[anti-abuse-wg] 2019-03 and over-reach

Hi,


On Sun, 31 Mar 2019, Richard Clayton wrote:

>> 1) The hijackings you mentioned also affect your customers, right?
>
> I do not believe they did, not all announced space is in use

If third parties could receive any of the customer's space is already bad 
enough. The hijacker could be impersonating the customer towards other 
networks (not necessarily to every network in the world).



>> 2) Do you or your customers report these hijackings (and their impact) to
>> somebody?
>
> The hijacks only came to light due to feedback about spam sending, where
> it turned out to be impossible to identify anyone using the IPs that
> were sending the spam. In that sense the reporting was the other way.

Although the victims (third party networks) directed their reports to the 
wrong people -- this is why i'm saying impersonating is an advantage to 
hijackers.



>> 3) Is it in your customers' best interest to do nothing?
>
> I think it's presumptuous to assume that nothing was done. Once it was
> understood what was occurring (which took rather longer than I think it
> would today) the matter was dealt with and the hijacks ceased

If enough harm was already done.......



>> 4) Is it in your customers' best interest to "protect" the lack of rules
>> about hijacking at registry level?
>
> Rules do not prevent hijacks -- detection and mitigation do

I agree detection and mitigation do, but having no rules is actually 
helping hijackers.



>> As i understand it, if someone provides the RIR with falsified data
>
> there was no falsified data provided to an RIR in this case

I wasn't clear enough. I'm saying the rule about falsified data exists and 
if someone does that, the RIR is able to act -- today it doesn't have the 
ability to act regarding hijacks!



>> , they
>> expose themselves to have a LIR closure (i.e. RIPE-716). Imho, having
>> this rule in place is protecting the RIR's long term stability -- the
>> point about 2019-03 is that someone doing persistent intentional hijacks
>> should be subject to the same "risk".
>
> I have already pointed you towards IXPs once ... that's where this
> example was dealt with.

That is precisely another excellent issue. IXPs are by nature "neutral". 
However, if rules are written, one member that announces hijacked routes 
will most likely be shown the door. When that happens the IXP is only 
"enforcing" the rules. In my opinion, the RIR (which also does that in 
other cases of rule breaking) should be doing the same -- but for that rhe 
rule needs to be in place.



>> I understand your point about partial visibility. With 2019-03 in place, i
>> think the incentive for anyone to share their routing view will increase,
>> as a way of protection -- i see it as "community protection".
>
> this is a new point presented without any evidence whatsoever (albeit I
> do agree that having more sensors would improve the detection of some
> hijacking events).

That's basically it... more sensors, better "community protection".


> The content of routing tables are often not shared
> publicly for reasons of perceived commercial confidentiality -- you

It's always a choice not publicly detailing which your neighbors are. I'm 
only saying more public information helps in "detection".



> should elaborate why that shyness would be changed by the proposed
> policy (especially given the claims made that hijacking is already easy
> to understand with the existing sensor network).

I only said it was an incentive to... i'm not suggesting it should be 
mandatory for every network to export info about who actually are their 
neighbors.


Best Regards,
Carlos




> -- 
> richard                                                   Richard Clayton
>
> Those who would give up essential Liberty, to purchase a little temporary
> Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755
>