[anti-abuse-wg] Policy disallowing spam from RIPE blocks

Ronald F. Guilmette wrote:
> In message<1299680973.2210.72.camel at shane-desktop>,
> Shane Kerr<shane at time-travellers.org>  wrote:
>
>> As far as I can tell, the desire is to make it against the policies to
>> send spam from RIPE NCC address space. I find it incredibly frustrating
>> that nobody will actually just say that. :)
>> ...
>> If I'm missing the point and there is actually something else going on,
>> please someone clue me in!
>
> Be glad to.  And I appreciate you asking.
>

> The bottom line is that these kinds of one-domain/one-IP spammers are
> actually not difficult at all to handle in a very complete and comprehensive
> manner, using existing tools (i.e. existing blacklists), and thus they
> don't create much in the way of problems for anyone.  The problem of
> one-domain/one-IP spammers is virtually a non-problem.

No, its not.
Spam is illegal in a couple of countries and every spam counts in those.

We have to get away from the perspective to rank spam by the "size" of
the problem its causing.

The only way to define abuse is to describe it as the problems abuse
is causing at the receivers side, not the senders side.

"Abuse" is to my understanding, any harm an activity of a third party
is causing to the resources of an IP owner, that the IP owner did
not intented or wants.
The definition of "abuse" is up to the abused resource owner.

And responsible for any kind of abuse is the resource owner of
the IPs the abuse is originating from.

And RIPE NCC has to improve its concepts and regulations to
prevent abuse caused by their members.
A first step of RIPE NCC should be to improve abuse reporting
by improving whois data by accuracy and ease to retrieve
the responsible person.

> In contrast to this sort of sitiation, these days the net has lots and
> lots of what are called professional ``snowshoe'' spammers.  These folks
> are astute. They know the score, and they know how existing spam blocking
> systems work.  These people are *not* at all the same as Joe's idiot nephew.
> They are determined, and they educated, and like he Terminator, they WILL
> NOT STOP... at least not until they have managed to defeat all of the
> existing technical systems that have been put in place to block spam.

True, RIPE NCC cannot do a lot these days to stop them, but RIPE NCC
can do a lot to make it easier for the victims to protect themselve.

> Is this whole escalation of the spam arms race bad for ``our side''... for
> the ``good guys'' who are fighting against spam?  Yes.  Certainly.  But
> here, since not everybody on this list is even clearly convinced that spam
> itself is a Bad Thing, we can... abnd probably should... ignore that fact

And thats the crazy thing I complain about.
How can RIPE NCC not do anything because the "RIPE community" also
consist of spammers ?

Thats like a goverment saying, that murder or theft isnt eval and wrong
because some murders and thiefs think its ok ...
I really wonder that the current RIPE regulations do not contain
at least some points that are coming close to human rights.

So: any idea how we can bring the RIPE regulations so far, that
abuse IS eval and the RIPE NCC has to improve regulations, protocols
and techniques ?
And stop abuse friendly people in the community from blocking this
process ?

> When the issue is looked at even with these blinders on... ignoring totally
> the massive annoyance and massive costs that spam on the net creates for
> everyone... it can *still* be seen that ``snowshoeing'', at least with

Do not think about abuse only on spam.
There is a lot of other abuse, like password scanning of mail accounts,
DDoS attacks or hacking.
Those things are not even simple abuse, these things are against laws
in the most countries.

As an ISP we had a lot of cases during the last years, where this kind
of abuse was going to be invested by legal authorities (police, court
aso) and they had NO chance to detect the originator, because of
inaccuracy in RIPEs database, highjaked IP space, because the LIR
did not care who announces his old IP space aso ...
So: RIPE NCC IS responsible for the accuracy of the database
and the resources.
And: the LIRs should be forced to improve their techniques
to prevent misuse by regulations, just because its very easy
to detect botted PCs in your own network and its even easier
to block them.
Its also easy to detect misuse of orphaned address space.
And its easy for RIPE NCC to punish LIRs that do not follow
the regulations (f.e. why are LIRs not beeing forced to
announce address space they own ? if they do not need the IPs,
RIPE NCC could revoke them).


BTW: spam farms are usally not a big technical problem, because
its easy to detect ranges with spam outbreaks. More problematic
are all those unprotected PCs out there with daily changing IP.


Kind regards, Frank



>
>
> Regards,
> rfg
>
>
>


-- 

Mit freundlichen Gruessen,
--
PHADE Software - PowerWeb                       http://www.powerweb.de
Inh. Dipl.-Inform. Frank Gadegast             mailto:frank at powerweb.de
Schinkelstrasse 17                                fon: +49 33200 52920
14558 Nuthetal OT Rehbruecke, Germany             fax: +49 33200 52921
======================================================================
Public PGP Key available for frank at powerweb.de