Re: Repeated Blacklisting / IP reputation

2009-10-03 Thread Rich Kulawiec
On Tue, Sep 15, 2009 at 09:22:02PM -0400, Christopher Morrow wrote: > > build expertise on managing it. If you go to SpamHaus you will see a major > > ISP and their netblocks listed and associated with known spammers. What is > > this ISP doing about this? Nothing! ?My guess is that they look at th

RE: Repeated Blacklisting / IP reputation

2009-09-17 Thread David Schwartz
Shawn Somers wrote: > Anyone that intentionally uses address space in a manner that they > know will cause it to become contaminated should be denied on any > further address space requests. I couldn't disagree more with this kind of heckler's veto proposal. RBL operators should not be permited

RE: Repeated Blacklisting / IP reputation

2009-09-16 Thread Lee Howard
> > and it will be up to the receipient to trust/accept the resource for what it > > currently is or chose to reject it and find soliace elsewhere. > > > > 'solace elsewhere'... dude there is no 'elsewhere'. "elsewhere" = "designated transfer" https://www.arin.net/policy/nrpm.html#eight3 Do you

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Wed, Sep 16, 2009 at 12:08 AM, Joel Jaeggli wrote: > Christopher Morrow wrote: >> >> Spammers have a lot of variables to change in this equation, RIR's >> dont always have the ability to see all of the variables, nor >> correlate all of the changes they see :( > > Being a crimnal enterprise the

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Joel Jaeggli
Christopher Morrow wrote: > > Spammers have a lot of variables to change in this equation, RIR's > dont always have the ability to see all of the variables, nor > correlate all of the changes they see :( Being a crimnal enterprise there are some tools in your kit that a legitimate business does no

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Tue, Sep 15, 2009 at 10:29 PM, wrote: > On Tue, Sep 15, 2009 at 09:34:14PM -0400, Christopher Morrow wrote: >> On Tue, Sep 15, 2009 at 4:46 PM,   wrote: >> > >> > so... this thread has a couple of really interesting characteristics. >> > a couple are worth mentioning more directly (they have b

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread bmanning
On Tue, Sep 15, 2009 at 09:34:14PM -0400, Christopher Morrow wrote: > On Tue, Sep 15, 2009 at 4:46 PM, wrote: > > > > so... this thread has a couple of really interesting characteristics. > > a couple are worth mentioning more directly (they have been alluded to > > elsewhere)... > > as always,

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Tue, Sep 15, 2009 at 4:46 PM, wrote: > > so... this thread has a couple of really interesting characteristics. > a couple are worth mentioning more directly (they have been alluded to > elsewhere)... as always, despite your choice in floral patterned shirts :) good comments/questions. > >  

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Tue, Sep 15, 2009 at 5:31 PM, Zaid Ali wrote: > I think costs of maintaining an abuse helpdesk is a big factor here. I don't > see many ISP's putting money and resources into an abuse helpdesk and this > is because it is low cost to obtain a Netblock so why should one employ and have you ever

on naming conventions (was: Re: Repeated Blacklisting / IP reputation)

2009-09-15 Thread Steven Champeon
on Tue, Sep 08, 2009 at 09:57:58AM -0500, Tom Pipes wrote: > [...] We have done our best to ensure these blocks conform to RFC > standards, including the proper use of reverse DNS pointers. Sorry to jump in so late, been catching up from vacation. I'm checking out the PTRs for the /18 you mention,

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Zaid Ali
I think costs of maintaining an abuse helpdesk is a big factor here. I don't see many ISP's putting money and resources into an abuse helpdesk and this is because it is low cost to obtain a Netblock so why should one employ and build expertise on managing it. If you go to SpamHaus you will

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Brandon Lehmann
I believe there is another side to that argument as well. If I operate a regional ISP and request address space for dynamic address pools I am aware of a few things: 1) I am fully aware that there is a chance a customer's system could become infected and generate millions of malicious messa

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread bmanning
so... this thread has a couple of really interesting characteristics. a couple are worth mentioning more directly (they have been alluded to elsewhere)... Who gets to define "bad" - other than a blacklist operator? Are the common, consistent defintions of "contamination"?

