<HTML><HEAD></HEAD> <BODY dir=ltr> <DIV dir=ltr> <DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000"> <DIV>> While I agree, there are some others guilty of that, viz. the repeated accusation that ISPs (and the RIPE NCC) are criminals (or at least in league with such etc. Seemingly, they have yet to be banned from this list.</DIV> <DIV> </DIV> <DIV>KKKKKKKKKKKKKKKKKKKK</DIV> <DIV> </DIV> <DIV>> If nobody is to be allowed to ridicule or criticise the "other" side - and the contributor has a valid point, however annoyingly presented, it is not a "community" but a "cult".</DIV> <DIV> </DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>K K K</DIV></DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> </DIV></DIV> <DIV>> Agreed. So, if censorship be it, please remove all the other trolls, including their sockpuppets, from this list. I suspect it will be a very quiet one after that and perhaps deservedly so.</DIV> <DIV> </DIV> <DIV>Either we learn to live with the contradictory or we will burn crosses and wear hoods.</DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'> </DIV></DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Marilson</DIV></DIV> <DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'></DIV> <DIV style="FONT: 10pt tahoma"> <DIV> </DIV> <DIV style="BACKGROUND: #f5f5f5"> <DIV style="font-color: black">From: <A title=anti-abuse-wg-request@ripe.net href="mailto:anti-abuse-wg-request@ripe.net">anti-abuse-wg-request@ripe.net</A> </DIV> <DIV>Sent: Thursday, February 16, 2017 2:45 PM</DIV> <DIV>To: <A title=anti-abuse-wg@ripe.net href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</A> </DIV> <DIV>Subject: anti-abuse-wg Digest, Vol 63, Issue 19</DIV></DIV></DIV> <DIV> </DIV></DIV> <DIV style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>Send anti-abuse-wg mailing list submissions to anti-abuse-wg@ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://mailman.ripe.net/ or, via email, send a message with subject or body 'help' to anti-abuse-wg-request@ripe.net You can reach the person managing the list at anti-abuse-wg-owner@ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. WG Chair Mailing List Decision (Brian Nisbet) 2. Re: The well-behaved ISP's role in spamfight (Max Grobecker) 3. Re: WG Chair Mailing List Decision (Sascha Luck [ml]) 4. Re: WG Chair Mailing List Decision (Suresh Ramasubramanian) 5. Re: WG Chair Mailing List Decision (ox) 6. Re: WG Chair Mailing List Decision (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 16 Feb 2017 13:05:19 +0000 From: Brian Nisbet <brian.nisbet@heanet.ie> To: "'anti-abuse-wg@ripe.net'" <anti-abuse-wg@ripe.net> Cc: "aa-wg-chair@ripe.net" <aa-wg-chair@ripe.net> Subject: [anti-abuse-wg] WG Chair Mailing List Decision Message-ID: <e3b44f81-c9d7-5680-c70e-526aba509889@heanet.ie> Content-Type: text/plain; charset=utf-8 Colleagues, This morning Tobias and I asked the NCC to take the very unusual step, effectively immediately, of removing the person behind svenk@xs4all.nl from the Anti-Abuse WG mailing list. This was not done lightly, rather it was done to safeguard this community. We would ask the members not to forward any of their mails to the list, nor to include them in list discussions. This mailing list is a place to discuss network abuse (of all sorts, not just spam) amongst ISPs, LEAs, Governments, Enterprise Networks and any concerned Internet Citizens. It is not a place to insult, to decry, to repeatedly state the same point over and over or to discriminate against other members of the community based on their race, creed, gender or sexual preferences. If we cannot maintain a list upon which reasonable discussion can take place, then it leaves our community in a weakened state. Tobias and I discussed this matter with Hans Petter Holen, the RIPE Chair, and we have arrived at this course of action. The Co-Chairs are happy to answer reasonable questions off-list. Of course this is a community mailing list, so we are also happy for discussion to take place here. However, as with all discussions, we would ask that if people do wish for this, that it remain respectful and on topic. If required we can devote some time to discussion of this at RIPE74. Brian & Tobias Co-Chairs, RIPE AA-WG ------------------------------ Message: 2 