Re: [anti-abuse-wg] abuse of the internet by multinationals and nation states
On Sat, 5 May 2018 13:30:29 +0200 (GMT+02:00), Tobi wrote: >Why should I as user not have the right to protect/hide MY personal data in >whois? Because you are using a public resource. Traceability and accountability are essential to the functioning of the public resource
Re: [anti-abuse-wg] Language on List
On Thu, 2 Feb 2017 21:12:39 +, Sascha Luck [ml] wrote: >What century is this? The rules are timeless. across the millenia. Some people in some places choose not to observe the rules, and some periods and some places see more violations than others. According to whether you observe or violate the rules, you define yourself as refined or coarse. Coarse people have fewer life opportunities because they are viewed as inconsiderate of refined persons (who mostly control the worlds institutions). This is basic sociology. I hope it is helpful to my fellow list members. Jeffrey Race
[anti-abuse-wg] Norms of discourse on this newsgroup [was: RBL Discussion Update]
Dear Marilson, Our group converse to engage in exchange of ideas about technical issues in communications. As technically oriented persons we bring certain expectations to the discussion, for example clearly delineating issues, following a logical progression of analysis based on evidence, using words according to their precisely defined meanings, and of course excluding personalized negative statements and irrelevant issues. Only by following such rules can scientifically valid knowledge grow. Your mode of conversation does not well match these expectations. For example you use the word 'fascist' which has a precise meaning in political science apparently as some generalized condemnation. It is out of place here even were you to use it correctly which you don't.Psychopathy again has a precise definition in its field which you apparently don't know. Likewise it has no place in this forum. Vulgar language has no place in a forum like this as it is rude and offensive and so detracts from the mental calmness and clarity needed to analyse complex technical issues. Censors perform their proper function by excluding submissions which violate the norms of discourse. If you can limit your future contributions to the subject and the expectations of this group I am sure our colleagues will be happy to have you with us. If not then you may be more comfortable raising your ideas in different fora with different expectations and norms. Jeffrey Race --Original Message Text--- From: Marilson Date: Thu, 2 Feb 2017 08:28:27 -0200 According Brian Nisbet the Anti-Abuse WG welcomes a free exchange of ideas and opinions, it does not welcome PERSONAL abuse OF ANY KIND. I was alerted by a WG member that my comments are not being posted. There are censors deciding what can be commented. I would not be surprised by fascist attitudes. I see this problem as follows: if you don't want me to make comments, cancel my register. I don't want to waste my time writing comments in a language I do not master. If this is not personal abuse what would it be? Fascism? Arrogance? Psychopathy? I usually use generalized swearing against companies and their representatives when my rights are not respected. WITH EVIDENCE OF ILLICIT ACTS. If this bothers you, do not be hypocrites by saying _oI have little or no problem with generalised swearing.__ Marilson Never so few done so much harm to so many. From: Marilson Sent: Wednesday, February 01, 2017 12:02 AM To: HRH Prince Sven Olaf von CyberBunker Cc: anti-abuse-wg@ripe.net Subject: Re: anti-abuse-wg Digest, Vol 62, Issue 33 My little chit-chat?!? I have reported with evidence and detailed reports explaining the dirty economic and financial motives of the criminal use that all these companies, quoted by you, and hundreds of others, make of their tools, which were developed with a single goal, cheat to increase profit. The ends justifying the means. The criminal and exacerbated profit at the expense of the population of the planet. The absolute absence of good ethics and decency practiced by sociopaths who have the preference to occupy the positions of CEO. HSBC, Volkswagen and Mitsubishi are the picture of this economy where you should cheat, just try not to get caught. And I've been doing this every day for three years. Is your 20k mails in 5 minutes also seen as spam by the top spammers? Gmail Google, The Godfather, has a habit of returning my complaints of spam and scams as spam. And whenever it happens I divulge the fact to the main communications channels and related institutions. I never post a complaint with links enabled, neither in the detail of the complaint nor in the header or in the text of the pasted message. That is it Marilson Never so few done so much harm to so many. --- -- On Jan 31, 2017 HRH Prince Sven Olaf von CyberBunker wrote: just try to use SMTP for something serious, other than your little chit-chat and you'll quickly see exactly -why- it's dead. oh yeah. your invoice-sending-run of 20k mails in 5 minutes is also seen as spam by the largest receiving entities: yahoo, hotmail, gmail. despite it not only being -legal- but legally mandatory to send invoices. lolol --- On Jan 31, 2017 Marilson wrote: Now we are speaking the same language (with my English). I will not agree with the reasons for your refusal to cancel contracts because I am a layperson. For me it's something that came from Alpha Centaur after traveling 26 years at the speed of light. I'm just an architect. But I can consider it quite probable considering the behavior that repeats itself in such 'entities