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Tue, Sep 15, 2009 at 4:23 PM, wrote: > On Tue, 15 Sep 2009 08:01:48 PDT, Shawn Somers said: > >>   Anyone that intentionally uses address space in a manner that they >> know will cause it to become contaminated should be denied on any >> further address space requests. > > You *do* realize tha

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Valdis . Kletnieks
On Tue, 15 Sep 2009 08:01:48 PDT, Shawn Somers said: > Anyone that intentionally uses address space in a manner that they > know will cause it to become contaminated should be denied on any > further address space requests. You *do* realize that the people you're directing that paragraph at a

RE: Repeated Blacklisting / IP reputation

2009-09-15 Thread Aaron Wendel
The mailing sent daily contains both. -Original Message- From: Justin Shore [mailto:jus...@justinshore.com] Sent: Tuesday, September 15, 2009 11:18 AM To: Martin Hannigan Cc: NANOG list Subject: Re: Repeated Blacklisting / IP reputation Martin Hannigan wrote: > > Well, I h

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Justin Shore
Martin Hannigan wrote: Well, I haven't even had coffee yet and... Get the removals: curl -ls http://lists.arin.net/pipermail/arin-issued/2009-September/000270.html | grep Remove | grep -v "" Get the additions: mahannig$ curl -ls http://lists.arin.net/pipermail/arin-issued/2009-September/

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Joe Greco
> I'd be more than happy to see this, with the added caveat that anyone > that returned address space to ARIN that was subsequently marked as > 'contaminated', should undergo a review process when attempting to > obtain new address space. Charge them for the review process > > Anyone that int

RE: Repeated Blacklisting / IP reputation

2009-09-15 Thread Shawn Somers
the fee's on a sliding scale based on the amount of contamination and churn. the more contamination, the higher the fee. Shawn Somers Michiel Klaver wrote: - Message: 3 Date: Tue, 15 Sep 2009 11:57:58 +0200 From: Michiel Klaver Subject: RE: Repeated Blacklisting / IP rep

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Martin Hannigan
Well, I haven't even had coffee yet and... Get the removals: curl -ls http://lists.arin.net/pipermail/arin-issued/2009-September/000270.html | grep Remove | grep -v "" Get the additions: mahannig$ curl -ls http://lists.arin.net/pipermail/arin-issued/2009-September/000270.html | grep Add | grep

RE: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-15 Thread Michiel Klaver
I think ARIN is no party to contact all RBL's and do any cleanup of 'contaminated' address space. The only steps ARIN might do are: - When requesting address space, one should be able to indicate whether receiving previous used address space would be unwanted or not. - When assigning address

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Martin Hannigan
On Mon, Sep 14, 2009 at 2:58 PM, Justin Shore wrote: > Frank Bulk wrote: > >> With scarcity of IPv4 addresses, organizations are more desperate than >> ever >> to receive an allocation. If anything, there's more of a disincentive >> than >> ever before for ARIN to spend time on netblock sanitizat

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Justin Shore
Frank Bulk wrote: With scarcity of IPv4 addresses, organizations are more desperate than ever to receive an allocation. If anything, there's more of a disincentive than ever before for ARIN to spend time on netblock sanitization. I do think that ARIN should inform the new netblock owner if it w

RE: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread Azinger, Marla
Subject: Re: Repeated Blacklisting / IP reputation, replaced by registered use On Sep 14, 2009, at 10:40 AM, Douglas Otis wrote: > Perhaps ICANN could require registries establish a clearing-house, > where at no cost, those assigned a network would register their intent > to initiate bul

Re: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread David Conrad
On Sep 14, 2009, at 10:40 AM, Douglas Otis wrote: Perhaps ICANN could require registries establish a clearing-house, where at no cost, those assigned a network would register their intent to initiate bulk traffic, such as email, from specific addresses. ICANN can't require the RIRs do anyt

RE: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread Lee Howard
> -Original Message- > From: Douglas Otis [mailto:do...@mail-abuse.org] > Sent: Monday, September 14, 2009 1:41 PM > To: joel jaeggli > Cc: NANOG list > Subject: Re: Repeated Blacklisting / IP reputation, replaced by registered use > > On 9/13/09 12:49 PM, joel

Re: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread Douglas Otis
On 9/13/09 12:49 PM, joel jaeggli wrote: Frank Bulk wrote: [] If anything, there's more of a disincentive than ever before for ARIN to spend time on netblock sanitization. This whole thread seems to be about shifting (I.E. by externalizing) the costs of remediation. presumably the entities re