Date: Thu, 16 Feb 2017 14:42:19 +0100 From: Max Grobecker <max.grobecker@ml.grobecker.info> To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] The well-behaved ISP's role in spamfight Message-ID: <79675681-d0cd-9b0f-4f00-75b1f6bbb234@ml.grobecker.info> Content-Type: text/plain; charset="utf-8" Hi, Am 13.02.2017 um 22:18 schrieb peter h: > There is not any req that all customers always should be forced to use > ISP relays, the default behaviour might be to use ISP relays, and > to have DHCP given address. But for an extra service one could > obtain a fixed address, and as extra service, use port 25. The main > point is to have those "unaware" users, whos computers might be stolen, > prevented. They won't notice, and they don't get harmed. The best practice should be to (automatically?) block port 25 as soon as there are complaints about SPAM being sent from the according account. Maybe some good reputated blacklist providers could work together with ISPs to provide them real-time notifications for their IP allocations based on a kind of "push service". Then (as a provider) you have: A) Customers that can use any port unfiltered and are not complaining about blocked ports in your support department. B) If you receive notifications about SPAM being sent you have a good reason to block specific ports for this user (and, of course, send a notification to the customer). C) The customer is made aware that something inside his network is infected with malware which should get cleaned. The provider could offer help, fees apply. If I block port 25 outgoing by default, the user can sit there for ages in his home network while the malware is trying to send SPAM - but the customer won't notice. "Yes, of course, the computer is very slow, but..." As soon as the user moves his infected laptop to another network which don't have this blocking policy for whatever reason, the malware fires out its offers for medication to improve specific parts of the male body. And, besides of SPAM, there are also other services that are getting targeted by malware - for example SIP. You can set up a SIP server, reachable to the whole world on port 5060/UDP and you get a feeling that specific parts of the internet are trying to place phone calls to countries you wouldn't even find on a map ;-) THAT is more than a bit inconvenient - it's really harmful and costs real money (much money). But: Would you block port 5060 by default? And which other ports, too? And what about bruteforce attacks against websites? And why aren't ISPs blocking incoming packets to port 1900/UDP or port 5454/UDP by default, which are misused for DDoS attacks? I think blocking ports by default isn't the cure. It's just raising support volumes. IMHO the better way is to let customers learn from it (when they get instant notifications as soon as malware starts attacking others). Max -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: OpenPGP digital signature URL: </ripe/mail/archives/anti-abuse-wg/attachments/20170216/f020678a/attachment-0001.sig> ------------------------------ Message: 3 Date: Thu, 16 Feb 2017 14:40:02 +0000 From: "Sascha Luck [ml]" <aawg@c4inet.net> To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision Message-ID: <20170216144002.GQ93886@cilantro.c4inet.net> Content-Type: text/plain; charset=us-ascii; format=flowed On Thu, Feb 16, 2017 at 01:05:19PM +0000, Brian Nisbet wrote: >This morning Tobias and I asked the NCC to take the very unusual >step, effectively immediately, of removing the person behind >svenk@xs4all.nl from the Anti-Abuse WG mailing list. This was >not done lightly, rather it was done to safeguard this >community. Safeguard it from what? Non-approved opinions? Please note that, as a notional member of said community, I was not asked whether I wanted to be "safeguarded". Thank you, Daddy, for looking out for my well-being but I'm old enough to look after that myself... >It is not a place to insult, to decry, to repeatedly state the >same point over and over While I agree, there are some others guilty of that, viz. the repeated accusation that ISPs (and the RIPE NCC) are criminals (or at least in league with such) etc. Seemingly, they have yet to be banned from this list. >or to discriminate against other members of the community