- NANOG - lists.nanog.org

Re: Policies affecting the Internet as a whole - Hitting wh
by Dave Paulsen 29 Dec '96

29 Dec '96

>From: Bradley Dunn <bradley(a)dunn.org> >Recently one of their customers decided the incoming directory on our FTP >server would be a good place to start a warez site. We mailed help(a)uu.net >and noc(a)uu.net. Our mail included the src IP address and the times that >the uploading of the warez occurred. They were fairly quick to respond >with UUNet's policy on these matters. Basically they will only take >action when told to do so by a law-enforcement agency. Well, common practice is to have your incoming directory writable but not readable, but, barring that lapse, once you discovered what was going on it was _your_ responsibility to inform the proper authorities with the information you had. Quite a few ISPs have an AUP that states a members account will be yanked upon reasonable proof of illegal or net.unfriendly activities. It is, however, a sticky situation trying to make ISPs net.cops. After weighing the pros and cons, I have to give more weight to the "common carrier" argument. It is _your_ responsibility to protect yourself. Most of us here are more than willing to help you do that, and your time is better spent getting your system setup properly than trying to get another ISP to police their users. If people didn't make it so damn easy to abuse their systems, there'd be a lot less abuse. >I think if you are getting attacked from a specific IP or block of IPs, >you have every right to filter those packets. I question the prudence of >a 'blacklist', though. I think you have a right to filter any packets you want, for any ol' reason whatsoever, into _your_ LAN. Just don't presume that any downstream systems may also want to use whatever filtering "algorithm" you come up with. Along the same lines, a blacklist from people or groups I trust (Bush, Vixie, NANOG in general) saves me time. >From: Wayne Bouchard <web(a)typo.org> >where it might be housed so... It would be nice if some group (Hey, >wait a minute.. we're something of a group..) could come up with an >"Acceptable Use Policy" that people could subscribe to or use as a >base for building their own policy. Keeping a list of people who have This is starting to sound familiar...oh yeah, about ten years ago...FidoNet Policy formulation...I'm in favor of anything that's no longer than and embodies the same spirit as the following: 1.) Thou shalt not be excessively annoying. 2.) Thou shalt not be too easily annoyed. I s'pose we can drop "Thou shalt honor ZoneMailHour" :-) >From: Paul A Vixie <paul(a)vix.com> >we do when our network is congested is: delay it. What we do when we see >a large amount of junk in a mail queue that appears to be the result of >some automated process gone wild is (listen carefully) expunge it with no >notice to anybody. :-) >>On Fri, 27 Dec 1996, jenni baier wrote: >> So how about a creating a "white"list? and a reply >From: "Robert A. Pickering Jr." <pickerin(a)fuse.net> >This is a much better approach. Reward those who operate responsibly and >in a sense of cooperation. I'd certainly be willing to help on a draft >of such a charter. Yeah, it sounds nice, positive, all feely-good and all that, but think for a nanosecond or so. What you'll end up with is a list of about 95-98% of all ISPs, and while the folks at _Boardwatch_ and other compilers of 'net lists will greatly appreciate your efforts, it's not gonna do those searching for a reputable ISP a whole lotta good. >From: Barry Shein <bzs(a)world.std.com> [in regard to dealing with spammers, crackers, and other net.miscreants] >Too often when an issue like this is discussed we are all mesmerized >by an image of getting a real bad guy. No, if he's just a plain old jerk, that's ok too :-) ...but... >I'd say around half of the complaints I see range from "there's >nothing wrong with that behavior, what's your point?", to "there's To true, to true. >One gets the feeling that at our current level >of sophistication in internet governance no matter what the infraction >we'd either ignore it or crush the person's car, mostly depending on >which action was more convenient at the moment. and your point is?... >From: randy(a)psg.com (Randy Bush) >Indeed. We don't neen no steenkin' legal system, we can just hang 'em >right here. Works for me. >Maybe this whole thread could be moved to inet-excess or somewhere? Actually, I'd like to take it somewhere, and to anyone who's traversed this far into this spew--is there a half-way intelligent discourse going on somewhere that goes into the more social/political aspects of network operation? I realize any such forum is gonna be about 50% flame fest, but as long as there are a few competent tech people to balance out the wild- eyed idealists, liberals, and the other generally clueless, it shouldn't be too bad. _dave_(seemingly obligatory and definitely bandwidth wasting .sig)

