! >>> >>> I will share the following solution in the near General Meeting and I'm >>> interested to share the following technical solution with you as well, it >>> will completely resolve: Spoofed IP traffic, Spoofed amplification DDoS >>> attacks, BGP&RIR hijacking. And will dramatically lower: IoT botnet >>> infections and Botnet C&Cs. >>> >>> By a single update to any BGP router, not any router needs to be >>> updated, only active BGP routers. If I will have the honor of being elected >>> to the Ripe Board I will harness all the power of Ripe and all of the 5 >>> RIR's and all of the LIR's in the 5 RIR's so routing manufacturing >>> companies will implement the below processes and methods with a single >>> firmware update to their BGP routers. >>> >>> I'm asking for your support in electing me so I will be able to enter >>> the Ripe Board and then I will be able to make everything which is written >>> in this post to come true. >>> >>> >>> Regarding the bgp-anycasted infrastructure written below, ICANN is >>> written but the global bgp-anycasted infrastructure can be managed by the 5 >>> RIR's and/or by the ccTLDs registries (my main point is that who will >>> operate the bgp-anycasted infrastructure is not important for now, as long >>> as it will be an agreed authoritative non-governmental non-commercial >>> global entity/ies) >>> >>> With new tracking protocol over ip, routers will be able to confirm that >>> source ip came from the network of the announcing ASN, and hence spoofed >>> amplification DDoS attacks will be completely annihilated. >>> >>> >>> The Process: >>> >>> At the source BGP router, for any ip packet with a source address that >>> is from the network of the source BGP router (lets call it original ip >>> packet) - the source BGP router will create a new ip packet (lets call it >>> tracking ip packet) with a new transport layer protocol and with the same >>> source address and with the same destination address and with the same >>> IP-ID such as the original ip packet. >>> >>> In the new tracking ip packet there will be a new transport layer >>> protocol (tracking protocol) with the following fields: >>> AS number of source BGP router in clear text >>> AS number of source BGP router encrypted with the private key of the >>> source BGP router >>> >>> The destination BGP router (a BGP router that the destination address is >>> in its network) whenever it receive a 'tracking ip packet' will check if >>> its have the internal boolean 'Check tracking flag' in it - 'on' or 'off': >>> If 'off' then the destination BGP router will drop that 'tracking ip >>> packet' >>> >>> If 'on' then the destination BGP router will decrypt the 'encrypted AS >>> number' with the public key of the specific AS number >>> and after decryption the AS number need to be the result: >>> if not then to drop the tracking ip packet and the original ip packet >>> related to it >>> if yes then to drop the tracking ip packet and to forward the related >>> original ip packet to destination but only if the source address is >>> originated from the specific ASN (according to the local ASNs+ranges table >>> in the BGP router, such table will be received from ICANN) >>> >>> >>> If the 'Check tracking flag' is set to 'on' then any original ip packet >>> that arrive to the destination BGP router will wait for the related >>> tracking ip packet (in case the related tracking ip packet didn't already >>> arrived to the destination BGP router). The destination BGP router will >>> manage such waiting for X number of seconds. >>> >>> The destination BGP router will match between a tracking ip packet and >>> an original ip packet - based on their source address and their destination >>> address and their IP-ID which will all be identical. >>> >>> >>> >>> More Aspects: >>> >>> - The end-devices will not need to be updated, any router will not need >>> to be updated, only all the BGP routers will need to be updated. >>> - Any BGP router in the routing path, which the original ip packet and >>> the tracking ip packet are not destined to an ip address in its own network >>> - will not check the content of the tracking ip packet and will forward >>> both the tracking ip packet and the original ip packet as they are. >>> - Each BGP router will have all the public keys (of all the ASN's) >>> locally. >>> - Each BGP router will have a full list of all the ASN's and all the >>> route objects ranges which are related to them locally. >>> >>> >>> >>> How BGP routers will receive all the ranges in all the route objects of >>> all the ASNs (in the 5 RIRs) and all the public keys of all the ASNs (for >>> decrypting the encrypted strings in 'tracking ip packets'): >>> >>> - Each BGP router will create a tcp session with ICANN backend >>> infrastructure (the backend infrastructure of ICANN will use BGP anycast >>> and will be available from many locations worldwide with automatic syncing) >>> - At this stage there will be a handshake process between the BGP router >>> and the ICANN backend infrastructure in order for ICANN to know the correct >>> ASN which is operating the BGP router - the BGP router will send its ASN in >>> cleartext and also its ASN encrypted with its >>> ICANN-communication-private-key , ICANN will know the related public key >>> for the specific ASN from the specific ASN object in the RIR (the public >>> key for communication with ICANN will be displayed