based >on their race, creed, gender or sexual preferences. A quick browse (and thanks for making me have to do that)through the relevant contributions has not thrown up any obvious evidence of any such statements. If you have any that I might have missed, I'd like to see it. Otherwise, I think, an apology for what certainly reads like a gratuitious accusation is more than appropriate. >If we cannot maintain a list upon which reasonable discussion >can take place, then it leaves our community in a weakened >state. Agreed. So, if censorship be it, please remove all the other trolls, including their sockpuppets, from this list. I suspect it will be a very quiet one after that and perhaps deservedly so. If nobody is to be allowed to ridicule or criticise the "other" side - and the contributor has a valid point, however annoyingly presented, it is not a "community" but a "cult". Kind Regards, Sascha Luck ------------------------------ Message: 4 Date: Thu, 16 Feb 2017 06:55:40 -0800 From: Suresh Ramasubramanian <ops.lists@gmail.com> To: "Sascha Luck [ml]" <aawg@c4inet.net>, <anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision Message-ID: <E9ECECAD-43D9-4D25-ABFA-78F376512BBE@gmail.com> Content-Type: text/plain; charset="UTF-8" Do name names. Who ? according to you ? is a sockpuppet here? Or a troll? All I see in this email is a series of stream of consciousness accusations but zero specifics. To be plain ? I think many people on this list, you included, have zero background in abuse mitigation, and engaging in any sort of discussion with such people is, just possibly, a slightly less unproductive endless loop than engaging with Kamphuis would have been. But beyond that I see zero signs of collusion, as you seem to allege others have been saying. On 16/02/17, 6:40 AM, "anti-abuse-wg on behalf of Sascha Luck [ml]" <anti-abuse-wg-bounces@ripe.net on behalf of aawg@c4inet.net> wrote: Agreed. So, if censorship be it, please remove all the other trolls, including their sockpuppets, from this list. I suspect it will be a very quiet one after that and perhaps deservedly so. ------------------------------ Message: 5 Date: Thu, 16 Feb 2017 16:59:40 +0200 From: ox <andre@ox.co.za> To: "Sascha Luck [ml]" <aawg@c4inet.net> Cc: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision Message-ID: <mailman.6429.1487263553.1952.anti-abuse-wg@ripe.net> Content-Type: text/plain; charset=US-ASCII On Thu, 16 Feb 2017 14:40:02 +0000 "Sascha Luck [ml]" <aawg@c4inet.net> wrote: > On Thu, Feb 16, 2017 at 01:05:19PM +0000, Brian Nisbet wrote: > >This morning Tobias and I asked the NCC to take the very unusual > >step, effectively immediately, of removing the person behind > >svenk@xs4all.nl from the Anti-Abuse WG mailing list. This was > >not done lightly, rather it was done to safeguard this > >community. > Safeguard it from what? Non-approved opinions? Please note that, > as a notional member of said community, I was not asked whether I > wanted to be "safeguarded". Thank you, Daddy, for looking out for > my well-being but I'm old enough to look after that myself... speak for yourself! I am still young and beautiful :) > >It is not a place to insult, to decry, to repeatedly state the > >same point over and over > While I agree, there are some others guilty of that, viz. the > repeated accusation that ISPs (and the RIPE NCC) are criminals > (or at least in league with such) etc. Seemingly, they have yet > to be banned from this list. > >or to discriminate against other members of the community based > >on their race, creed, gender or sexual preferences. > A quick browse (and thanks for making me have to do that)through > the relevant contributions has not thrown up any obvious evidence > of any such statements. If you have any that I might have missed, > I'd like to see it. Otherwise, I think, an apology for what > certainly reads like a gratuitious accusation is more than > appropriate. > >If we cannot maintain a list upon which reasonable discussion > >can take place, then it leaves our community in a weakened > >state. > Agreed. So, if censorship be it, please remove all the other > trolls, including their sockpuppets, from this list. I suspect it > will be a very quiet one after that and perhaps deservedly so. > If nobody is to