1 0

Re: Policies affecting the Internet as a whole
by John Curran 28 Dec '96

28 Dec '96

Hello all, My only request is that folks keeping lists of "cooperative" and "uncooperative" ISP's keep in mind that it is not a world of all black and white. In particular, there are many steps that a provider can take to cooperate with an ongoing security or spamming incident which are clearly valuable and legal (e.g. confirming contact information, escalating visibility of the situation at the customer/origin site, providing guidance on how to filter/remedy the situation locally at the destination, or opting to terminate service [all of the above actions are, of course, subject to the agreement between the ISP and site]). There are a set of actions which have been requested in the past which violate contract, consumer protection, or federal law in various contexts (e.g. termination w/o notice in the absence of a threat to life/property/service, certain privacy violations regarding email or wiretapping, etc.) Frankly, an ISP which engages in such activities without diligence is a hazard to us all. It will be interesting to see when the first ISP goes out of business for terminating someone's service without adaquate process (as the first customer terminated without notice as a result of forged email is going to win big in the court). If folks can tolerate the delay associated with ISP/customer resolution of complaints, then we may have an adaquate system. For those who want policing of the net and instant justice, I'd recommend investment in Internet-literate law enforcement and judicial staff, for this is the only place where "orders" should ever come. /John

1 0

Re: Policies affecting the Internet as a whole - Hitting where it hurts
by Vadim Antonov 28 Dec '96

28 Dec '96

Jenni Baier <lioness(a)universe.digex.net> wrote: > How about creating some organization for which the pre-requisite of > membership would be adherence to a charter which outlined some standards > and policies for dealing with other ISPs when giving complaints and > standards for dealing with complaints received? The membership list could > be published and serve as a list of providers worth using, rather than > publishing a "bad" list (which, it has already been shown, is > problematic). Several years ago i proposed that CIX membership should require adherence to some rules in regard to "good conduct". I don't know if the proposal was formally considered, though few top CIX people have seen it. In my opinion that this would make membership in CIX something which could figure pominently in ads, and definitely worth membership fees. --vadim

1 0

Re: Policies affecting the Internet as a whole - Hitting where it hurts
by alan＠mindvision.com 27 Dec '96

27 Dec '96

Hi. I wrote: ] > Did you contact a law enforcement agency? Did we comply with ] > their wishes? ] > It seems that you are asking for vigilantism, not cooperation. Kim wrote: ] What sort of law enforcement agency would contact uunet ? ] How about my local township police department ? Whatever law enforement agency has jurisdiction. If the attacked server is within their jurisdiction, that would be a good place to start. Potentially you will have to escalate this to the FBI, as they seem to be pretty savvy to computer crimes, on a relative scale. Law enforcement agencies _do_ contact providers, and do catch folk. Read any popular book about shimomura and mitnick to see an instance. (legal tramplings not withstanding) I make no bones about this being a difficult problem, and I don't mean to infer that Mr Hawn was attacking UUNET or advocating that an ISP "retaliate". I apologize that this came across this way. However, the more general theme seems to infer that providers of service should maintain some level of responsibility for what their users do. This scares me, in the "real world". -alan

2 1

RE: Policies affecting the Internet as a whole - Hitting where it hurts
by Chris A. Icide 27 Dec '96

27 Dec '96

There is a Gent in DC by the name of Thom Swink. He is with the Computer Crime Squad of the FBI, and is a member of the Internet group. He seems very knowledgeable as is many of his peers. Their phone number there is 212-384-1000 and his extension is X4505. This would definitely be a good place to start. We've been here quite a few times with more acceptable results than non. Chris ---------- From: Alan Hannan[SMTP:alan@mindvision.com] Sent: Friday, December 27, 1996 10:12 AM To: nanog(a)merit.edu Subject: Re: Policies affecting the Internet as a whole - Hitting where it hurts Hi. I wrote: ] > Did you contact a law enforcement agency? Did we comply with ] > their wishes? ] > It seems that you are asking for vigilantism, not cooperation. Kim wrote: ] What sort of law enforcement agency would contact uunet ? ] How about my local township police department ? Whatever law enforement agency has jurisdiction. If the attacked server is within their jurisdiction, that would be a good place to start. Potentially you will have to escalate this to the FBI, as they seem to be pretty savvy to computer crimes, on a relative scale. Law enforcement agencies _do_ contact providers, and do catch folk. Read any popular book about shimomura and mitnick to see an instance. (legal tramplings not withstanding) I make no bones about this being a difficult problem, and I don't mean to infer that Mr Hawn was attacking UUNET or advocating that an ISP "retaliate". I apologize that this came across this way. However, the more general theme seems to infer that providers of service should maintain some level of responsibility for what their users do. This scares me, in the "real world". -alan