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Martin Hannigan
On Sun, Sep 13, 2009 at 7:43 AM, John Curran wrote: > On Sep 11, 2009, at 6:52 PM, Martin Hannigan wrote: > > > > I honestly don't think that it's up to them to create a set-aside > > either, > > hence my comment about behind the scenes activities. I appreciate you > > detailing that, but I hones

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Rich Kulawiec
On Tue, Sep 08, 2009 at 11:44:44AM -0700, Wayne E. Bouchard wrote: > Best practices for the public or subscription RBLs should be to place > a TTL on the entry of no more than, say, 90 days or thereabouts. But there's no reason to do so, and a number of reasons not to, including the very high pro

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Tim Chown
On Sun, Sep 13, 2009 at 12:45:03PM -0400, Christopher Morrow wrote: > On Wed, Sep 9, 2009 at 11:48 PM, Mark Andrews wrote: > > > > > Note we all could start using IPv6 and avoid this problem altogether. > > There is nothing stopping us using IPv6 especially for MTA's. > > that'd solve the spam

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Andy Davidson
On 9 Sep 2009, at 06:04, Peter Beckman wrote: How about a trial period from ARIN? You get your IP block, and you get 30 days to determine if it is "clean" or not. The reuse issue is possibly decades away in v6 land. The reuse issue can't really be solved for v4 in a year or two. Sounds li

Re: Repeated Blacklisting / IP reputation

2009-09-13 Thread Christopher Morrow
On Wed, Sep 9, 2009 at 11:48 PM, Mark Andrews wrote: > Note we all could start using IPv6 and avoid this problem altogether. > There is nothing stopping us using IPv6 especially for MTA's. that'd solve the spam problem... for a while at least. (no ipv6 traffic == no spam) -Chris (yes, I'm yan

Re: Repeated Blacklisting / IP reputation

2009-09-13 Thread Christopher Morrow
On Wed, Sep 9, 2009 at 11:30 PM, Leo Vegoda wrote: > On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: > >> Along the same lines, I noticed that the worst Actor in recent >> memory (McColo - AS26780) stopped paying their bills to ARIN and >> their addresses have been returned to the pool. >> >> It'

Re: Repeated Blacklisting / IP reputation

2009-09-13 Thread John Curran
On Sep 11, 2009, at 6:52 PM, Martin Hannigan wrote: > > I honestly don't think that it's up to them to create a set-aside > either, > hence my comment about behind the scenes activities. I appreciate you > detailing that, but I honestly don't think it matters since as you > mentioned > you get

RE: Repeated Blacklisting / IP reputation

2009-09-12 Thread Keith Medcalf
> and then that's PART of the MTA. Otherwise, it's an add-on > of some sort. > Given that the point I was making was about capabilities *included* in > the MTA, and given that I *said* you could add on such functions, it's > kind of silly to try to confuse the issue in this manner. CommuniGate P

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread joel jaeggli
ill [mailto:jcdill.li...@gmail.com] > Sent: Wednesday, September 09, 2009 5:40 PM > To: NANOG list > Subject: Re: Repeated Blacklisting / IP reputation > > > > They can (and IMHO should) determine the state it is in before they > reallocate it. What happens next is

RE: Repeated Blacklisting / IP reputation

2009-09-12 Thread Frank Bulk
esday, September 09, 2009 5:40 PM To: NANOG list Subject: Re: Repeated Blacklisting / IP reputation They can (and IMHO should) determine the state it is in before they reallocate it. What happens next is obviously unpredictable but in reality an IP that isn't being blocked today and isn&#x

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread Joe Greco
> > "Joe" == Joe Greco writes: > > Joe> So, you agree, MTA's do not implement this functionality. It's > Joe> obviously possible to make it happen through shell scripting, > Joe> database tricks, > > No, I do not agree. > > The sql backend is part of the MTA; features added by offering a s

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread James Cloos
> "Joe" == Joe Greco writes: Joe> So, you agree, MTA's do not implement this functionality. It's Joe> obviously possible to make it happen through shell scripting, Joe> database tricks, No, I do not agree. The sql backend is part of the MTA; features added by offering a sql backend for tab

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread Joe Greco
> > "Joe" == Joe Greco writes: > Joe> Show me ONE major MTA which allows you to configure an expiration > Joe> for an ACL entry. > > Any MTA which supports using an sql db as its backend. Postfix is a > fine example. > > You just define the table and the query to either have an until column