there) - after >>> decryption ICANN will compare the decrypted string to the AS Number for >>> successful authentication. >>> - After successful authentication, all the communication will be >>> encrypted, ICANN will notify the BGP router about its public key and ICANN >>> will use the public key of the ASN for the communication with ICANN - from >>> the ASN object in the RIR. >>> - The BGP router will send over the session its public key to be used by >>> other BGP routers in order to decrypt the encrypted string in the tracking >>> ip packets that it will originate (that private key and public key will be >>> managed in the BGP router GUI or CLI). >>> - ICANN will notify all the other BGP routers through the sessions with >>> them about a newly updated such public key of any other BGP router. >>> - ICANN will also receive in real-time any route object >>> creation/modification/deletion notification from any of the 5 RIRs and will >>> then update all the BGP routers through all of their sessions. >>> >>> - In case a BGP router doesn't have an active session to ICANN backend >>> infrastructure (for any reason, might be due to networking issue) - then >>> temporarily the internal 'Check tracking flag' of it will be set to 'off'. >>> After the session with ICANN backend infrastructure will be re-established >>> and the BGP router will receive all the meantime updates - the boolean >>> value of 'Check internal flag' will return to initial state. >>> - Any update from ICANN backend infrastructure to a BGP router (such as >>> a public key of another BGP router, or a routing object update) - will be >>> confirmed that the update was received well by the BGP router side. >>> >>> >>> >>> 'Check tracking flag' in BGP Routers: >>> >>> - BGP routers, in their GUI and CLI interfaces - will not allow the >>> end-user to set the boolean value of 'Check tracking flag', in order to >>> avoid misconfiguration. >>> - The ICANN backend infrastructure through the session with the BGP >>> router - will be able to set the boolean value of the 'Check tracking flag'. >>> - The reason for it, is that if 'Check tracking flag' will be set on >>> some destination BGP routers while some other source BGP routers weren't >>> upgraded yet (and will not send the 'tracking ip packet' due to it) - then >>> 'tracking ip packet' will never reach the destination BGP router and the >>> internet will break. >>> - Central setting of 'Check tracking flag' through ICANN backend >>> infrastructure - will allow ICANN to inform all the BGP routers at once to >>> switch 'on' the 'Check tracking flag' >>> - ICANN, in the session to any BGP router, will also receive the >>> percentage of ip packets that were destained to that BGP router network - >>> that also had ip tracking packets, in this way ICANN will know when all the >>> BGP routers were properly globally updated and when it is time to enable >>> the 'Check tracking flag' in all the BGP routers. >>> - ICANN will know if all the BGP routers in the world were upgraded >>> based on keeping the full BGP table and comparing it to all the BGP routers >>> that did and that did not open a session to ICANN backend infrastructure. >>> >>> >>> >>> Automatic preventation of IoT botnet infections: >>> >>> - IoT botnets are based on default credentials, if we can block default >>> credentials of IoT devices then these kind of botnets (such as >>> Mirai-variants and similar) will stop to have an impact in the internet. >>> - The data field in an ip packet - will always be the same for an access >>> attempt to a IoT device with default credentials - hence these kind of "IP >>> protocol data fingerprints" which are related to specific "IP protocol >>> numbers" will be provided by ICANN backend infrastructure to each BGP >>> router through the opened session with it. >>> - There are two issues with matching incoming ip packets to the "locally >>> stored IP protocol data fingerprints" - the first one is that ip packets >>> can be sent by fragments (so not all the data field will be sent at once in >>> order to be able to be compared with the locally stored data fingerprints) >>> and the second is that usernames (or url's) or any other textual data in >>> the incoming ip packet data field can be in uppercase or in lowercase. In >>> order to overcome the possibility of the existence of a single data >>> fingerprint in multiple incoming ip packet fragments - then in case the BGP >>> router is recognizing the incoming fragmented ip packet data value as part >>> of an existing fingerprint data in its local database then it will keep >>> track of the arrival ip packet fragments based on their specific IP-ID >>> identifier and the BGP router will not forward the last ip packet fragment >>> if the last ip packet fragment will cause all the related ip packet >>> fragments to match a specific ip fingerprint data (last ip packet doesn't >>> have to be the last fragmented part but it is the last ip packet that >>> arrived with that IP-ID identifier, so the BGP router will keep track of >>> the specific fragmented IP packets that arrived and their indexes in order >>> to know when the last one of them arrived). Regarding the second issue - >>> the stored data fingerprints in the local BGP router will be stored in a >>> way that some bytes of them (in specific indexes) will not be compared and >>> in case all the other bytes will match - then the bytes