Re: [anti-abuse-wg] objection to RIPE policy proposal 2016-01
Dear Lu, Your reasoning fails the logic test because you do not cognize the mismatch between the operation of "law to enforce things" and the spammer business model. The loss to no single victim rises above the threshold to initiate either criminal or civil proceedings. The spammers organize their business model in this way expecting most people to have your attitude. This is clearly explained in <http://www.jeffreyrace.com/nugget/spam_05.pdf> Kind regards, Dr. Jeffrey Race, President Cambridge Electronics Laboratories 20 Chester Street, Somerville MA 02144-3005 Tel +1 617 629-2805 Fax +1 617 623-1882 Avoid spinal damage from computer use! Read "Cripples by Thirty?" <http://www.camblab.com/nugget/nugget.htm> --Original Message Text--- From: Lu Heng Date: Fri, 4 Mar 2016 14:20:28 +1300 Hi there: I think the whole notion about we are managing the internet though the policy are not correct. We are not managing the internet, we are book keeping really. Denis, your argument standing on a group that if we do not manage the internet, the gov will step in and do it for us, but that is largely untrue. The Gov are managing it now as we speak, they have something called law to enforce things, they really don't need bother to go though policy here to block content they dislike, bust people they think are bad, find people are responsible, if there is a seriou crime going on, with or without abuse-c, gov will find them or not---abuse c does not change the outcome. Take China for example, A 500 m user can not access Facebook, tell me they go though any sort of APNIC policy to do that, same goes for some countries inA Middle East. So my last point is. If you like their gov job, you can apply one, don't try to push community here to do gov's job. On Friday 4 March 2016, denis <ripede...@yahoo.co.uk> wrote: Hi Peter OK lets cut to the bottom line. Does anyone NOT agree with these points: -Internet abuse (in it's various forms) is considered both a nuisance and a danger by the publicA -Politicians will jump onto any band wagon that has popular public support and enhances their careers -Responsible internet resource management includes receiving and handling abuse complaints related to the networks you manage If we all supported these points, especially the last one, then in an ideal world all network managers would be happy to provide abuse contact details and would take action on complaints received. Unfortunately we don't live in that ideal world. The fact that so many experienced technical internet people are opposing this policy worries me. So many of you are fixating on this point about 'mandatory', 'enforcing', 'justifying'. If everyone agreed with point 3 above then you would all be willing to do this voluntarily anyway. So what difference does it make to those of you who do this anyway if it is mandatory? But we know some people simply can't be bothered to handle abuse complaints and we also know some people make money by providing services to the abusers. There is no point pretending this does not happen. If there is a lot of money to be made some people will want a slice of it. That is why this has to be mandatory. When abuse-c was first introduced it was made clear that this was the first step of a process. The intention was for all IP addresses within the RIPE region to have one common way of documenting an abuse contact that can be accessed programatically. It was also made clear that this first step had nothing to do with whether anyone responds to reports sent to that contact. Because it was and still is clear that some people don't want to publicise any abuse contact details it had to be and still has to be mandatory. If you enter data into the RIPE Database you are required to ensure it is correct. Dealing with whether anyone responds to the reports sent to this contact is a separate issue and should not cloud the discussion on the abuse-c information in the RIPE Database. Neither should the technical implementation of the abuse-c attribute. I know there are policies about policies for legacy resources. Personally I think that is crazy. All IP addresses are technically the same no matter how or when you acquired it. Abuse can come from any one of them. I don't know why we are making the policy side so complicated. The principle is simple. If you manage IP addresses in the public domain, from where abuse can be generated, responsible management requires you to provide abuse contact details!!! cheers denis On 03/03/2016 23:30, Peter Koch wrote: On Thu, Mar 03, 2016 at 11:46:45AM +0100, denis wrote: In these days of political interest in how the internet is 'managed' the RIRs need to do more than 'just maintain an accurate registry'. The indeed. The community should be careful to maintain and improve the credibility and legitimacy of its policy development process. ``Extra constitutional
Re: [anti-abuse-wg] WHOIS (AS204224)
>From a systems perspective the discussion below is exactly
backwards.
A millions-user system dependent for correct operation (e.g. one not
promoting abuse [the subject of this list]) must be [re]designed to
place the onus on the user not the registrar. Rule: if your data are
not correct, you are off the net.Same as if you don't pay your
bills to your ISP.The ISP (or the electric company, or the
phone company . . . .) don't chase after you and spend hours
getting you to pay your bill.They just disconnect you after sufficient
notice to the registered address.
