[anti-abuse-wg] update on netsecdb project

Frank Wrote:

I added some more statistics to our own blacklist.
Then I will run the ASes of everyboy on this list Im aware
off through this statistics next month and gonna post
the results to this list, lets see ...

Maybe everybody on this list running a blacklist or statistics
about spam he receives should do this too.

What this would result in? Haven't you seen many bogus prefixes generating
from ASes everybody knows about (ref: weekly routing analysis)? Havent's you
seen hell de-aggregation from big providers for so long? Havent you seen
some frequently blacklisted IPs belonging to the same ASes for quite
sometime? I'm not saying that what your are doing is bad but seriously
providers who are generating spams either totally aware of it or are too
naive to do anything about it.

IMHO, first we have to agree/build consensus that there is a problem and
there are the problem makers among us.


Regards,

Aftab A. Siddiqui


On Wed, Apr 7, 2010 at 12:25 PM, Frank Gadegast <phade at www.powerweb.de>wrote:

> >
> > HI, Frank!
>
> Hi,
>
> > Feel your frustration. But do a quick google search on FUSSP.
>
> April fools day if over ...
>
> > Anyway, your solution would impose costs on others (i.e. RIPE, other
> ISPs),
>
> Sure, but they can easily be shared with the same method that RIPE
> uses for the member fees, big ISPs pay more, small ones less.
> In fact it will be simple some costs at RIPE.
> And who cares what a spamming provider will have to invest to get
> his customers cleaned ?
>
>
> Im somehow getting the idea, that those people on this list that
> are always AGAINST any idea ARE these providers, that are too lazy
> to control their spambotted customers.
> Could that be the final reason why we do not find a solution ?
>
> I added some more statistics to our own blacklist.
> Then I will run the ASes of everyboy on this list Im aware
> off through this statistics next month and gonna post
> the results to this list, lets see ...
>
> Maybe everybody on this list running a blacklist or statistics
> about spam he receives should do this too.
>
> > and would be easily abused to destroy an ISP you don't like.
>
> How that ?
> By sending fake reports to RIPE clearing address ?
>
> I recommended that the ISP has to categorize the report
> himself like you can do on spamcop too, he can simply
> select "no spam from us" and thats it.
>
> And RIPE can control the behaviour of the ISP easily
> with some simple statistics ...
> The system should work fuzzy-like, only the really
> bad ones get punished and the ones with little problems
> get away.
>
> And RIPE can easily reject reports coming from the same
> IPs all the time ... or the ISP under a fake attack can
> talk to RIPE about it, that problem isnt really hard
> to solve.
>
>
> Kind regards, Frank
> --
> PHADE Software - PowerWeb                       http://www.powerweb.de
> Inh. Dipl.-Inform. Frank Gadegast             mailto:frank at powerweb.de
> Schinkelstrasse 17                                fon: +49 33200 52920
> 14558 Nuthetal OT Rehbruecke, Germany             fax: +49 33200 52921
> ======================================================================
> Public PGP Key available for frank at powerweb.de
>
> >
> >
> > --
> > Esa Laitinen
> > Tel. +41 76 200 2870
> > skype/yahoo: reunaesa
> >
> > --000e0cd1145cbf98e60483a02e56
> > Content-Type: text/html; charset=ISO-8859-1
> >
> > HI, Frank!<br><br>Feel your frustration. But do a quick google search on
> FUSSP.<br><br>Anyway, your solution would impose costs on others (i.e. RIPE,
> other ISPs), and would be easily abused to destroy an ISP you don't
> like.<br>
> > <br clear="all"><br>-- <br>Esa Laitinen<br>Tel. +41 76 200
> 2870<br>skype/yahoo: reunaesa<br>
> >
> > --000e0cd1145cbf98e60483a02e56--
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20100407/ad11008f/attachment.html>