in these indexes - >>> will first be lowered case - and only then comparison will be made to the >>> specific indexed bytes in the specific ip packet data fingerprint. >>> - In case a IoT device behind a BGP router will be infected somehow (for >>> example when a specific fingerprint data with default credentials for a >>> specific device wasn't updated yet through ICANN backend infrastructure), >>> it will be able to infect all the other IoT devices in the local network >>> when the connectivity to them is not through the BGP router, that kind of >>> impact will be much much lower than infected IoT device which can infect >>> any other IoT device in the internet and then massive botnets in the >>> internet are created which are being used for DDoS. >>> >>> >>> >>> Automatic prevention of botnet C&C ip addresses: >>> >>> - Botnets C&C are also a problem in the internet. >>> - This problem can be overcome using the following technical addition: >>> the 5 RIR's will operate end-users honeypots machines all over the world >>> (it will be implemented by a single physical machine in each location, for >>> example in each datacenter and in each major ISP, each single physical >>> machine will emulate a virtual router and virtual VM's, the virtual VM's >>> will emulate many different kinds of 'real world machines', any kind of >>> automatic updating (in the operating system configurations) will be >>> disabled, these honeypots machines are not intended to make any outgoing >>> connection, the virtual routers will monitor if any outgoing connection is >>> made and if yes then it is to a botnet C&C, the virtual router will update >>> the ICANN backend infrastructure regarding it and the ICANN backend >>> infrastructure will update all the BGP routers (in their open sessions) >>> regarding it to completely block any communication to that botnet C&C ip >>> address. There will be a web-based system and only the related Law >>> Enforcement Agency of that C&C ip address region - will be able to remove >>> that C&C ip address from being blocked after their manual check. >>> - Honeypot machines will be deployed using 'templates' - these templates >>> must be signed and not anyone can create them, they should be created and >>> signed by an agreed Law Enforcement Agency such as Interpol in order to >>> make sure that these templates are by-design not making any outgoing >>> connection. The templates will be deployed in an automatic way (major ISP's >>> and datacenters will be able to easily add a 'physical honeypot' server in >>> their network, that will be shipped to them), the re-initiation of a >>> compromised 'virtual machine' that made an outgoing connection - will also >>> be automatic through the system in the physical server. >>> >>> >>> Respectfully, >>> Elad >>> >>> _______________________________________________ >>> members-discuss mailing list >>> members-discuss(a)ripe.net >>> https://lists.ripe.net/mailman/listinfo/members-discuss >>> Unsubscribe: >>> https://lists.ripe.net/mailman/options/members-discuss/ripe-members-discuss… >>> >> _______________________________________________ >> members-discuss mailing list >> members-discuss(a)ripe.net >> https://lists.ripe.net/mailman/listinfo/members-discuss >> Unsubscribe: >> https://lists.ripe.net/mailman/options/members-discuss/ripe%40tmo.sh >> >

3 2

Technical solution to resolve Spoofed IP traffic, Spoofed amplification DDoS attacks, BGP&RIR hijacking, IoT botnet infections and Botnet C&Cs
by Elad Cohen 01 May '20

01 May '20

Hello Ripe Members! I will share the following solution in the near General Meeting and I'm interested to share the following technical solution with you as well, it will completely resolve: Spoofed IP traffic, Spoofed amplification DDoS attacks, BGP&RIR hijacking. And will dramatically lower: IoT botnet infections and Botnet C&Cs. By a single update to any BGP router, not any router needs to be updated, only active BGP routers. If I will have the honor of being elected to the Ripe Board I will harness all the power of Ripe and all of the 5 RIR's and all of the LIR's in the 5 RIR's so routing manufacturing companies will implement the below processes and methods with a single firmware update to their BGP routers. I'm asking for your support in electing me so I will be able to enter the Ripe Board and then I will be able to make everything which is written in this post to come true. Regarding the bgp-anycasted infrastructure written below, ICANN is written but the global bgp-anycasted infrastructure can be managed by the 5 RIR's and/or by the ccTLDs registries (my main point is that who will operate the bgp-anycasted infrastructure is not important for now, as long as it will be an agreed authoritative non-governmental non-commercial global entity/ies) With new tracking protocol over ip, routers will be able to confirm that source ip came from the network of the announcing ASN, and hence spoofed amplification DDoS attacks will be completely annihilated. The Process: At the source BGP router, for any ip packet with a source address that is from the network of the source BGP router (lets call it original ip packet) - the source BGP router will create a new ip packet (lets call it tracking ip packet) with a new transport layer protocol and with the same source address and with the same destination address and with the same IP-ID such as the original ip packet. In