[anti-abuse-wg] WG Chair Mailing List Decision

> While I agree, there are some others guilty of that, viz. the repeated accusation that ISPs (and the RIPE NCC)  are criminals (or at least in league with such etc. Seemingly, they have yet to be banned from this list.

KKKKKKKKKKKKKKKKKKKK

> If nobody is to be allowed to ridicule or criticise the "other" side - and the contributor has a valid point, however annoyingly presented, it is not a "community" but a "cult".

K K K
> Agreed. So, if censorship be it, please remove all the other trolls, including their sockpuppets, from this list. I suspect it will be a very quiet one after that and perhaps deservedly so.

Either we learn to live with the contradictory or we will burn crosses and wear hoods.
Marilson

From: anti-abuse-wg-request at ripe.net 
Sent: Thursday, February 16, 2017 2:45 PM
To: anti-abuse-wg at ripe.net 
Subject: anti-abuse-wg Digest, Vol 63, Issue 19

Send anti-abuse-wg mailing list submissions to
anti-abuse-wg at ripe.net

To subscribe or unsubscribe via the World Wide Web, visit
https://mailman.ripe.net/
or, via email, send a message with subject or body 'help' to
anti-abuse-wg-request at ripe.net

You can reach the person managing the list at
anti-abuse-wg-owner at ripe.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of anti-abuse-wg digest..."


Today's Topics:

   1. WG Chair Mailing List Decision (Brian Nisbet)
   2. Re: The well-behaved ISP's role in spamfight (Max Grobecker)
   3. Re: WG Chair Mailing List Decision (Sascha Luck [ml])
   4. Re: WG Chair Mailing List Decision (Suresh Ramasubramanian)
   5. Re: WG Chair Mailing List Decision (ox)
   6. Re: WG Chair Mailing List Decision (Brian Nisbet)


----------------------------------------------------------------------

Message: 1
Date: Thu, 16 Feb 2017 13:05:19 +0000
From: Brian Nisbet <brian.nisbet at heanet.ie>
To: "'anti-abuse-wg at ripe.net'" <anti-abuse-wg at ripe.net>
Cc: "aa-wg-chair at ripe.net" <aa-wg-chair at ripe.net>
Subject: [anti-abuse-wg] WG Chair Mailing List Decision
Message-ID: <e3b44f81-c9d7-5680-c70e-526aba509889 at heanet.ie>
Content-Type: text/plain; charset=utf-8

Colleagues,

This morning Tobias and I asked the NCC to take the very unusual step,
effectively immediately, of removing the person behind svenk at xs4all.nl
from the Anti-Abuse WG mailing list. This was not done lightly, rather
it was done to safeguard this community.

We would ask the members not to forward any of their mails to
the list, nor to include them in list discussions.

This mailing list is a place to discuss network abuse (of all sorts, not
just spam) amongst ISPs, LEAs, Governments, Enterprise Networks and any
concerned Internet Citizens.

It is not a place to insult, to decry, to repeatedly state the same
point over and over or to discriminate against other members of the
community based on their race, creed, gender or sexual preferences.

If we cannot maintain a list upon which reasonable discussion can take
place, then it leaves our community in a weakened state.

Tobias and I discussed this matter with Hans Petter Holen, the RIPE
Chair, and we have arrived at this course of action.

The Co-Chairs are happy to answer reasonable questions off-list. Of
course this is a community mailing list, so we are also happy for
discussion to take place here. However, as with all discussions, we
would ask that if people do wish for this, that it remain respectful and
on topic. If required we can devote some time to discussion of this at
RIPE74.

