<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-IN" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> <p class="MsoNormal"><span style="mso-fareast-language:EN-US">+1 � most of the activity on this list has been people from the anti abuse community come up with suggestions that the RIPE regulars find unworkable, and then many people spend lots of time pointing out why the proposal is unworkable.<o:p></o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US">So far I have not seen one case of a proposal coming in from the other side on what can be done instead to achieve the goals of the unworkable proposal, but have a chance of working under RIPE policies and procedures.<o:p></o:p></span></p> <p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of IP Abuse Research <ipabuseresearch@gmail.com><br> <b>Date: </b>Wednesday, 2 December 2020 at 7:25 PM<br> <b>To: </b>Serge Droz <serge.droz@first.org><br> <b>Cc: </b>"anti-abuse-wg@ripe.net" <anti-abuse-wg@ripe.net><br> <b>Subject: </b>Re: [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I'd like to second Serge's sentiment, RFG catches a good deal of abuse for his contributions, which we have all seen on this and other lists. What the continued findings indicate is a need for IANA and the RIRs to adapt to a new stage in the resource issuance and governance lifecycle. Since this is by definition a working group, would it make sense to establish some metrics to quantify the perceived impact of this phenomenon on abuse?<o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">If we establish a process to collect these observations of either "abandoned" resources, prefixes or ASNs, which then re-appear mysteriously or in the case of an ASN start routing space that is unexpectedly, "hijack", we can take a step as a community to quantify the phenomenon? <o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Note: This is specifically not an internet policing function as much as a neighborhood watch effort to help inform the governing bodies / policy ... etc. Right now from responses it seems like defacto this weight has been put onto the shoulder of Spamhaus vs. having a working group work on a solution.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">If this is of interest I'm happy to write up a proposal and or work with the chairs to see if this is something that is seen as constructive. Also if this doesn't fit into the anti-abuse working group ... where does it fit?<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <div> <p class="MsoNormal">On Wed, Dec 2, 2020 at 3:12 AM Serge Droz via anti-abuse-wg <<a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a>> wrote:<o:p></o:p></p> </div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"> <p class="MsoNormal" style="margin-bottom:12.0pt">First of: Congrats and thank you Ronald for this work.<br> <br> What makes me a bit sad is, that posting this here immediately starts a<br> discussion about what is expected behavior on these lists, rather than<br> how we could combat abuse more efficiently.<br> <br> It seems a seeminglu, to me at least, humorous remark, sparks more<br> discussion than the troubling fact that criminals have the time of their<br> lives during this period of time.<br> <br> I'm all in favor of staying civil on public fora. But noting in the<br> original post was not civil. I am wondering what the we want to achieve<br> here on the anti-abuse list? Call me stupid, but I just don't get it.<br> <br> Best<br> Serge<br> <br> <br> On 01.12.20 22:48, Ronald F. Guilmette wrote:<br> > In message <DB7PR06MB501791137C12E71EA525C7DD94F40@DB7PR06MB5017.eurprd06.prod.<br> > <a href="http://outlook.com" target="_blank">outlook.com</a>>, Brian Nisbet <<a href="mailto:brian.nisbet@heanet.ie" target="_blank">brian.nisbet@heanet.ie</a>> wrote:<br> > <br> >> However I suspect that X-posting to a list like apnic-talk may not be the<br> >> wisest idea, given the different populations etc...<br> > <br> > It is among my fondest hopes that cybercriminals of all stripes, and<br> > particularly the ones who squat on IPv4 space that doesn't belong to<br> > them, will, in future, show more respect for regional boundaries, such<br> > that their devious activities will only oblige me to notify the<br> > members of a single one of the five RIR regions regarding any single<br> > one of these elaborate criminal schemes. Alas, in this instance<br> > however, the perpetrators, in a very unsportsmanlike manner, elected<br> > to make messes whose roots were found in both the RIPE region and also<br> > in the APNIC region. (And that's not even to mention that most of the<br> > squatted IPv4 real estate was and is under the administration of the<br> > ARIN region.)<br> > <br> > Clearly, authorities in all five regions should be devoting somewhat<br> > more effort towards the cultivation of a better and more respectful<br> > class of cybercriminals who will confine their convoluted schemes to<br> > their own home regions.<br> > <br> > <br> > Regards,<br> > rfg<br> > <br> <br> -- <br> Dr. Serge Droz<br> Chair of the FIRST Board of Directors<br> <a href="https://www.first.org" target="_blank">https://www.first.org</a><o:p></o:p></p> </blockquote> </div> </div> </body> </html>