Re: Article on spammers and their infrastructure

2010-01-03 Thread Eric Brunner-Williams
On 1/2/10 11:38 PM, Suresh Ramasubramanian wrote: ... it would be interesting if some process were developed to deaccredit or otherwise kill off the shell registrars Suresh, Why? ICANN accreditation provides the registrar with a right to attempt OTE with registries, the Verisign operated

Re: Article on spammers and their infrastructure

2010-01-03 Thread Suresh Ramasubramanian
On Sun, Jan 3, 2010 at 10:24 PM, Eric Brunner-Williams brun...@nic-naa.net wrote: On 1/2/10 11:38 PM, Suresh Ramasubramanian wrote: ... it would be interesting if some process were developed to deaccredit or otherwise kill off the shell registrars Suresh, Why? My comment was more in the

Re: Article on spammers and their infrastructure

2010-01-02 Thread Suresh Ramasubramanian
While not at all touching the accuracy of knujon's stats with a bargepole, it would be interesting if some process were developed to deaccredit or otherwise kill off the shell registrars .. and the bogus LIRs (which is how the thread started). On Thu, Dec 31, 2009 at 10:02 PM, Eric

Re: Article on spammers and their infrastructure

2009-12-31 Thread Eric Brunner-Williams
At the Montevideo ICANN meeting, in August, 2001, I was surprised, and disapointed, that the ISP Constituency had reduced to ... a couple of IP attorneys. So, as a point of departure, were one going to advocate policy which affects ISPs as ISPs, as opposed to ISPs as trademark portfolio

Re: Article on spammers and their infrastructure

2009-12-31 Thread Barry Shein
The obvious change RIRs could make would be to make sure the contracts they allocate resources under give them the latitude to cancel those contracts if certain boundaries of behavior are breached. YES I REALIZE EASIER SAID THAN DONE. But just as allocation of resources is not a transfer of

Re: Article on spammers and their infrastructure

2009-12-31 Thread Paul Timmins
Barry Shein wrote: The obvious change RIRs could make would be to make sure the contracts they allocate resources under give them the latitude to cancel those contracts if certain boundaries of behavior are breached. YES I REALIZE EASIER SAID THAN DONE. But just as allocation of resources is

Re: Article on spammers and their infrastructure

2009-12-31 Thread David Conrad
On Dec 31, 2009, at 11:32 AM, Paul Timmins wrote: Cool. Then you just have to figure out how to unilaterally withdraw a resource that doesn't have a centralized automated verification system. Taking you out of whois doesn't automatically take you out of people's BGP tables, after all. See

RE: Article on spammers and their infrastructure

2009-12-31 Thread Alex Lanstein
From: Paul Timmins [p...@telcodata.us] Cool. Then you just have to figure out how to unilaterally withdraw a resource that doesn't have a centralized automated verification system. Taking you out of whois doesn't automatically take you out of people's BGP tables, after all. That's step two of the

Re: Article on spammers and their infrastructure

2009-12-31 Thread Jorge Amodio
Cool. Then you just have to figure out how to unilaterally withdraw a resource that doesn't have a centralized automated verification system. Taking you out of whois doesn't automatically take you out of people's BGP tables, after all. That's step two of the problem - enforcement.  Enforcement

Re: Article on spammers and their infrastructure

2009-12-30 Thread Rich Kulawiec
On Wed, Dec 23, 2009 at 01:58:47AM -0500, Christopher Morrow wrote: The ARIN meetings (at least) are open, please come and help guide policies. I'm sure RIPE also wouldn't mind a discussion, if there could be some positive policy outcome. Why should I or anyone else do that? It will cost us,

Re: Article on spammers and their infrastructure

2009-12-30 Thread Randy Bush
If ARIN and/or RIPE and/or ICANN and/or anyone else were truly interested in making a dent in the problem, then they would have already paid attention to our collective work product. the rirs, the ietf, the icann, ... each think they are the top of the mountain. we are supposed to come to

Re: Article on spammers and their infrastructure

2009-12-30 Thread Jorge Amodio
If ARIN and/or RIPE and/or ICANN and/or anyone else were truly interested in making a dent in the problem, then they would have already paid attention to our collective work product. the rirs, the ietf, the icann, ... each think they are the top of the mountain.  we are supposed to come to