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread James Cloos
> "Joe" == Joe Greco writes: Joe> Show me ONE major MTA which allows you to configure an expiration Joe> for an ACL entry. Any MTA which supports using an sql db as its backend. Postfix is a fine example. You just define the table and the query to either have an until column, or have a col

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread Martin Hannigan
On Fri, Sep 11, 2009 at 4:23 PM, David Conrad wrote: > Marty, > > > It's possible that not everything is above the table as well. >> > > Actually, no. The whole point in publishing the algorithm IANA is using in > allocating /8s is to allow anyone to verify for themselves we are following > th

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread David Conrad
Marty, On Sep 10, 2009, at 2:45 PM, Martin Hannigan wrote: Not sure when ICANN got into the business of economic bailouts, ?? The blog posting implies it: "AfriNIC and LACNIC have fewest IPv4 /8s and service the regions with the most developing economies. We decided that those RIRs shoul

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread Joel Jaeggli
Benjamin Billon wrote: > >> Why don't we just blacklist everything and only whitelist those we know >> are good? >> >>> Note we all could start using IPv6 and avoid this problem altogether. >> > Yeah. When ISP will start receiving SMTP traffic in IPv6, they could > start to accept whiteliste

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread Joel Jaeggli
Peter Beckman wrote: > On Thu, 10 Sep 2009, Mark Andrews wrote: > >> What a load of rubbish. How is ARIN or any RIR/LIR supposed to >> know the intent of use? > > Why don't we just blacklist everything and only whitelist those we know > are good? > > Because the cost of determining who is

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Scott Weeks
--- leo.veg...@icann.org wrote: In my limited experience, requesting address space from ARIN involved describing what I would be doing with it. YMMV. - That's the easy part of the process. Proof of what you did with what you already have assigned to yo

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Leo Vegoda
On 09/09/2009 8:48, "Mark Andrews" wrote: [...] > What a load of rubbish. How is ARIN or any RIR/LIR supposed to > know the intent of use? In my limited experience, requesting address space from ARIN involved describing what I would be doing with it. YMMV. Leo

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Martin Hannigan
On Thu, Sep 10, 2009 at 4:21 PM, David Conrad wrote: > On Sep 9, 2009, at 8:41 PM, Martin Hannigan wrote: > >> Not sure when ICANN got into the business of economic bailouts, >> > > ?? > The blog posting implies it: "AfriNIC and LACNIC have fewest IPv4 /8s and service the regions with the most

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread David Conrad
On Sep 9, 2009, at 8:41 PM, Martin Hannigan wrote: Not sure when ICANN got into the business of economic bailouts, ?? but the mechanism that ICANN has defined seems patently unfair. RFC 2777 is unfair? Or are you unhappy that LACNIC and AfriNIC have 2 /8s from the least tainted pools?

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Joe Greco
> Because the cost of determining who is good and who is not has a great > cost. If you buy an IP block, regardless of your intent, that IP block > should not have the ill-will of the previous owner passed on with it. Might as well be the end of discussion, right there, then, because what

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Valdis . Kletnieks
On Wed, 09 Sep 2009 20:30:02 PDT, Leo Vegoda said: > Putting these addresses back into use does not mean that they have to > be allocated to networks where they'll number mail servers. ARIN staff > is doubtless aware of the history of these blocks and will presumably > do their best to allocate th

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Benjamin Billon
You're not Hotmail =)

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Peter Beckman
On Thu, 10 Sep 2009, Benjamin Billon wrote: Why don't we just blacklist everything and only whitelist those we know are good? Note we all could start using IPv6 and avoid this problem altogether. Yeah. When ISP will start receiving SMTP traffic in IPv6, they could start to accept whitel

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Kevin Loch
Benjamin Billon wrote: Why don't we just blacklist everything and only whitelist those we know are good? Note we all could start using IPv6 and avoid this problem altogether. Yeah. When ISP will start receiving SMTP traffic in IPv6, they could start to accept whitelisted senders only.