the new tracking ip packet there will be a new transport layer protocol (tracking protocol) with the following fields: AS number of source BGP router in clear text AS number of source BGP router encrypted with the private key of the source BGP router The destination BGP router (a BGP router that the destination address is in its network) whenever it receive a 'tracking ip packet' will check if its have the internal boolean 'Check tracking flag' in it - 'on' or 'off': If 'off' then the destination BGP router will drop that 'tracking ip packet' If 'on' then the destination BGP router will decrypt the 'encrypted AS number' with the public key of the specific AS number and after decryption the AS number need to be the result: if not then to drop the tracking ip packet and the original ip packet related to it if yes then to drop the tracking ip packet and to forward the related original ip packet to destination but only if the source address is originated from the specific ASN (according to the local ASNs+ranges table in the BGP router, such table will be received from ICANN) If the 'Check tracking flag' is set to 'on' then any original ip packet that arrive to the destination BGP router will wait for the related tracking ip packet (in case the related tracking ip packet didn't already arrived to the destination BGP router). The destination BGP router will manage such waiting for X number of seconds. The destination BGP router will match between a tracking ip packet and an original ip packet - based on their source address and their destination address and their IP-ID which will all be identical. More Aspects: - The end-devices will not need to be updated, any router will not need to be updated, only all the BGP routers will need to be updated. - Any BGP router in the routing path, which the original ip packet and the tracking ip packet are not destined to an ip address in its own network - will not check the content of the tracking ip packet and will forward both the tracking ip packet and the original ip packet as they are. - Each BGP router will have all the public keys (of all the ASN's) locally. - Each BGP router will have a full list of all the ASN's and all the route objects ranges which are related to them locally. How BGP routers will receive all the ranges in all the route objects of all the ASNs (in the 5 RIRs) and all the public keys of all the ASNs (for decrypting the encrypted strings in 'tracking ip packets'): - Each BGP router will create a tcp session with ICANN backend infrastructure (the backend infrastructure of ICANN will use BGP anycast and will be available from many locations worldwide with automatic syncing) - At this stage there will be a handshake process between the BGP router and the ICANN backend infrastructure in order for ICANN to know the correct ASN which is operating the BGP router - the BGP router will send its ASN in cleartext and also its ASN encrypted with its ICANN-communication-private-key , ICANN will know the related public key for the specific ASN from the specific ASN object in the RIR (the public key for communication with ICANN will be displayed there) - after decryption ICANN will compare the decrypted string to the AS Number for successful authentication. - After successful authentication, all the communication will be encrypted, ICANN will notify the BGP router about its public key and ICANN will use the public key of the ASN for the communication with ICANN - from the ASN object in the RIR. - The BGP router will send over the session its public key to be used by other BGP routers in order to decrypt the encrypted string in the tracking ip packets that it will originate (that private key and public key will be managed in the BGP router GUI or CLI). - ICANN will notify all the other BGP routers through the sessions with them about a newly updated such public key of any other BGP router. - ICANN will also receive in real-time any route object creation/modification/deletion notification from any of the 5 RIRs and will then update all the BGP routers through all of their sessions. - In case a BGP router doesn't have an active session to ICANN backend infrastructure (for any reason, might be due to networking issue) - then temporarily the internal 'Check tracking flag' of it will be set to 'off'. After the session with ICANN backend infrastructure will be re-established and the BGP router will receive all the meantime updates - the boolean value of 'Check internal flag' will return to initial state. - Any update from ICANN backend infrastructure to a BGP router (such as a public key of another BGP router, or a routing object update) - will be confirmed that the update was received well by the BGP router side. 