<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-IE" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> Serge<o:p></o:p> <o:p> </o:p> It�s not a matter of �comfort zones� � which Nick explained quite articulately<o:p></o:p> <o:p> </o:p> RIPE currently does not have the power to do a lot of things. The WG cannot magically change that. <o:p></o:p> <o:p> </o:p> If you look at the current �debate� raging on the main members� list, people are arguing over a potential 50 euro / year fee for an ASN trying to make out that it could potentially bankrupt them�. <o:p></o:p> <o:p> </o:p> Getting the same people to agree to giving RIPE NCC more powers over their actions would be an uphill struggle!<o:p></o:p> <o:p> </o:p> Regards<o:p></o:p> <o:p> </o:p> Michele<o:p></o:p> <o:p> </o:p> -- <o:p></o:p> Mr Michele Neylon<o:p></o:p> Blacknight Solutions<o:p></o:p> Hosting, Colocation & Domains<o:p></o:p> <a href="https://www.blacknight.com/">https://www.blacknight.com/</a><o:p></o:p> <a href="https://blacknight.blog/">https://blacknight.blog/</a><o:p></o:p> Intl. +353 (0) 59 9183072<o:p></o:p> Direct Dial: +353 (0)59 9183090<o:p></o:p> Personal blog: <a href="https://michele.blog/">https://michele.blog/</a><o:p></o:p> Some thoughts: <a href="https://ceo.hosting/">https://ceo.hosting/</a><o:p></o:p> -------------------------------<o:p></o:p> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845<o:p></o:p> <o:p> </o:p> I have sent this email at a time that is convenient for me. I do not expect you to respond to it outside of your usual working hours.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div id="mail-editor-reference-message-container"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Serge Droz via anti-abuse-wg <anti-abuse-wg@ripe.net> Date: Friday, 10 May 2024 at 13:51 To: Cc: anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] Seeking Input on the Future of the Anti-Abuse Working Group<o:p></o:p> </div> <div style="mso-element:para-border-div;border:solid #FFCACA 1.0pt;padding:12.0pt 12.0pt 12.0pt 12.0pt;background:#FFCACA;margin-left:36.0pt;margin-right:0cm"> [EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources.<o:p></o:p> </div> <div> <div> Hi Nick I agree. But what you are saying, is that the WG should continue having no tangible effect, because the status quo is more important than getting out of one's comfort zone. Meanwhile others will, in my opinion, push for policy change. And these others likely lack crucial insight, i.e. will produce policies that have undesirable side effects. The question was if we want to recharter this WG, so I answered what I felt merits the name. I like the training the WG produced in the past, but I don't remember much else. If we want to make a concrete contribution to fighting abuse, we may have to leave our comfort zone. The internet and the world it lies within has changed considerably in the past years. This would suggest we should too. But I think I made my point by now, and I realise it's not a comfortable one. Best Serge<o:p></o:p> </div> <o:p> </o:p> <div> <div> On 10 May 2024 11:57:44 UTC, Nick Hilliard <nick@foobar.org> wrote:<o:p></o:p> </div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"> <div> Serge, there's been extensive debate on AAWG over the years about the principles behind your additional suggestions below, but very little consensus. If sanctioning is added to the charter of a new security-wg, this lack of consensus is likely to continue, and the only outcome will be that the WG will be distracted from other productive output. I understand why you might want it in there, but punitive action is not within the remit of the RIPE NCC. Similarly on point 2, advocacy is important, but requirement / enforcement is out of scope for both the RIPE Community and RIPE NCC. Nick Serge Droz via anti-abuse-wg wrote on 10/05/2024 07:21: <o:p></o:p> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Hi Leo<o:p></o:p> It's more about sharpening the focus. I colored this red below. I feel eventually the RIPE NCC must adapt stronger policies to punish non-action or disregard of action. I think it would be better if this WG comes up with such policies which the RIPE NCC can then adopt (or not) rather than the RIPE NCC having to react to external pressure, e.g. from policy makers, in particular the EU. I'm sure one can formulate this much better. I firmly believe, that there is no way around stronger regulation, and I'd much rather see this coming from this community than form the outside. The regulators i see and work with are increasingly irritated and react with totally inadequate demands, which I wont reproduce here.