Brian & Tobias
Co-Chairs, RIPE AA-WG



------------------------------

Message: 2
Date: Thu, 16 Feb 2017 14:42:19 +0100
From: Max Grobecker <max.grobecker at ml.grobecker.info>
To: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] The well-behaved ISP's role in spamfight
Message-ID: <79675681-d0cd-9b0f-4f00-75b1f6bbb234 at ml.grobecker.info>
Content-Type: text/plain; charset="utf-8"

Hi,

Am 13.02.2017 um 22:18 schrieb peter h:

> There is not any req that all customers always should be forced to use
> ISP relays, the default behaviour might be to use ISP relays, and
> to have DHCP given address. But for an extra service one could 
> obtain a fixed address, and as extra service, use port 25.  The main 
> point is to have those "unaware" users, whos computers might be stolen, 
> prevented. They won't notice, and they don't get harmed.

The best practice should be to (automatically?) block port 25 as soon as there are complaints
about SPAM being sent from the according account.
Maybe some good reputated blacklist providers could work together with ISPs to provide them real-time
notifications for their IP allocations based on a kind of "push service".

Then (as a provider) you have:
A) Customers that can use any port unfiltered and are not complaining about blocked ports in your support department.
B) If you receive notifications about SPAM being sent you have a good reason to block specific ports for this user (and, of course, send a notification to the customer).
C) The customer is made aware that something inside his network is infected with malware which should get cleaned. The provider could offer help, fees apply.


If I block port 25 outgoing by default, the user can sit there for ages in his home network while the malware is trying to send SPAM - but the customer won't notice.
"Yes, of course, the computer is very slow, but..."
As soon as the user moves his infected laptop to another network which don't have this blocking policy for whatever reason,
the malware fires out its offers for medication to improve specific parts of the male body.

And, besides of SPAM, there are also other services that are getting targeted by malware - for example SIP.
You can set up a SIP server, reachable to the whole world on port 5060/UDP and you get a feeling that specific parts of the internet are trying to
place phone calls to countries you wouldn't even find on a map ;-)
THAT is more than a bit inconvenient - it's really harmful and costs real money (much money).
But: Would you block port 5060 by default? And which other ports, too? And what about bruteforce attacks against websites?
And why aren't ISPs blocking incoming packets to port 1900/UDP or port 5454/UDP by default, which are misused for DDoS attacks?

I think blocking ports by default isn't the cure. It's just raising support volumes.
IMHO the better way is to let customers learn from it (when they get instant notifications as soon as malware starts attacking others).


Max

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20170216/f020678a/attachment-0001.sig>

------------------------------

Message: 3
Date: Thu, 16 Feb 2017 14:40:02 +0000
From: "Sascha Luck [ml]" <aawg at c4inet.net>
To: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision
Message-ID: <20170216144002.GQ93886 at cilantro.c4inet.net>
Content-Type: text/plain; charset=us-ascii; format=flowed

On Thu, Feb 16, 2017 at 01:05:19PM +0000, Brian Nisbet wrote:
>This morning Tobias and I asked the NCC to take the very unusual
>step, effectively immediately, of removing the person behind
>svenk at xs4all.nl from the Anti-Abuse WG mailing list. This was
>not done lightly, rather it was done to safeguard this
>community.

Safeguard it from what? Non-approved opinions? Please note that,
as a notional member of said community, I was not asked whether I
wanted to be "safeguarded". Thank you, Daddy, for looking out for
my well-being but I'm old enough to look after that myself...

>It is not a place to insult, to decry, to repeatedly state the
>same point over and over 

While I agree, there are some others guilty of that, viz. the
repeated accusation that ISPs (and the RIPE NCC)  are criminals
(or at least in league with such) etc. Seemingly, they have yet
to be banned from this list.

>or to discriminate against other members of the community based
>on their race, creed, gender or sexual preferences.

A quick browse (and thanks for making me have to do that)through
the relevant contributions has not thrown up any obvious evidence
of any such statements. If you have any that I might have missed,
I'd like to see it. Otherwise, I think, an apology for what
certainly reads like a gratuitious accusation is more than
appropriate.

>If we cannot maintain a list upon which reasonable discussion
>can take place, then it leaves our community in a weakened
>state.