At present the internet is a cesspool of crime without effective
mechanisms of accountability and traceability. An outsider viewing this
thread (and the dozens of others I've been monitoring for more than a
decade) would find remarkable the unspoken assumption of their
discussions: how to make life trouble-free for the registration and
contracting bodies, even though this makes inevitable the criminal
nature of the mechanism they are charged with managing.
With a proper goal in mind ("Develop our mechanisms so the internet
is no longer a cesspool of crime") the kind of discussion below
("We can't consider that because it would be a lot of work and
some people would become upset") would be out of bounds.
The matter of the "defining discussion goal" will have to be taken up
in order to make progress on this list's putative purpose of "anti-abuse."
Jeffrey Race
On Fri, 6 Nov 2015 13:49:01 +, Sascha Luck [ml] wrote:
>On Fri, Nov 06, 2015 at 11:56:51AM +0100, denis wrote:
>>
>>Add to that all the possible language issues and I am not sure how you
>>will expect the RIPE NCC to validate all this personal contact data
>>with people who they have no relationship with and who may have never
>>heard of the RIPE NCC or RIPE. Anyone who receives an email from an
>>organisation they have never heard of, possibly in a language they
>>don't understand, asking to validate personal information...well you
>>know how that will be treated these days.
>
>I've occasionally done db cleanup death-marches for customers
>where I've created/updated/deleted 100 or so objects in a single
>day. (usually with contact data relating to the LIR which does
>have a contract with the NCC)
>Is the idea seriously that someone doing this will have to field
>100 phone calls or reply to 100 emails over the day?
>
>What about the numerous LIRs who do their resource management
>programatically, without human input?
>
>IMO, such actions would actually discourage proper resource
>management and lower the quality of the db.
>
>>Also bear in mind a single data validation is quite pointless. What is
>>valid today may not be tomorrow. So you cannot trust data that was
>>validated yesterday. To have any benefit this data would have to be
>>routinely re-validated. Given the quantity of personal data sets in
>>the RIPE Database (we are talking millions), many of whom have never
>>heard of the RIPE NCC, to ask them to undertake this exercise would
>>result in the RIPE NCC being reported to many law enforcement
>>authorities for phishing.
>
>Not even considering the inevitable members' revolt.
>
>rgds,
>Sascha Luck
>
Re: [anti-abuse-wg] WHOIS (AS204224)
On Fri, 6 Nov 2015 15:22:30 +, Sascha Luck [ml] wrote: >>though this makes inevitable the criminal nature of the >>mechanism they are charged with managing. > >The internet resource management mechanism as managed by RIRs and >LIRS is "of a criminal nature", do I understand you correctly? The mechanism is the internet
Re: [anti-abuse-wg] WHOIS (AS204224)
You have misunderstood the English words. I said that the mechanism by which the internet operates was slackly designed and is slackly operated so has become a cesspool of criminality. Jeffrey Race On Fri, 6 Nov 2015 17:14:22 +, Sascha Luck [ml] wrote: >On Fri, Nov 06, 2015 at 11:57:18AM -0500, Jeffrey Race wrote: >>>The internet resource management mechanism as managed by RIRs and >>>LIRS is "of a criminal nature", do I understand you correctly? >> >>The mechanism is the internet > >Uhuh. I guess it's just as well that barely any operators seem to read >this list. They may be less than happy to learn that they are all >criminals. > >rgds, >Sascha Luck > >
Re: [anti-abuse-wg] WHOIS (AS204224)
On Wed, 4 Nov 2015 14:32:30 +, Sascha Luck [ml] wrote: >There is a need to be able to reach a resource holder to notify >them of abuse coming from their network (the abuse-c) or >technical problems (the tech-c). There is NO need to have the >street address and phone number of every *person* "who partly >manages any aspect of a resource" in a public database, just to >satisfy the curiosity of some curtain-twitcher or give actual >criminals some data for ID theft purposes. >From an engineering standpoint you absolutely must have at least one redundant channel, with an acknowledgement mechanism (e.g. registered mail). But fax is also possible for this because the receipt is stamped with date/time of reception. This is easily monitored for continuing validity using the kind of automated checks I mentioned recently; no human involvement required at sending end, only at the receiving end to return the token (manually, ensuring that someone is actually managing the public resource in his care). Jeffrey Race
[anti-abuse-wg] Also seeking input [branching from 'WHOIS (AS204224)']
