Re: Article on spammers and their infrastructure

2010-01-03 Thread Suresh Ramasubramanian
On Sun, Jan 3, 2010 at 10:24 PM, Eric Brunner-Williams wrote: > On 1/2/10 11:38 PM, Suresh Ramasubramanian wrote: >> ... it would be interesting if some process were developed to >> deaccredit or otherwise kill off the shell registrars > > Suresh, Why? My comment was more in the context of this t

Re: Article on spammers and their infrastructure

2010-01-03 Thread Eric Brunner-Williams
On 1/2/10 11:38 PM, Suresh Ramasubramanian wrote: > ... it would be interesting if some process were developed to > deaccredit or otherwise kill off the shell registrars Suresh, Why? ICANN accreditation provides the registrar with a right to attempt OT&E with registries, the Verisign operated .

Re: Article on spammers and their infrastructure

2010-01-02 Thread Suresh Ramasubramanian
While not at all touching the accuracy of knujon's stats with a bargepole, it would be interesting if some process were developed to deaccredit or otherwise kill off the shell registrars .. and the bogus LIRs (which is how the thread started). On Thu, Dec 31, 2009 at 10:02 PM, Eric Brunner-William

Re: Article on spammers and their infrastructure

2009-12-31 Thread Jorge Amodio
Cool. Then you just have to figure out how to unilaterally withdraw a resource that doesn't have a centralized automated verification system. Taking you out of whois doesn't automatically take you out of people's BGP tables, after all. > > That's step two of the problem - enforcemen

RE: Article on spammers and their infrastructure

2009-12-31 Thread Alex Lanstein
>>>From: Paul Timmins [p...@telcodata.us] >>>Cool. Then you just have to figure out how to unilaterally withdraw a >>>resource that doesn't have a centralized automated verification system. >>>Taking you out of whois doesn't automatically take you out of people's >>>BGP tables, after all. That's s

Re: Article on spammers and their infrastructure

2009-12-31 Thread David Conrad
On Dec 31, 2009, at 11:32 AM, Paul Timmins wrote: > Cool. Then you just have to figure out how to unilaterally withdraw a > resource that doesn't have a centralized automated verification system. > Taking you out of whois doesn't automatically take you out of people's BGP > tables, after all. S

Re: Article on spammers and their infrastructure

2009-12-31 Thread Paul Timmins
Barry Shein wrote: The obvious change RIRs could make would be to make sure the contracts they allocate resources under give them the latitude to cancel those contracts if certain boundaries of behavior are breached. YES I REALIZE EASIER SAID THAN DONE. But just as allocation of resources is no

Re: Article on spammers and their infrastructure

2009-12-31 Thread Barry Shein
The obvious change RIRs could make would be to make sure the contracts they allocate resources under give them the latitude to cancel those contracts if certain boundaries of behavior are breached. YES I REALIZE EASIER SAID THAN DONE. But just as allocation of resources is not a transfer of owne

Re: Article on spammers and their infrastructure

2009-12-31 Thread Eric Brunner-Williams
At the Montevideo ICANN meeting, in August, 2001, I was surprised, and disapointed, that the ISP Constituency had reduced to ... a couple of IP attorneys. So, as a point of departure, were one going to advocate policy which affects ISPs as ISPs, as opposed to ISPs as trademark portfolio manag

Re: Article on spammers and their infrastructure

2009-12-30 Thread Fred Baker
One might say the same about the IETF, which Randy likes to lampoon. Not sure how it comes up in this context, as (as Randy loves to remind us) while many operators attend, it is not first-and-foremost an operational community. As to ICANN, I think Rich may be talking about the registries a

Re: Article on spammers and their infrastructure

2009-12-30 Thread Paul Vixie
Randy Bush writes: >> If ARIN and/or RIPE and/or ICANN and/or anyone else were truly >> interested in making a dent in the problem, then they would have already >> paid attention to our collective work product. > > the rirs, the ietf, the icann, ... each think they are the top of the > mountain.