Re: Article on spammers and their infrastructure

2009-12-30 Thread Paul Vixie
Randy Bush ra...@psg.com writes: If ARIN and/or RIPE and/or ICANN and/or anyone else were truly interested in making a dent in the problem, then they would have already paid attention to our collective work product. the rirs, the ietf, the icann, ... each think they are the top of the

Re: Article on spammers and their infrastructure

2009-12-30 Thread Fred Baker
One might say the same about the IETF, which Randy likes to lampoon. Not sure how it comes up in this context, as (as Randy loves to remind us) while many operators attend, it is not first-and-foremost an operational community. As to ICANN, I think Rich may be talking about the registries

RE: Article on spammers and their infrastructure

2009-12-25 Thread O'Reirdan, Michael
on spammers and their infrastructure Wouldn't that be kind of pointless? ARIN policies are proposed by the public, not ARIN staff or board members. https://www.arin.net/policy/pdp.html Policy proposals may be submitted by anyone in the global Internet community except for members

Re: Article on spammers and their infrastructure

2009-12-24 Thread Jon Lewis
On Tue, 22 Dec 2009, Leo Vegoda wrote: ASSIGNED PA: This address space has been assigned to an End User for use with services provided by the issuing LIR. It cannot be kept when terminating services provided by the LIR. My interpretation of the above is ASSIGNED PA is the equivalent of

Re: Article on spammers and their infrastructure

2009-12-24 Thread Jon Lewis
Wouldn't that be kind of pointless? ARIN policies are proposed by the public, not ARIN staff or board members. https://www.arin.net/policy/pdp.html Policy proposals may be submitted by anyone in the global Internet community except for members of the ARIN Board of Trustees or the ARIN

Re: Article on spammers and their infrastructure

2009-12-24 Thread Leo Vegoda
On Dec 24, 2009, at 8:59 AM, Jon Lewis wrote: […] I am sure that your interpretation was the original intent of the policy text. However, the wording could also be read in a way that allows an LIR to just provide registry services, without providing any connectivity services. That's one

Re: Article on spammers and their infrastructure

2009-12-23 Thread Rich Kulawiec
On Wed, Dec 23, 2009 at 01:58:47AM -0500, Christopher Morrow wrote: no real arguement, but... 'please provide some set of workable solutions' The set of workable solutions at this point looks something like null routes, firewall rules, blacklist entries -- in order to deny traffic to and from

Re: Article on spammers and their infrastructure

2009-12-23 Thread Joel Jaeggli
Rich Kulawiec wrote: On Wed, Dec 23, 2009 at 01:58:47AM -0500, Christopher Morrow wrote: no real arguement, but... 'please provide some set of workable solutions' The set of workable solutions at this point looks something like null routes, firewall rules, blacklist entries -- in order to

Re: Article on spammers and their infrastructure

2009-12-23 Thread J.D. Falk
On Dec 22, 2009, at 11:58 PM, Christopher Morrow wrote: On Wed, Dec 23, 2009 at 1:12 AM, Paul Ferguson fergdawgs...@gmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Folks should not be so obtuse about these activities. It's almost blatantly in-your-face, so to speak. These

Article on spammers and their infrastructure

2009-12-22 Thread Phil Regnauld
http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets-spam-122109 It this something new ? The article seems to mix various issues together. And this would seem highly inefficient to me compared to traditional botnets (renting your own rack for a botnet doesn't really make

Re: Article on spammers and their infrastructure

2009-12-22 Thread Tony Finch
On Tue, 22 Dec 2009, Phil Regnauld wrote: http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets-spam-122109 It this something new ? The article seems to mix various issues together. And this would seem highly inefficient to me compared to traditional botnets (renting

Re: Article on spammers and their infrastructure

2009-12-22 Thread Suresh Ramasubramanian
With the added refinement of spammer / botmaster controlled LIRs .. after spammer / botmaster controlled registrars. I did wonder sometimes how some snowshoe spammers could keep acquiring a series of /20 to /15 sized CIDRs over the past year or two. On Tue, Dec 22, 2009 at 6:38 PM, Tony Finch

Re: Article on spammers and their infrastructure

2009-12-22 Thread Jon Lewis
On Tue, 22 Dec 2009, Phil Regnauld wrote: http://threatpost.com/en_us/blogs/attackers-buying-own-data-centers-botnets-spam-122109 It this something new ? The article seems to mix various issues together. And this would seem highly inefficient to me compared to traditional botnets (renting