Dear group members, For many years I've silently followed these discussions and now a project is emerging on which I'd like to ask whether any of you knowledgeable members might wish to help. The project starts in a different place but will inform your deliberations. Background: Two years ago I began a research project at the Harvard Kennedy School on "Pathologies of Public- Decision-making," to answer the question: Why do very smart and well-informed persons make decisions with catastrophic consequences, even though warned in advance-- and what can be done to mitigate this pathological behavior? The findings will be based on a series of case studies including the Iraq War and 2007/08 financial crisis (building on my earlier work on the Vietnam War).It turns out that decision-making processes in all these cases share structural similiarities leading to the adverse outcomes. As for us on this group, the decision process leading to the present rules for internet messaging seems to have strong resemblances to the other cases You are all smart and we were adequately warned in advance and all the way along (as this thread illustrates, and over the years I've monitored many dozens of threads like this one). But the result has been catastrophic: most messages are spam, with a heavy economic cost in terms of cleanup and prevention costs and the burden of fraud. So I will include a case study on the spam/abuse phenomenon and why so many smart people (like those on this and related lists I monitor) have produced such adverse outcomes. I am planning to complete my book manuscript next year and hope to be writing up this part of the draft early in '16.I invite anyone interested in commenting (or even working with me in writing this chapter) to send me a note off-list. To understand my approach please see the "Pathologies" page linked on my website noted below. Best to invest 10 minutes in viewing the MP4 file. A quick summary appears in the linked PDF but if you are not read into this type of analysis the elaboration in the spoken version will help a lot. My thanks in advance to any of you who find this of interest and might be able to help make the final result something unusual. Jeffrey Race, President Cambridge Electronics Laboratories Co-organizer, "Buddhism Rejoins the Great Conversation in India" Pune, India, November 22-24, 2014 (Centre for Buddhist Studies University of Oxford) International Center of Excellence --- University of Yangon (2014) "Introduction to Economics and Political Economy" (under auspices of School of Advanced International Studies, The Johns Hopkins University, Washington DC) Ash Center Fellow Harvard University (2012-13) +1 617 629-2805086 709-7645 (follows me worldwide)(in Thailand) Current projects and forthcoming publications: <http://www.jeffreyrace.com> ** "The Vietnam War as an Early Warning" <http://www.jeffreyrace.com/document/race_oh.pdf> ** "Pathologies of Public Decision-making" informal title: "How Not To Be An American Blunderer" <http://www.jeffreyrace.com/tenmin/bonfire.htm> (Presented at Harvard University on 5/26/2015) On Tue, 3 Nov 2015 14:37:10 +, Brian Nisbet wrote: >On 03/11/2015 14:14, Gert Doering wrote: >> Hi, >> >> On Tue, Nov 03, 2015 at 01:49:18PM +, Sascha Luck [ml] wrote: >>> On Tue, Nov 03, 2015 at 07:13:17PM +0530, Suresh Ramasubramanian wrote: >>>> I would actually prefer any such proposal to come from within >>>> the regular RIPE community, rather than from one of us >>>> outsiders. >>> >>> For once I agree completely. If this goes to an actual proposal, >>> this needs to be in APWG as it would be: >>> >>> a) address policy >>> b) affecting the entire community >>> >>> Any contractual changes will also need membership approval via GM >>> vote anyway. >> >> I'm not so sure about APWG. "Spending resources" is traditionally >> ncc-services-land, "combating abuse" is definitely anti-abuse-wg... so >> discussing the details here, and sending a heads-up over to APWG and >> ncc-services is good enough for me... > >We're getting deep into minutiae at this point, but this is actually >something I had planned to try and bring to the DB-WG and we'd see where >we went from there. That said, I simply haven't had the time over the >summer. > >Suresh, your point is noted, however I was asking more for people to >undertake to help, rather than to lead. > >Ok, I realise I have s
Re: [anti-abuse-wg] Verifiability (was: WHOIS (AS204224))
On Tue, 03 Nov 2015 02:31:26 +, Aftab Siddiqui wrote: >Yes it is easy.. but not scalable, exception rate would be >very high.. multiply that with 7000+ (members) It's not a problem for the registrar!!No human effort is required at all so the registrar incurs no costs except setting the system up. The registrant has to cure the failure to submit the tokens. (My bank uses tokenized messages to permit access to my account; their system surely processes thousands of messages daily but no human intervention is involved. )
Re: [anti-abuse-wg] Verifiability (was: WHOIS (AS204224))