Re: Article on spammers and their infrastructure

2009-12-30 Thread Jorge Amodio
>> If ARIN and/or RIPE and/or ICANN and/or anyone else were truly >> interested in making a dent in the problem, then they would have >> already paid attention to our collective work product. > > the rirs, the ietf, the icann, ... each think they are the top of the > mountain.  we are supposed to c

Re: Article on spammers and their infrastructure

2009-12-30 Thread Randy Bush
> If ARIN and/or RIPE and/or ICANN and/or anyone else were truly > interested in making a dent in the problem, then they would have > already paid attention to our collective work product. the rirs, the ietf, the icann, ... each think they are the top of the mountain. we are supposed to come to t

Re: Article on spammers and their infrastructure

2009-12-30 Thread Rich Kulawiec
On Wed, Dec 23, 2009 at 01:58:47AM -0500, Christopher Morrow wrote: > The ARIN meetings (at least) are open, please come and help guide > policies. I'm sure RIPE also wouldn't mind a discussion, if there > could be some positive policy outcome. Why should I or anyone else do that? It will cost us

RE: Article on spammers and their infrastructure

2009-12-25 Thread O'Reirdan, Michael
ticle on spammers and their infrastructure Wouldn't that be kind of pointless? ARIN policies are proposed by the public, not ARIN staff or board members. https://www.arin.net/policy/pdp.html Policy proposals may be submitted by anyone in the global Internet community except for memb

Re: Article on spammers and their infrastructure

2009-12-24 Thread Leo Vegoda
On Dec 24, 2009, at 8:59 AM, Jon Lewis wrote: […] >> I am sure that your interpretation was the original intent of the policy >> text. However, the wording could also be read in a way that allows an LIR to >> just provide registry services, without providing any connectivity services. > > That's

Re: Article on spammers and their infrastructure

2009-12-24 Thread Jon Lewis
Wouldn't that be kind of pointless? ARIN policies are proposed by the public, not ARIN staff or board members. https://www.arin.net/policy/pdp.html Policy proposals may be submitted by anyone in the global Internet community except for members of the ARIN Board of Trustees or the ARIN staff

Re: Article on spammers and their infrastructure

2009-12-24 Thread Jon Lewis
On Tue, 22 Dec 2009, Leo Vegoda wrote: ASSIGNED PA: This address space has been assigned to an End User for use with services provided by the issuing LIR. It cannot be kept when terminating services provided by the LIR. My interpretation of the above is ASSIGNED PA is the equivalent of my

Re: Article on spammers and their infrastructure

2009-12-23 Thread O'Reirdan, Michael
JD Great point, I am more than happy to have a couple of people from ARIN or RIPE as guests at the next MAAWG in SFO or the subsequent one in Barcelona. Mike On 12/23/09 1:18 PM, "J.D. Falk" wrote: > On Dec 22, 2009, at 11:58 PM, Christopher Morrow wrote: > >> > On Wed, Dec 23, 2009 at 1:12

Re: Article on spammers and their infrastructure

2009-12-23 Thread J.D. Falk
On Dec 22, 2009, at 11:58 PM, Christopher Morrow wrote: > On Wed, Dec 23, 2009 at 1:12 AM, Paul Ferguson wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> Folks should not be so obtuse about these activities. It's almost blatantly >> in-your-face, so to speak. These guys have no f

Re: Article on spammers and their infrastructure

2009-12-23 Thread Joel Jaeggli
Rich Kulawiec wrote: > On Wed, Dec 23, 2009 at 01:58:47AM -0500, Christopher Morrow wrote: >> no real arguement, but... 'please provide some set of workable >> solutions' > > The set of workable solutions at this point looks something like > "null routes, firewall rules, blacklist entries" -- in

Re: Article on spammers and their infrastructure

2009-12-23 Thread Rich Kulawiec
On Wed, Dec 23, 2009 at 01:58:47AM -0500, Christopher Morrow wrote: > no real arguement, but... 'please provide some set of workable solutions' The set of workable solutions at this point looks something like "null routes, firewall rules, blacklist entries" -- in order to deny traffic to and from

Re: Article on spammers and their infrastructure

2009-12-22 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Dec 22, 2009 at 11:14 PM, Christopher Morrow wrote: > > IP-address issues can't get solved without policy changes, which > happen today via community consensus. Domain-name issues have to get > hammered out from the top down (with some policy

Re: Article on spammers and their infrastructure

2009-12-22 Thread Christopher Morrow
On Wed, Dec 23, 2009 at 2:05 AM, Paul Ferguson wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On Tue, Dec 22, 2009 at 10:58 PM, Christopher Morrow > wrote: > >> On Wed, Dec 23, 2009 at 1:12 AM, Paul Ferguson >> wrote: > >>> Folks should not be so obtuse about these activities. It's

Re: Article on spammers and their infrastructure

2009-12-22 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Dec 22, 2009 at 10:58 PM, Christopher Morrow wrote: > On Wed, Dec 23, 2009 at 1:12 AM, Paul Ferguson > wrote: >> Folks should not be so obtuse about these activities. It's almost >> blatantly in-your-face, so to speak. These guys have no fe

Re: Article on spammers and their infrastructure

2009-12-22 Thread Christopher Morrow
On Wed, Dec 23, 2009 at 1:12 AM, Paul Ferguson wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Folks should not be so obtuse about these activities. It's almost blatantly > in-your-face, so to speak. These guys have no fear of retribution. no real arguement, but... 'please provide so