Agreed. So, if censorship be it, please remove all the other
trolls, including their sockpuppets, from this list. I suspect it
will be a very quiet one after that and perhaps deservedly so.

If nobody is to be allowed to ridicule or criticise the "other"
side - and the contributor has a valid point, however annoyingly
presented, it is not a "community" but a "cult".

Kind Regards,
Sascha Luck



------------------------------

Message: 4
Date: Thu, 16 Feb 2017 06:55:40 -0800
From: Suresh Ramasubramanian <ops.lists at gmail.com>
To: "Sascha Luck [ml]" <aawg at c4inet.net>, <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision
Message-ID: <E9ECECAD-43D9-4D25-ABFA-78F376512BBE at gmail.com>
Content-Type: text/plain; charset="UTF-8"

Do name names. Who ? according to you ? is a sockpuppet here? Or a troll?

All I see in this email is a series of stream of consciousness accusations but zero specifics.

To be plain ? I think many people on this list, you included, have zero background in abuse mitigation, and engaging in any sort of discussion with such people is, just  possibly, a slightly less unproductive endless loop than engaging with Kamphuis would have been.  

But beyond that I see zero signs of collusion, as you seem to allege others have been saying.


On 16/02/17, 6:40 AM, "anti-abuse-wg on behalf of Sascha Luck [ml]" <anti-abuse-wg-bounces at ripe.net on behalf of aawg at c4inet.net> wrote:

    Agreed. So, if censorship be it, please remove all the other
    trolls, including their sockpuppets, from this list. I suspect it
    will be a very quiet one after that and perhaps deservedly so.





------------------------------

Message: 5
Date: Thu, 16 Feb 2017 16:59:40 +0200
From: ox <andre at ox.co.za>
To: "Sascha Luck [ml]" <aawg at c4inet.net>
Cc: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision
Message-ID: <mailman.6429.1487263553.1952.anti-abuse-wg at ripe.net>
Content-Type: text/plain; charset=US-ASCII

On Thu, 16 Feb 2017 14:40:02 +0000
"Sascha Luck [ml]" <aawg at c4inet.net> wrote:
> On Thu, Feb 16, 2017 at 01:05:19PM +0000, Brian Nisbet wrote:
> >This morning Tobias and I asked the NCC to take the very unusual
> >step, effectively immediately, of removing the person behind
> >svenk at xs4all.nl from the Anti-Abuse WG mailing list. This was
> >not done lightly, rather it was done to safeguard this
> >community.
> Safeguard it from what? Non-approved opinions? Please note that,
> as a notional member of said community, I was not asked whether I
> wanted to be "safeguarded". Thank you, Daddy, for looking out for
> my well-being but I'm old enough to look after that myself...

speak for yourself! I am still young and beautiful :)

> >It is not a place to insult, to decry, to repeatedly state the
> >same point over and over 
> While I agree, there are some others guilty of that, viz. the
> repeated accusation that ISPs (and the RIPE NCC)  are criminals
> (or at least in league with such) etc. Seemingly, they have yet
> to be banned from this list.
> >or to discriminate against other members of the community based
> >on their race, creed, gender or sexual preferences.
> A quick browse (and thanks for making me have to do that)through
> the relevant contributions has not thrown up any obvious evidence
> of any such statements. If you have any that I might have missed,
> I'd like to see it. Otherwise, I think, an apology for what
> certainly reads like a gratuitious accusation is more than
> appropriate.
> >If we cannot maintain a list upon which reasonable discussion
> >can take place, then it leaves our community in a weakened
> >state.
> Agreed. So, if censorship be it, please remove all the other
> trolls, including their sockpuppets, from this list. I suspect it
> will be a very quiet one after that and perhaps deservedly so.
> If nobody is to be allowed to ridicule or criticise the "other"
> side - and the contributor has a valid point, however annoyingly
> presented, it is not a "community" but a "cult".
> Kind Regards,
> Sascha Luck
> 
mostly +1 buuut... well... i like being on a list with the ilk of Gert
& Suresh & the dudes with seriosu abuse skillz :)
- even if we are to be a cult :)

please tell me about the alleged sockpuppet(s) - seriously (no trolling) 
i have sneaky suspicions, but, well, nothing concrete...