On Tue, 3 Nov 2015 02:42:33 +, Sascha Luck [ml] wrote: >Exactly *what* purpose would a phone call or fax (why not TELEX >if we're doing retro tech?) serve? Precisely to establish that the registrant humanly responds to messages at its published addresses. The registrar would have to employ a CAPTCHA on his token-accepting site; otherwise clever rogues would automate the token-submission process:) But this is all trivial and done daily by numerous institutions. Sascha perhaps your question arose because I was imprecise in my brief earlier message; this procedure would not be an anti-spam measure, but it would greatly simplify the next steps in anti-spam processes if the registrar community ever becomes serious about halting spam (itself again easy to do but that is the subject of another message). Kind regards to all Jeffrey Race
[anti-abuse-wg] Verifiability (was: WHOIS (AS204224))
This is trivially and virtually costlessly done in an automated way, taking about a day of a good programmer's time. Thereafter zero/minimal maintenance except for 'exception' followups. One informs registrants that CONTINUOUSLY working contact modes (e-mail, fax, phone, postal, say at least three of four) are mandatory to avoid suspension/rescission. Then one automates a routine to transmit tokenized letters/faxes/ calls/e-mails on a periodic but random basis, with the covering message stating that the token must be returned on a website within x days according to the terms of registration. If sufficient tokens to not appear, suspension occurs automatically, just as if you don't pay your credit card bill or pay your phone bill. This is easy stuff. Jeffrey Race On Mon, 2 Nov 2015 23:50:25 +0100, Sander Steffann wrote: >Hi Roland, > >>>> The issue isn't the announcement of out-of-region IP space. The issue >>>> is the self-evidently fradulent nature of the registration of, and the >>>> WHOIS record for, AS204224. >>> >>> Again that lousy "self-evidently" argument. Please don't use that, it is >>> often used by people who don't have any better arguments and want to >>> fool the casual reader into agreeing with them without thinking. Real >>> data please. >> >> Here is the contact data for AS204224: >> >> person: Boris Soloviev >> address:192284, city Sankt-Peterburg, av.Kosmonavtov 47, k.2B >> phone: +7-812-3630014 >> nic-hdl:BS8826-RIPE >> mnt-by: CJSCMMS-MNT >> created:2015-07-21T17:43:59Z >> last-modified: 2015-07-21T17:43:59Z >> source: RIPE >> >> Someone needs to CALL the phone number listed there and simply ask if >> Mr. Soloviev is available. Once he is on the line, someone needs to ask >> if he even works for Mashzavod Marketing Services, and if so, whether or >> not he or his company requested an AS from RIPE NCC in early July. > >The spammer putting in a fake/temporary/etc mobile of VoIP number there is >easy, and the person answering the phone would just confirm everything. If you >want to do real verification then you'd have to start from an independent >source and work your way down to the person in the RIPE DB. And even then you >would have only verified that this person works at that company, not that the >person is actually authorised to make decisions on requesting ASNs for the >company. So it could still be a fake registration. It would make it harder >though to fake stuff. > >> I would do it myself, but I don't speak Russian. (And I suspect that >> there is no firm requirement that contact persons listed in RIPE WHOIS >> records be even minimally profficient in English.) > >The ASNs were requested through a sponsoring LIR. They are the one that should >do the verification bit. The contractual link is RIPE NCC to LIR, and LIR to >end-user. It might be that the LIR is a victim as well or it may be that the >LIR is an accomplice. Difficult to tell. > >For your phone verification system to work the RIPE NCC would have to ignore >the LIR and the data provided by the LIR and trace down the contacts starting >at an independent source that can not be faked by the LIR or its customer. > >>> How do you know that they don't have the right to announce those >>> addresses? Is it unallocated space? In that case it's easy. >> >> It _is_ unallocated (bogon) space in this case, so yes, it is easy. > >network operators should be filtering better on announced prefixes anyway. >It's always frustrating to see so many are still letting bad routes through >(plug: https://www.routingmanifesto.org/manrs/) > >>> Maybe suspicious with hindsight. Nothing that RIPE NCC could/should have >>> acted on when the request was made. >> >> I disagree. >> >> As noted above, I believe that a simple phone verification system, much >> like the one already used by Google Voice, by CraigsList, by credit >> card companies, and by countless other businesses would have prevented >> what appears to be a clear-cut case of identity fraud. > >It's certainly something we should think about. I'm just thinking that using >the phone number from the RIPE DB doesn't prove anything as the spammer will >provide that data for themselves. Any ideas on how to make sure we get a valid >phone number that belongs to the company/organisation/etc that the resources >are being assigned to? > >> (In this country, everyone is told from an early age that they ought to >> be honest. But people still do lock up their bicycles anyway.) > >You don'