Re: Article on spammers and their infrastructure

2009-12-22 Thread Christopher Morrow
On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis jle...@lewis.org wrote: Should US based networks be willing to route RIPE ASSIGNED PA space customers provide? this is an interesting question, which when I worked for an ISP I always wondered about. In fact, when we'd see solely based US customers

Re: Article on spammers and their infrastructure

2009-12-22 Thread Joel Jaeggli
Christopher Morrow wrote: On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis jle...@lewis.org wrote: Should US based networks be willing to route RIPE ASSIGNED PA space customers provide? Are any of your customers multinationals? this is an interesting question, which when I worked for an ISP

Re: Article on spammers and their infrastructure

2009-12-22 Thread Jon Lewis
On Tue, 22 Dec 2009, Joel Jaeggli wrote: Should US based networks be willing to route RIPE ASSIGNED PA space customers provide? Are any of your customers multinationals? They may be. I don't agree that it's relevant. You can disagree with the RIPE wording or with RIPE policies, or maybe

Re: Article on spammers and their infrastructure

2009-12-22 Thread Nick Hilliard
On 22/12/2009 23:36, Jon Lewis wrote: On Tue, 22 Dec 2009, Joel Jaeggli wrote: On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis jle...@lewis.org wrote: Should US based networks be willing to route RIPE ASSIGNED PA space customers provide? I would argue not and the bofh in me would be inclined to

Re: Article on spammers and their infrastructure

2009-12-22 Thread Leo Vegoda
On 22/12/2009 3:36, Jon Lewis jle...@lewis.org wrote: [...] They may be. I don't agree that it's relevant. You can disagree with the RIPE wording or with RIPE policies, or maybe I'm misinterpreting ASSIGNED PA: This address space has been assigned to an End User for use with services

Re: Article on spammers and their infrastructure

2009-12-22 Thread Suresh Ramasubramanian
On Wed, Dec 23, 2009 at 4:24 AM, Joel Jaeggli joe...@bogus.com wrote: Christopher Morrow wrote: On Tue, Dec 22, 2009 at 4:24 PM, Jon Lewis jle...@lewis.org wrote: Should US based networks be willing to route RIPE ASSIGNED PA space customers provide? Are any of your customers

RE: Article on spammers and their infrastructure

2009-12-22 Thread Alex Lanstein
the issue, when really it's their own stuff that they shuffle around. Regards, Alex Lanstein From: Jon Lewis [jle...@lewis.org] Sent: Tuesday, December 22, 2009 4:24 PM To: Phil Regnauld Cc: nanog@nanog.org Subject: Re: Article on spammers

Re: Article on spammers and their infrastructure

2009-12-22 Thread Christopher Morrow
On Tue, Dec 22, 2009 at 7:03 PM, Nick Hilliard n...@foobar.org wrote: On 22/12/2009 23:36, Jon Lewis wrote: So, if you're not multihomed with jump.ro as one of your providers, is 'multihomed' here could mean: we have an IPSEC vpn, we need to use globally unique ip space, we may have exit points

Re: Article on spammers and their infrastructure

2009-12-22 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Dec 22, 2009 at 8:58 PM, Alex Lanstein alanst...@fireeye.com wrote: I might as well reply to this here. The folks from threatpost had me talk at length about the various issues with doing cybercrime enforcement and how things have

Re: Article on spammers and their infrastructure

2009-12-22 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Dec 22, 2009 at 10:58 PM, Christopher Morrow morrowc.li...@gmail.com wrote: On Wed, Dec 23, 2009 at 1:12 AM, Paul Ferguson fergdawgs...@gmail.com wrote: Folks should not be so obtuse about these activities. It's almost blatantly

Re: Article on spammers and their infrastructure

2009-12-22 Thread Christopher Morrow
On Wed, Dec 23, 2009 at 2:05 AM, Paul Ferguson fergdawgs...@gmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Dec 22, 2009 at 10:58 PM, Christopher Morrow morrowc.li...@gmail.com wrote: On Wed, Dec 23, 2009 at 1:12 AM, Paul Ferguson fergdawgs...@gmail.com wrote:

Re: Article on spammers and their infrastructure

2009-12-22 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Dec 22, 2009 at 11:14 PM, Christopher Morrow morrowc.li...@gmail.com wrote: IP-address issues can't get solved without policy changes, which happen today via community consensus. Domain-name issues have to get hammered out from the top