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread bmanning
On Thu, Sep 10, 2009 at 04:42:13PM +0200, Benjamin Billon wrote: > > > Why don't we just blacklist everything and only whitelist those we know > > are good? > > > >>Note we all could start using IPv6 and avoid this problem altogether. > > > Yeah. When ISP will start receiving SMTP traffic in IPv6,

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Benjamin Billon
Why don't we just blacklist everything and only whitelist those we know are good? Note we all could start using IPv6 and avoid this problem altogether. Yeah. When ISP will start receiving SMTP traffic in IPv6, they could start to accept whitelisted senders only. "IPv6 emails == clean"

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Peter Beckman
On Thu, 10 Sep 2009, Mark Andrews wrote: What a load of rubbish. How is ARIN or any RIR/LIR supposed to know the intent of use? Why don't we just blacklist everything and only whitelist those we know are good? Because the cost of determining who is good and who is not has a great cost.

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Nick Feamster
Hi Tom (and NANOG), You may be interested in an alternative approach, motivated by the very problem you are facing (see below). Our system, SNARE, develops IP reputation automatically based on a combination of network features. We'll discuss the pros and cons of this approach at MAAWG. The addit

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Dave Martin
On Wed, Sep 09, 2009 at 04:13:18PM -0700, Jay Hennigan wrote: > JC Dill wrote: > As for a role account, there is "postmaster". I would think that the > best hope in the real world, rather than an autoresponder would be an > RFC that clearly defines text accompanying an SMTP rejection notice

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Mark Andrews
In message , Leo Vegoda writes: > On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: > > > Along the same lines, I noticed that the worst Actor in recent =20 > > memory (McColo - AS26780) stopped paying their bills to ARIN and =20 > > their addresses have been returned to the pool. > > > > It's my

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Martin Hannigan
On Wed, Sep 9, 2009 at 11:30 PM, Leo Vegoda wrote: > On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: > > > Along the same lines, I noticed that the worst Actor in recent > > memory (McColo - AS26780) stopped paying their bills to ARIN and > > their addresses have been returned to the pool. > > >

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Leo Vegoda
On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: > Along the same lines, I noticed that the worst Actor in recent > memory (McColo - AS26780) stopped paying their bills to ARIN and > their addresses have been returned to the pool. > > It's my opinion that a very select number of CIDR blocks (a

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Sep 9, 2009 at 7:18 PM, Alex Lanstein wrote: > Along the same lines, I noticed that the worst Actor in recent memory > (McColo - AS26780) stopped paying their bills to ARIN and their addresses > have been returned to the pool. > > It's my opi

RE: Repeated Blacklisting / IP reputation

2009-09-09 Thread Alex Lanstein
_ From: John Curran [jcur...@arin.net] Sent: Tuesday, September 08, 2009 1:43 PM To: nanog@nanog.org Subject: Re: Repeated Blacklisting / IP reputation Folks - It appears that we have a real operational problem, in that ARIN does indeed reissue space that has been reclaimed/r

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread David Conrad
On Sep 9, 2009, at 12:13 PM, Martin Hannigan wrote: The problem of tainted ipv4 allocations probably grows from here since at some point in the near future there isn't going to be much left in terms of "clean" space to allocate. We're running out of v4 addresses in case anyone forgot. Som

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Jay Hennigan
JC Dill wrote: Joe Greco wrote: Answer queries to whether or not IP space X is currently blocked (potentially at one of hundreds or thousands of points in their system, which corporate security may not wish to share, or even give "some random intern" access to)? Process reports of new ARIN d

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread JC Dill
Joe Greco wrote: John Curran wrote: On Sep 8, 2009, at 2:18 PM, JC Dill wrote: It seems simple and obvious that ARIN, RIPE, et. al. should determine the blacklist state of a reclaimed IP group and ensure that the IP group is usable before re-allocating it. When IPs are reclaimed,

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Valdis . Kletnieks
On Wed, 09 Sep 2009 15:13:44 EDT, Martin Hannigan said: > Not sure that this is an ARIN problem more than an operational problem since > RBL's are opt-in. An effort to identify RBL's that are behaving poorly is > probably more interesting at this point, no? I suspect the problem isn't poor RBLs, i

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread John Curran
On Sep 8, 2009, at 5:20 PM, Joe Provo wrote: > > On Tue, Sep 08, 2009 at 01:43:39PM -0400, John Curran wrote: > [snip] >> Could some folks from the appropriate networks explain why >> this is such a problem and/or suggest additional steps that >> ARIN or the receipts should be taking to avoid th

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Martin Hannigan
On Wed, Sep 9, 2009 at 1:15 PM, Seth Mattinen wrote: > Skywing wrote: > > What's to stop spammers from doing this to cycle through blocks in > rapid-fashion? > > > > This proposal seems easily abusable to me. > > > > Oh, I don't know, maybe ARIN staff can say no? The process is heavy with > human

