[anti-abuse-wg] [Misc] Research project on blacklists

Apologies for my slow response - I have been traveling and also consulting
with my team members on how best to respond (as you might have gleaned from
my profile linked upthread, my own background is not in networking or
security :)). I hope to share more thorough responses with you once the sun
rises in their timezones.

>surprisingly, I haven't seen the request on any other lists that are (a)
relevant and (b) open -- perhaps they and their project team are not
especially well connected in this space :(

This is true. We were advised to share to RIPE and regional NOG mailing
lists. Are there others you would have recommended?

> as John Levine already noted, the questionnaire seems somewhat confused
as to whether it cares about routing issues (bogon lists, the Spamhaus
DROP list etc) or spam filtering (bad domains, phishing feeds, botnet
IPs etc etc)

Hm, I think we are interested in quite the range of blacklists. Here is a
table of what my colleagues are monitoring:

[image: image.png]

>it also asked if internally generated lists were used, but seemed
curiously uninterested in anything other than if the answer to that was
yes or no -- a missed opportunity I thought.

What would you have recommended probing here?

I do genuinely appreciate your discussion and patience. It is very
interesting and useful for me to see what topics matter to you most and
where we might have misdirected our attention. Just as background, we did
pilot the survey with a smaller set of network operators and felt it had
been straightforward to respond to, given their reactions. But as many of
you have noted, the survey is rather general. I have been conducting
interviews with those working in abuse prevention (even at some of the
companies that have been mentioned upthread) to collect more specific
anecdotes about how dynamic addressing has lowered the accuracy of certain
feeds, for example, or how errors in geo-IP feeds affected them. The
interviews allow for a bit more elucidation, but it has been difficult to
recruit participants. Hence the survey.

All the best,
Anushah



On Thu, Jul 18, 2019 at 2:36 PM Richard Clayton <richard at highwayman.com>
wrote:

> In message , ac <ac at main.me> writes
>
> >Mostly, what makes me very angry is the audacity
>
> this does seem a reasonable list to ask for assistance on ... but being
> around to answer questions promptly would be appropriately polite
>
> surprisingly, I haven't seen the request on any other lists that are (a)
> relevant and (b) open -- perhaps they and their project team are not
> especially well connected in this space :(  though there is a recent
> "anonymous" survey request about router configurations on the NANOG list
>
> >and then the
> >"anonymous"
>
> the Qualtrics platform is available over Tor (unlike some online survey
> platforms) so if you declined to answer the questions about which AS and
> company you were associated with then there is a substantial amount of
> anonymity available to you should you wish to use it...
>
> >and I can already see the "findings" of this research...
> >based on random anonymous, hidden and secret inputs....
>
> that is a concern -- this type of questionnaire pretty much never leads
> to high quality research directly (since there are significant biases in
> who might choose to give replies and there is scope for multiple
> responses from a single person, bots filling it in etc)
>
> nevertheless as a starting point for qualitative research (rather than
> quantitative) it can be very useful in allowing a researcher to identify
> general trends in the answers and -- importantly -- to help the
> researcher frame good research questions that are capable of being
> investigated in more detail
>
> as John Levine already noted, the questionnaire seems somewhat confused
> as to whether it cares about routing issues (bogon lists, the Spamhaus
> DROP list etc) or spam filtering (bad domains, phishing feeds, botnet
> IPs etc etc)
>
> it also asked if internally generated lists were used, but seemed
> curiously uninterested in anything other than if the answer to that was
> yes or no -- a missed opportunity I thought.
>
> --
> richard                                                   Richard Clayton
>
> Those who would give up essential Liberty, to purchase a little temporary
> Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755
>


-- 
Anushah Hossain, PhD Student
Energy and Resources Group, UC Berkeley
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20190718/b05ce759/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 86788 bytes
Desc: not available
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20190718/b05ce759/attachment.png>