[anti-abuse-wg] UCEPROTECT DNSBL possibly abusive practice and RIPEStat Blacklist entries widget

Hi Christian,

As others have pointed out, even purely on a technical level, they are not
any kind of trustworthy source as paying to be delisted creates a very bad
incentive for them.

I agree that in general more lists should be added, but uceprotect should
be removed, because just listing it does (whether intended or not) give it
some legitimacy in the eyes of many (I assume).

I can understand that the sexist comments could be overlooked from the
point of view of RIPEstat if you had a list far larger including pretty
much every list that is semi-common.
However, the fact that it is basically based on extortion inherently
results in a very low quality blocklist.

I know I have repeated myself a bit here, but I feel it is important to
point out that disregarding their awful business practices, it is just very
bad on a technical level too.

-Cynthia


On Thu, Mar 4, 2021 at 5:16 PM Christian Teuschel <cteusche at ripe.net> wrote:

> Hi Elvis and Suresh, dear colleagues,
>
> Putting exact numbers on how many operators are using UCEProtect is
> difficult, but through feedback from users, network operators and
> members we understand that it is in use and that the provisioning of
> this RBL on RIPEstat has value.
>
> If I am reading the feedback in this discussion correctly, the sentiment
> is leaning towards adding more RBLs instead of less and if that is the
> case we are going to look into how and when we can achieve this. Please
> let me know if that is aligned with your requirements/expectations.
>
> Best regards,
> Christian
>
> On 04/03/2021 09:54, Elvis Daniel Velea wrote:
> > Hi Christian,
> >
> > while it may be useful to have their data source, it only shows the RIPE
> > NCC favors one or two operators and I think that is damaging to the
> > whole idea of being impartial.
> >
> > You either include a good list of blacklist operators and their data or
> > none. Including only a couple will lead to the impression that only
> > those are important enough to be considered by the RIPE NCC.
> >
> > my 2 cents,
> > Elvis
> >
> > On 3/3/21 8:27 AM, Christian Teuschel wrote:
> >> Dear colleagues,
> >>
> >> RIPEstat is a neutral source of information and we aim to provide users
> >> with access to as many data sources as possible to provide insights.
> >>
> >> UCEProtect was added as a data source prior to 2010 and is still used by
> >> several network operators to filter traffic into their networks.
> >> Including it as a data source in RIPEstat allows users to see whether
> >> resources are included in their lists.
> >>
> >> RIPE NCC does not pay for, support or endorse their practices, although
> >> we understand that continuing to include UCEProtect as a data source
> >> could be misunderstood as such. We also do not use their lists to filter
> >> traffic on our services.
> >>
> >> Our goal remains to provide the best visibility and tools for network
> >> operators to diagnose their networks. We have also heard your feedback
> >> regarding including more RBLs. It is something that we have considered
> >> in the past, and we are open to revisiting this.
> >>
> >> RIPEstat is driven by the community. We would like to hear from you
> >> about whether including UCEProtect as a data source is useful.
> >>
> >> Regards,
> >> Christian
> >>
> >> On 02/03/2021 00:08, Kristijonas Lukas Bukauskas via anti-abuse-wg
> wrote:
> >>> Hello,
> >>>
> >>> I noticed that RIPE NCC uses uceprotect-level1, uceprotect-level2 and
> >>> uceprotect-level3 in RIPEStat Anti Abuse Blacklist Entries widget.
> >>>
> >>> There have been controversial positions about this blacklist recently:
> >>>
> >>> 1)
> >>>
> https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-RBL-UCEPROTECL-in-Hosted-Email-Security-and-Email-Security
> >>>
> >>> <
> https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-RBL-UCEPROTECL-in-Hosted-Email-Security-and-Email-Security
> >
> >>>
> >>> 2) https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html
> >>> <https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html>
> >>>
> >>> UCEPROTECT blacklists the whole range of IP addresses, including the
> >>> full IP range of some autonomous systems:
> >>>   UCEPROTECT states, '/Who is responsible for this listing? YOU ARE
> NOT!
> >>> Your IP was NOT directly involved in abuse but has a bad neighborhood.
> >>> Other customers within this range did not care about their security and
> >>> got hacked, started spamming, or were even attacking others, while your
> >>> provider has possibly not even noticed that there is a serious problem.
> >>> We are sorry for you, but you have chosen a provider not acting fast
> >>> enough on abusers'/) [http://www.uceprotect.net/en/rblcheck.php
> >>> <http://www.uceprotect.net/en/rblcheck.php>].
> >>>   It asks for a fee if some individual IP address wants to be
> >>> whitelisted
> >>> (http://www.whitelisted.org/ <http://www.whitelisted.org/>),
> >>>   It abuses people who decide to challenge their blacklist by
> publishing
> >>> conversations in their so-called /Cart00ney/
> >>> (http://www.uceprotect.net/en/index.php?m=8&s=0
> >>> <http://www.uceprotect.net/en/index.php?m=8&s=0>;
> >>> http://www.uceprotect.org/cart00neys/index.html
> >>> <http://www.uceprotect.org/cart00neys/index.html>).
> >>>   And the other type of threatening: http://www.uceprotect.org/
> >>> <http://www.uceprotect.org/>
> >>>   Does RIPE NCC have any position on this specific blacklist?
> >>>
> >>> Thank you!
> >>
> >
> >
>
> --
> Christian Teuschel
> RIPE NCC | @christian_toysh
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20210305/4db3997a/attachment.html>