'Check tracking flag' in BGP Routers: - BGP routers, in their GUI and CLI interfaces - will not allow the end-user to set the boolean value of 'Check tracking flag', in order to avoid misconfiguration. - The ICANN backend infrastructure through the session with the BGP router - will be able to set the boolean value of the 'Check tracking flag'. - The reason for it, is that if 'Check tracking flag' will be set on some destination BGP routers while some other source BGP routers weren't upgraded yet (and will not send the 'tracking ip packet' due to it) - then 'tracking ip packet' will never reach the destination BGP router and the internet will break. - Central setting of 'Check tracking flag' through ICANN backend infrastructure - will allow ICANN to inform all the BGP routers at once to switch 'on' the 'Check tracking flag' - ICANN, in the session to any BGP router, will also receive the percentage of ip packets that were destained to that BGP router network - that also had ip tracking packets, in this way ICANN will know when all the BGP routers were properly globally updated and when it is time to enable the 'Check tracking flag' in all the BGP routers. - ICANN will know if all the BGP routers in the world were upgraded based on keeping the full BGP table and comparing it to all the BGP routers that did and that did not open a session to ICANN backend infrastructure. Automatic preventation of IoT botnet infections: - IoT botnets are based on default credentials, if we can block default credentials of IoT devices then these kind of botnets (such as Mirai-variants and similar) will stop to have an impact in the internet. - The data field in an ip packet - will always be the same for an access attempt to a IoT device with default credentials - hence these kind of "IP protocol data fingerprints" which are related to specific "IP protocol numbers" will be provided by ICANN backend infrastructure to each BGP router through the opened session with it. - There are two issues with matching incoming ip packets to the "locally stored IP protocol data fingerprints" - the first one is that ip packets can be sent by fragments (so not all the data field will be sent at once in order to be able to be compared with the locally stored data fingerprints) and the second is that usernames (or url's) or any other textual data in the incoming ip packet data field can be in uppercase or in lowercase. In order to overcome the possibility of the existence of a single data fingerprint in multiple incoming ip packet fragments - then in case the BGP router is recognizing the incoming fragmented ip packet data value as part of an existing fingerprint data in its local database then it will keep track of the arrival ip packet fragments based on their specific IP-ID identifier and the BGP router will not forward the last ip packet fragment if the last ip packet fragment will cause all the related ip packet fragments to match a specific ip fingerprint data (last ip packet doesn't have to be the last fragmented part but it is the last ip packet that arrived with that IP-ID identifier, so the BGP router will keep track of the specific fragmented IP packets that arrived and their indexes in order to know when the last one of them arrived). Regarding the second issue - the stored data fingerprints in the local BGP router will be stored in a way that some bytes of them (in specific indexes) will not be compared and in case all the other bytes will match - then the bytes in these indexes - will first be lowered case - and only then comparison will be made to the specific indexed bytes in the specific ip packet data fingerprint. - In case a IoT device behind a BGP router will be infected somehow (for example when a specific fingerprint data with default credentials for a specific device wasn't updated yet through ICANN backend infrastructure), it will be able to infect all the other IoT devices in the local network when the connectivity to them is not through the BGP router, that kind of impact will be much much lower than infected IoT device which can infect any other IoT device in the internet and then massive botnets in the internet are created which are being used for DDoS. Automatic prevention of botnet C&C ip addresses: - Botnets C&C are also a problem in the internet. - This problem can be overcome using the following technical addition: the 5 RIR's will operate end-users honeypots machines all over the world (it will be implemented by a single physical machine in each location, for example in each datacenter and in each major ISP, each single physical machine will emulate a virtual router and virtual VM's, the virtual VM's will emulate many different kinds of 'real world machines', any kind of automatic updating (in the operating system configurations) will be disabled, these honeypots machines are not intended to make any outgoing connection, the virtual routers will monitor if any outgoing connection is made and if yes then it is to a botnet C&C, the virtual router will update the ICANN backend infrastructure regarding it and the ICANN backend infrastructure will update all the BGP routers (in their open sessions) regarding it to completely block any communication to that botnet C&C ip address. There will be a web-based system and only the related Law Enforcement Agency of that C&C ip address region - will be able to remove that C&C ip address from being blocked after their manual check. - Honeypot machines will be deployed using 'templates' - these templates must be signed and not anyone can create them, they should be created and signed by an agreed Law Enforcement Agency such as Interpol in order to make sure that these templates are by-design not making any outgoing connection. The templates will be deployed in an automatic way (major ISP's and datacenters will be able to easily add a 'physical honeypot' server in their network, that will be shipped to them), the re-initiation of a compromised 'virtual machine' that made an outgoing connection - will also be automatic through the system in the physical server. Respectfully, Elad

28 51