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Seth Mattinen
Skywing wrote: > What's to stop spammers from doing this to cycle through blocks in > rapid-fashion? > > This proposal seems easily abusable to me. > Oh, I don't know, maybe ARIN staff can say no? The process is heavy with human interaction, there is nothing "rapid" about it, and bears no compa

RE: Repeated Blacklisting / IP reputation

2009-09-09 Thread Skywing
g.org Subject: Re: Repeated Blacklisting / IP reputation How about a trial period from ARIN? You get your IP block, and you get 30 days to determine if it is "clean" or not. Do some testing, check the blacklists, do some magic to see if there are network-specific blacklists that might prevent

RE: Repeated Blacklisting / IP reputation

2009-09-09 Thread Frank Bulk
n would likely have. Contact info could be made available, mechanism to request delisting, etc. Frank -Original Message- From: Jay Hennigan [mailto:j...@west.net] Sent: Tuesday, September 08, 2009 1:14 PM To: John Curran Cc: nanog@nanog.org Subject: Re: Repeated Blacklisting / IP reputation

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Greco
> John, > > ARIN's role as the entity engaged in legal contractual relationship with > the previous owners of the space puts it in the position to insert > enforceable contract clauses to deter and/or mitigate "graffiti" in > allocations. That's complicated. How do you define "graffiti"? Jus

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Maimon
John, ARIN's role as the entity engaged in legal contractual relationship with the previous owners of the space puts it in the position to insert enforceable contract clauses to deter and/or mitigate "graffiti" in allocations. Policy proposals probably are not required for this. Space origi

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Dave Rand
[In the message entitled "Re: Repeated Blacklisting / IP reputation" on Sep 8, 14:34, Joe Greco writes:] > > there is a fundamental disconnect here. the IP space is neutral. > > it has no bias toward or against social behaviours. its a tool. > > the actual/real ta

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Greco
> bmann...@vacation.karoshi.com wrote: > > sounds like domain tasting to me. > > Oops! Oh yeah. Spammer gets an allocation... > > "Well, if that netblock was clean before, it sure isn't now! May I > please have another?" > > Lather, rinse, repeat. THAT would probably be easy enough to dete

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Greco
> > Show me ONE major MTA which allows you to configure an expiration for > > an ACL entry. > > > > The problem with your opinion, and it's a fine opinion, and it's even a > > good opinion, is that it has very little relationship to the tools which > > are given to people in order to accomplish blo

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Chris Hills
On 08/09/09 21:34, Joe Greco wrote: Show me ONE major MTA which allows you to configure an expiration for an ACL entry. This is fairly trivial to do with Exim by storing your acl entries in a database or directory with a field/attribute for expiry, and an appropriate router configuration. No

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Jay Hennigan
bmann...@vacation.karoshi.com wrote: sounds like domain tasting to me. Oops! Oh yeah. Spammer gets an allocation... "Well, if that netblock was clean before, it sure isn't now! May I please have another?" Lather, rinse, repeat. -- Jay Hennigan - CCIE #7880 - Network Engineering - j...@

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread bmanning
sounds like domain tasting to me. --bill On Wed, Sep 09, 2009 at 01:04:48AM -0400, Peter Beckman wrote: > How about a trial period from ARIN? You get your IP block, and you get 30 > days to determine if it is "clean" or not. Do some testing, check the > blacklists, do some magic to see if th

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Seth Mattinen
Peter Beckman wrote: > How about a trial period from ARIN? You get your IP block, and you get 30 > days to determine if it is "clean" or not. Do some testing, check the > blacklists, do some magic to see if there are network-specific blacklists > that might prevent your customers from sending or

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Peter Beckman
How about a trial period from ARIN? You get your IP block, and you get 30 days to determine if it is "clean" or not. Do some testing, check the blacklists, do some magic to see if there are network-specific blacklists that might prevent your customers from sending or receiving email/web/other co

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread William Astle
anog.org Sent: Tue Sep 08 17:17:58 2009 Subject: Re: Repeated Blacklisting / IP reputation ISPs can be invited and there are specific meetings for them (closed to other members). There're also whitepapers for ISP (and others). But I agree, hoping ALL the ISPs join MAAWG or even hear about

