[anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities, was Draft Anti-Abuse WG Minutes ? RIPE 61

On Wed, Feb 2, 2011 at 1:10 AM, Shane Kerr <shane at time-travellers.org> wrote:
> The anti-spam community is by necessity narrowly focused on a small
> subset of issues. For them, all of the other things that ISPs bring up
> when talking about dealing with abuse seem like hand-waving, avoiding
> responsibility, and otherwise trying to avoid doing the Right Thing.

Shane, the antispam community at MAAWG is the abuse and security teams
at ISPs and big operators of email (webmail services).   The same
organizations that send their network and DNS people to ARIN, RIPE and
APRICOT.  The focus on operational issues is just the same.

I would ask that you not point to, say, news.admin.net-abuse.email and
let your comments be colored by that.  The antispam community has
evolved rather a lot from a decade back.

> The people involved want different things. (Plus it's hard to normalize
> relations when Spamhaus representatives basically accuse the entire RIPE
> community of being irresponsible.)

They are highlighting a long standing issue with multiple PI / PA
netblocks being used for abuse (malware propagation etc, not just
spam), assigned to organizations that they see as fronts for online
crime rather than legitimate entities.  They appear to feel - and
probably with some reason - that neither RIPE NCC nor the RIPE
community has been sufficiently responsive to these concerns.

> One possible source of additional upset is that people confuse the RIPE
> NCC and RIPE. They go to the RIPE NCC, and the RIPE NCC says "we do not
> make policy", and they think that they are just saying "nothing to be
> done, sorry!"

That won't fly unfortunately.  The difference between the regional RIR
and the internet community in the region is obvious - and here, what
blame needs to be shared around is entirely collective.

RIPE NCC should have, long ago, worked to crack down on gross abuse
and gaming of the IP allocation process.  To be fair, they are taking
several steps in this direction.

The RIPE community should, as a whole, be more operationally focused
on this loss of a scarce shared resource by allocating large parts of
it to entities that use these for a very short time before
blocklisting, ISP nullroutes etc kick in, and then abandon them to be
recovered by the RIR and potentially reallocated.  Yes, the IP space
involved may be collectively less than a /8, small potatoes at an RIR
level, but still non trivial amounts of IP space.

> There *is* something to be done - engage the RIPE community. This is
> where policies are made. Ultimately this means putting specific policy
> proposals forward to the working groups, but it is probably best to
> start by chatting with people about ideas on list or off. Stating a

By the same token, I'd encourage the community here to actively reach
out.   A substantial amount of antispam and security operational work
goes on in other forums (some open like maawg, some closed and vetted
etc).  However this operational work tends to run into a brick wall
where issues such as serial IP allocations to malicious entities goes
on relatively unchecked, and outreach efforts / policy proposals
submitted so far haven't received an adequate level of understanding
and response.

Specific policy proposals have been made in the past by others focused
on this issue.  Tobias Knecht, Uwe Rasmussen of Microsoft are two that
I can think of.

--srs

-- 
Suresh Ramasubramanian (ops.lists at gmail.com)