Rather than hand IP space out to bad actors like candy with minimal to no verification and then have no alternative but to null route it locally, use DROP or whatever, it’d be so much better if the allocation was not made at all by the “not the internet police”.
Right now a common argument is “IPv4 is done with, IPv6 has so much space, even if bad actors corner large chunks of it, there’s still unlimited space left”. We will probably, with 20/20 hindsight, realize that this argument will go the way of that apocryphal Bill Gates quote about 640k should be enough for anybody. —srs From: Jeroen Massar <[email protected]> Date: Monday, 3 August 2026 at 6:33 PM To: Suresh Ramasubramanian <[email protected]> Cc: Serge Droz <[email protected]>; denis walker <[email protected]>; [email protected] <[email protected]>; Gert Doering <[email protected]> Subject: Re: [Security-wg] Abuse mailboxes are increasingly no longer monitored and are being replaced by (bad) forms > On 3 Aug 2026, at 13:54, Suresh Ramasubramanian <[email protected]> wrote: > > If a space is in an email oriented blocklist like say Spamhaus, it just gets > used for some other kind of abuse .. DDoS C2, account farming, host illegal > content and so on. Or if spam, then spam through some messaging or social > media platform rather than through email. Yep, that is why Spamhaus DROP exists: https://www.spamhaus.org/blocklists/do-not-route-or-peer/ (btw, as per the text there, do migrate to the JSON editions!) Which is a very rough hammer. As updates to entries are infrequent, one really has to be a bad seed to be listed there. I can recommend fetching the JSONs, making a delta with the previous version one has, and then adding a approve/deny option to your NOC interface of choice so that a live person reviews "who is that entity, why are they considered so bad" and then approves new listings. Though running blind by trusting Spamhaus is fine too of course ;) Maybe one thing in this field is to have, like adblockers, more such lists that are trusted, be that from the various NOGs or other groups. Spamhaus are great at what they do, but alternatives (that do have the legal protections needed for these kind of lists) would be a good thing. And in such a situation, merge those lists, rate&rank yourself how evil one considers those entities and... drop. Do note any other such good entities for consideration if one knows any solid ones. Regards, Jeroen
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/security-wg.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