Re: Article on spammers and their infrastructure

2009-12-22 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Dec 22, 2009 at 8:58 PM, Alex Lanstein wrote: > I might as well reply to this here. The folks from threatpost had me > talk at length about the various issues with doing cybercrime enforcement > and how things have changed, and they picked t

Re: Article on spammers and their infrastructure

2009-12-22 Thread Christopher Morrow
On Tue, Dec 22, 2009 at 7:03 PM, Nick Hilliard wrote: > On 22/12/2009 23:36, Jon Lewis wrote: >> So, if you're not multihomed with jump.ro as one of your providers, is 'multihomed' here could mean: "we have an IPSEC vpn, we need to use globally unique ip space, we may have exit points (and have s

RE: Article on spammers and their infrastructure

2009-12-22 Thread Alex Lanstein
y claim it was a downstream customer and that they've fixed the issue, when really it's their own stuff that they shuffle around. Regards, Alex Lanstein From: Jon Lewis [jle...@lewis.org] Sent: Tuesday, December 22, 2009 4:24 PM To: Phil Re

Re: Article on spammers and their infrastructure

2009-12-22 Thread Suresh Ramasubramanian
On Wed, Dec 23, 2009 at 4:24 AM, Joel Jaeggli wrote: > Christopher Morrow wrote: >> On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis wrote: >> >> >>> Should US based networks be willing to route RIPE "ASSIGNED PA" space >>> customers provide? > > Are any of your customers multinationals? What would yo

Re: Article on spammers and their infrastructure

2009-12-22 Thread Leo Vegoda
On 22/12/2009 3:36, "Jon Lewis" wrote: [...] > They may be. I don't agree that it's relevant. You can disagree with the > RIPE wording or with RIPE policies, or maybe I'm misinterpreting > > ASSIGNED PA: This address space has been assigned to an End User for use > with services provided

Re: Article on spammers and their infrastructure

2009-12-22 Thread Nick Hilliard
On 22/12/2009 23:36, Jon Lewis wrote: > On Tue, 22 Dec 2009, Joel Jaeggli wrote: >> On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis wrote: Should US based networks be willing to route RIPE "ASSIGNED PA" space customers provide? I would argue not and the bofh in me would be inclined to announ

Re: Article on spammers and their infrastructure

2009-12-22 Thread Jon Lewis
On Tue, 22 Dec 2009, Joel Jaeggli wrote: Should US based networks be willing to route RIPE "ASSIGNED PA" space customers provide? Are any of your customers multinationals? They may be. I don't agree that it's relevant. You can disagree with the RIPE wording or with RIPE policies, or maybe

Re: Article on spammers and their infrastructure

2009-12-22 Thread Joel Jaeggli
Christopher Morrow wrote: > On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis wrote: > > >> Should US based networks be willing to route RIPE "ASSIGNED PA" space >> customers provide? Are any of your customers multinationals? > this is an interesting question, which when I worked for an ISP I > alw

Re: Article on spammers and their infrastructure

2009-12-22 Thread Christopher Morrow
On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis wrote: > Should US based networks be willing to route RIPE "ASSIGNED PA" space > customers provide? this is an interesting question, which when I worked for an ISP I always wondered about. In fact, when we'd see solely based US customers asking for thi

Re: Article on spammers and their infrastructure

2009-12-22 Thread Jon Lewis
On Tue, 22 Dec 2009, Phil Regnauld wrote: http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets-spam-122109 It this something new ? The article seems to mix various issues together. And this would seem highly inefficient to me compared to traditional botnets (renting your

Re: Article on spammers and their infrastructure

2009-12-22 Thread Suresh Ramasubramanian
With the added refinement of spammer / botmaster controlled LIRs .. after spammer / botmaster controlled registrars. I did wonder sometimes how some snowshoe spammers could keep acquiring a series of /20 to /15 sized CIDRs over the past year or two. On Tue, Dec 22, 2009 at 6:38 PM, Tony Finch wro

Re: Article on spammers and their infrastructure

2009-12-22 Thread Tony Finch
On Tue, 22 Dec 2009, Phil Regnauld wrote: > http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets-spam-122109 > > It this something new ? The article seems to mix various issues together. > And this would seem highly inefficient to me compared to traditional > botnets (renti

Article on spammers and their infrastructure

2009-12-22 Thread Phil Regnauld
http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets-spam-122109 It this something new ? The article seems to mix various issues together. And this would seem highly inefficient to me compared to traditional botnets (renting your own rack for a botnet doesn't really make se