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread O'Reirdan, Michael
t: Re: Repeated Blacklisting / IP reputation ISPs can be invited and there are specific meetings for them (closed to other members). There're also whitepapers for ISP (and others). But I agree, hoping ALL the ISPs join MAAWG or even hear about it is utopian. -- Benjamin William Astle a écr

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Benjamin Billon
ISPs can be invited and there are specific meetings for them (closed to other members). There're also whitepapers for ISP (and others). But I agree, hoping ALL the ISPs join MAAWG or even hear about it is utopian. -- Benjamin William Astle a écrit : J.D. Falk wrote: Seth Mattinen wrote:

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Justin Shore
Jay Hennigan wrote: By the way, among the members... Experian CheetahMail ExactTarget, Inc Responsys, Inc. Vertical Response, Inc Yesmail Have you been reading from my blacklist again, Jay? Justin

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Tom Pipes
I am amazed with the amount of thoughtful comments I have seen, both on and off list. It really illustrates that people are willing to try to help out, but there is an overall lack of clear direction on how to improve things. Most of us seem to adopt that which has always just worked for us. Do

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread William Astle
J.D. Falk wrote: Seth Mattinen wrote: I was always under the impression that smaller orgs were not allowed to join the MAAWG club. I've heard that, too, but have no idea where it comes from. It's not true; there's no size requirement or anything like that. http://www.maawg.org/ has the me

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread J.D. Falk
Seth Mattinen wrote: I was always under the impression that smaller orgs were not allowed to join the MAAWG club. I've heard that, too, but have no idea where it comes from. It's not true; there's no size requirement or anything like that. http://www.maawg.org/ has the membership applicati

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Alex Balashov
Joe Greco wrote: I'm sorry, I agree that there's a problem, but this just sounds like it isn't feasible. Some people suffer from the culturally ingrained inability to understand that certain kinds of problems just can't. Be. Solved. And/or they aren't worth solving under present circumsta

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Ronald Cotoni
Joe Greco wrote: there is a fundamental disconnect here. the IP space is neutral. it has no bias toward or against social behaviours. its a tool. the actual/real target here are the people who are using these tools to be antisocial. blacklisting IP space is always reactive and should only beu

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Justin Shore
Wayne E. Bouchard wrote: Best practices for the public or subscription RBLs should be to place a TTL on the entry of no more than, say, 90 days or thereabouts. Best practices for manual entry should be to either keep a list of what and when or periodically to simply blow the whole list away and s

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Joe Greco
> John Curran wrote: > > On Sep 8, 2009, at 2:18 PM, JC Dill wrote: > > > > > It seems simple and obvious that ARIN, RIPE, et. al. should > > > determine the blacklist state of a reclaimed IP group and ensure > > > that the IP group is usable before re-allocating it. > > > > > > When IPs are recla

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Justin Shore
Jason Bertoch wrote: Suresh Ramasubramanian wrote: That said most of the larger players already attend MAAWG - that leaves rural ISPs, small universities, corporate mailservers etc etc that dont have full time postmasters, and where you're more likely to run into this issue. I've found the op

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread bmanning
On Tue, Sep 08, 2009 at 02:34:10PM -0500, Joe Greco wrote: > > there is a fundamental disconnect here. the IP space is neutral. > > it has no bias toward or against social behaviours. its a tool. > > the actual/real target here are the people who are using these tools > > to be antisocial. black

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Joe Greco
> there is a fundamental disconnect here. the IP space is neutral. > it has no bias toward or against social behaviours. its a tool. > the actual/real target here are the people who are using these tools > to be antisocial. blacklisting IP space is always reactive and > should only beused in em

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread JC Dill
John Curran wrote: On Sep 8, 2009, at 2:18 PM, JC Dill wrote: > It seems simple and obvious that ARIN, RIPE, et. al. should > determine the blacklist state of a reclaimed IP group and ensure > that the IP group is usable before re-allocating it. > > When IPs are reclaimed, first check to see if

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread bmanning
there is a fundamental disconnect here. the IP space is neutral. it has no bias toward or against social behaviours. its a tool. the actual/real target here are the people who are using these tools to be antisocial. blacklisting IP space is always reactive and should only beused in emergency a

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Joe Greco
> On Tue, 8 Sep 2009, Joe Greco wrote: > > It seems like it *could* be useful to have a system to notify of network > > delegation changes, but it also seems like if this was particularly > > important to anyone, then someone would have found a trivial way to > > implement at least a poor man's ver

  1   2   >