For the rest, I am filled with FUD and each character typed results in
an adjustment of tinfoil... - wondering what I am guilty of (cause I am
always guilty of something - even if only of being ignorant of my own
ignorance :) ) 

beFUDded

ooh, if we are a cult, please do not kick me out... i have always wanted
to be in a cult! - so are we a cult or no?

Andre



------------------------------

Message: 6
Date: Thu, 16 Feb 2017 16:45:54 +0000
From: Brian Nisbet <brian.nisbet at heanet.ie>
To: anti-abuse-wg at ripe.net
Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision
Message-ID: <bd4ee9e3-3680-42cf-f2fa-177ecf46a61d at heanet.ie>
Content-Type: text/plain; charset=windows-1252; format=flowed

Sascha,

Sascha Luck [ml] wrote on 16/02/2017 14:40:
> On Thu, Feb 16, 2017 at 01:05:19PM +0000, Brian Nisbet wrote:
>> This morning Tobias and I asked the NCC to take the very unusual
>> step, effectively immediately, of removing the person behind
>> svenk at xs4all.nl from the Anti-Abuse WG mailing list. This was
>> not done lightly, rather it was done to safeguard this
>> community.
>
> Safeguard it from what? Non-approved opinions? Please note that,
> as a notional member of said community, I was not asked whether I
> wanted to be "safeguarded". Thank you, Daddy, for looking out for
> my well-being but I'm old enough to look after that myself...

This isn't just about you. It's about making sure that the community 
comes across as welcoming to all of the various stakeholders. Tobias and 
I (as well as others, but the decision was ours) felt that Sven did not 
in any way contribute to the community or that welcome. Yes, we've had 
less than ideal conversations here before, but it never went to the 
level seen recently.

>> It is not a place to insult, to decry, to repeatedly state the
>> same point over and over
>
> While I agree, there are some others guilty of that, viz. the
> repeated accusation that ISPs (and the RIPE NCC)  are criminals
> (or at least in league with such) etc. Seemingly, they have yet
> to be banned from this list.

We are not here to talk about other instances. This is about one 
instance. There does need to be further conversation about the AA-WG 
community and the list.

>> or to discriminate against other members of the community based
>> on their race, creed, gender or sexual preferences.
>
> A quick browse (and thanks for making me have to do that)through
> the relevant contributions has not thrown up any obvious evidence
> of any such statements. If you have any that I might have missed,
> I'd like to see it. Otherwise, I think, an apology for what
> certainly reads like a gratuitious accusation is more than
> appropriate.

There is quite a lot of material that did not make it to the list 
because of the good offices of the NCC. Tobias and I asked them to take 
interim moderation measures. The question after that was to accept all 
mails or put in a ban, due to the continued issues we went for a ban.

>> If we cannot maintain a list upon which reasonable discussion
>> can take place, then it leaves our community in a weakened
>> state.
>
> Agreed. So, if censorship be it, please remove all the other
> trolls, including their sockpuppets, from this list. I suspect it
> will be a very quiet one after that and perhaps deservedly so.
>
> If nobody is to be allowed to ridicule or criticise the "other"
> side - and the contributor has a valid point, however annoyingly
> presented, it is not a "community" but a "cult".

Ridiculing and criticising are two very, very different things. We have 
never suggested that founded and well argued criticism shouldn't be 
allowed. Repeated offensive behaviour is very different.

Brian
Co-Chair, RIPE AA-WG



End of anti-abuse-wg Digest, Vol 63, Issue 19
*********************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20170217/811a2bfa/attachment.html>