be allowed to ridicule or criticise the "other" > side - and the contributor has a valid point, however annoyingly > presented, it is not a "community" but a "cult". > Kind Regards, > Sascha Luck > mostly +1 buuut... well... i like being on a list with the ilk of Gert & Suresh & the dudes with seriosu abuse skillz :) - even if we are to be a cult :) please tell me about the alleged sockpuppet(s) - seriously (no trolling) i have sneaky suspicions, but, well, nothing concrete... For the rest, I am filled with FUD and each character typed results in an adjustment of tinfoil... - wondering what I am guilty of (cause I am always guilty of something - even if only of being ignorant of my own ignorance :) ) beFUDded ooh, if we are a cult, please do not kick me out... i have always wanted to be in a cult! - so are we a cult or no? Andre ------------------------------ Message: 6 Date: Thu, 16 Feb 2017 16:45:54 +0000 From: Brian Nisbet <brian.nisbet@heanet.ie> To: anti-abuse-wg@ripe.net Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision Message-ID: <bd4ee9e3-3680-42cf-f2fa-177ecf46a61d@heanet.ie> Content-Type: text/plain; charset=windows-1252; format=flowed Sascha, Sascha Luck [ml] wrote on 16/02/2017 14:40: > On Thu, Feb 16, 2017 at 01:05:19PM +0000, Brian Nisbet wrote: >> This morning Tobias and I asked the NCC to take the very unusual >> step, effectively immediately, of removing the person behind >> svenk@xs4all.nl from the Anti-Abuse WG mailing list. This was >> not done lightly, rather it was done to safeguard this >> community. > > Safeguard it from what? Non-approved opinions? Please note that, > as a notional member of said community, I was not asked whether I > wanted to be "safeguarded". Thank you, Daddy, for looking out for > my well-being but I'm old enough to look after that myself... This isn't just about you. It's about making sure that the community comes across as welcoming to all of the various stakeholders. Tobias and I (as well as others, but the decision was ours) felt that Sven did not in any way contribute to the community or that welcome. Yes, we've had less than ideal conversations here before, but it never went to the level seen recently. >> It is not a place to insult, to decry, to repeatedly state the >> same point over and over > > While I agree, there are some others guilty of that, viz. the > repeated accusation that ISPs (and the RIPE NCC) are criminals > (or at least in league with such) etc. Seemingly, they have yet > to be banned from this list. We are not here to talk about other instances. This is about one instance. There does need to be further conversation about the AA-WG community and the list. >> or to discriminate against other members of the community based >> on their race, creed, gender or sexual preferences. > > A quick browse (and thanks for making me have to do that)through > the relevant contributions has not thrown up any obvious evidence > of any such statements. If you have any that I might have missed, > I'd like to see it. Otherwise, I think, an apology for what > certainly reads like a gratuitious accusation is more than > appropriate. There is quite a lot of material that did not make it to the list because of the good offices of the NCC. Tobias and I asked them to take interim moderation measures. The question after that was to accept all mails or put in a ban, due to the continued issues we went for a ban. >> If we cannot maintain a list upon which reasonable discussion >> can take place, then it leaves our community in a weakened >> state. > > Agreed. So, if censorship be it, please remove all the other > trolls, including their sockpuppets, from this list. I suspect it > will be a very quiet one after that and perhaps deservedly so. > > If nobody is to be allowed to ridicule or criticise the "other" > side - and the contributor has a valid point, however annoyingly > presented, it is not a "community" but a "cult". Ridiculing and criticising are two very, very different things. We have never suggested that founded and well argued criticism shouldn't be allowed. Repeated offensive behaviour is very different. Brian Co-Chair, RIPE AA-WG End of anti-abuse-wg Digest, Vol 63, Issue 19 ********************************************* </DIV></DIV></DIV></BODY></HTML>