<o:p></o:p> <![if !supportLists]>1. <![endif]>Identifying and analyzing emerging security threats and vulnerabilities affecting Internet infrastructure.<o:p></o:p> <![if !supportLists]>2. <![endif]>Collaborating with stakeholders, in particular the RIPE community, to develop and advocate and implement best practices, guidelines, and standards for securing Internet resources.<o:p></o:p> <![if !supportLists]>3. <![endif]>Facilitating information sharing and cooperation among network operators, law enforcement, and relevant entities to mitigate security risks.<o:p></o:p> <![if !supportLists]>4. <![endif]>Providing education, training, and outreach initiatives to raise awareness of security issues and promote best practices adoption.<o:p></o:p> <![if !supportLists]>5. <![endif]>Develop policies recommendations to the RIPE NCC that help enforcing good behavior and sanction disregard for faccepted security standards. This includes the definition of acceptable minimal standards. <o:p></o:p> <div> Best regards<o:p></o:p> </div> <div> Serge<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> On 09.05.24 21:39, Leo Vegoda wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <pre style="margin-left:36.0pt">Hi Serge,<o:p></o:p></pre> <pre style="margin-left:36.0pt"><o:p> </o:p></pre> <pre style="margin-left:36.0pt">On Thu, 9 May 2024 at 11:41, Serge Droz via anti-abuse-wg<o:p></o:p></pre> <pre style="margin-left:36.0pt"><a href="mailto:anti-abuse-wg@ripe.net"><anti-abuse-wg@ripe.net></a> wrote:<o:p></o:p></pre> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <pre style="margin-left:36.0pt">Hi Leo<o:p></o:p></pre> <pre style="margin-left:36.0pt"><o:p> </o:p></pre> <pre style="margin-left:36.0pt">We can only recommend the community, obviously.<o:p></o:p></pre> </blockquote> <pre style="margin-left:36.0pt">I agree.<o:p></o:p></pre> <pre style="margin-left:36.0pt"><o:p> </o:p></pre> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <pre style="margin-left:36.0pt">So these aare the best<o:p></o:p></pre> <pre style="margin-left:36.0pt">practices<o:p></o:p></pre> <pre style="margin-left:36.0pt"><o:p> </o:p></pre> <pre style="margin-left:36.0pt">We can recommend that RIPE NCC changes its rules and procedures to<o:p></o:p></pre> <pre style="margin-left:36.0pt">address certain issues.<o:p></o:p></pre> <pre style="margin-left:36.0pt"><o:p> </o:p></pre> <pre style="margin-left:36.0pt">As a WG, if I'm correct we have no other power.<o:p></o:p></pre> </blockquote> <pre style="margin-left:36.0pt">Based on thisl, I don't understand what's missing from the draft text.<o:p></o:p></pre> <pre style="margin-left:36.0pt">Maybe you could suggest some specific edits?<o:p></o:p></pre> <pre style="margin-left:36.0pt"><o:p> </o:p></pre> <pre style="margin-left:36.0pt">Kind regards,<o:p></o:p></pre> <pre style="margin-left:36.0pt"><o:p> </o:p></pre> <pre style="margin-left:36.0pt">Leo<o:p></o:p></pre> </blockquote> <pre style="margin-left:36.0pt">-- <o:p></o:p></pre> <pre style="margin-left:36.0pt">Dr. Serge Droz<o:p></o:p></pre> <pre style="margin-left:36.0pt">Member, FIRST Board of Directors <o:p></o:p></pre> <pre style="margin-left:36.0pt"><a href="https://www.first.org">https://www.first.org</a><o:p></o:p></pre> <o:p></o:p> </blockquote> <o:p> </o:p> </div> </blockquote> </div> <div> -- Dr. Serge Droz Director, Forum of Incident Response and Security Teams <a href="https://first.org">https://first.org</a><o:p></o:p> </div> </div> </div> </div> </div> </body> </html>