1 0

Re: Policies affecting the Internet as a whole - Hitting where it hurts
by hcb＠clark.net 27 Dec '96

27 Dec '96

At 11:29 AM 12/27/96, David Schwartz wrote: >On Fri, 27 Dec 1996, Neil J. McRae wrote: > >> The last thing the Internet needs is some dodgy cartell deciding on >> who is allowed access and who isn't. Although I've had similair experience >> mostly from academic sites. > > I think a list of sites that refuse to deal with troublemakers >(with details) would be extremely useful. If people want to use it to >blackhole traffic, that would be their decision. > > Even more importantly, you could check it before choosing an ISP >or provider to be sure that your provider is running a clean ship. That >way you don't get inconvenienced by other provider's defensive acts >against your provider. > > As an added bonus, you have some more assurance that your provider >will come to your aid if you are mail bombed, ping flooded, or hacked in >some other way. Providers that deal effectively with their own customers >when they create trouble are much more likely to assist their own >customers when they are attacked. > > David Schwartz > WIZnet Perhaps the model we might examine is not so much a cartel that decides who gets access, but that of a credit reporting service. Each merchant that uses such a reporting service makes an independent decision whether or not to grant credit. If such a service were established, I certainly would want to avoid the secretiveness, and resistance to correction, that long affected -- and still affects some -- credit bureaus. Howard Berkowitz

1 0

Re: [Announce] traceroute sites
by Paul Ferguson 26 Dec '96

26 Dec '96

Very nicely done. - paul At 12:18 PM 12/11/96 -0500, gv wrote: >A traceroute utility has been added to the Cable and Wireless Internet >Exchange (CWIX) network. There are links to nodes worldwide; on and off >the CWIX network. >You are welcome to take advantage of this as the need arises. > >traceroute url: >http://www.cwix.net/cgi-bin/trace > > >-- >Gary vonErden >gv(a)cwix.net >http://www.cwix.net/ > -- Paul Ferguson || || Consulting Engineering || || Herndon, Virginia USA |||| |||| tel: +1.703.397.5938 ..:||||||:..:||||||:.. e-mail: pferguso(a)cisco.com c i s c o S y s t e m s

3 2

ANNOUNCEMENT: NANOG Registration
by William B. Norton 24 Dec '96

24 Dec '96

Hi all - The NANOG 9 (Feb 97) Registration form is on-line today (www.nanog.org) More information about the hotel, local logistics, and initial agenda will be put up on the web in January. Merry Christmas! Bill -------------------------------------------------------------- William B. Norton <wbn(a)merit.edu> (313) 764-9430

1 0

cisco-nsp mailing list
by dave o'leary 23 Dec '96

23 Dec '96

Dorian Kim and his associates at CICnet have been gracious enough to create and host a list for discussion of cisco equipment, services, etc. as we relate to the service provider market. This list is intended to be much like the cisco(a)spot.colorado.edu list, except focused on service providers. This should help remove some of the cisco-specific chatter from the NANOG list (at least it provides a convenient place to redirect it which is potentially more appropriate). Here is the charter that we (actually Paul Ferguson) came up with: The cisco-nsp mailing list provides a forum for Internet Service Providers to discuss issues specific to cisco Systems product line implementations, both hardware and software related. While this list is not an official support vehicle of cisco Systems, Inc., both general and specific discussions are encouraged. Support issues should be directed at the usual support channels (cisco Technical Assistance Center, etc.) Subscriptions are via majordomo to cic.net, i.e. send mail to <Majordomo(a)cic.net> with the following command in the body of your email message: subscribe cisco-nsp <your email address> Alternatively, you can send to <cisco-nsp-request(a)cic.net>: with the command "subscribe" in the body of the message. thanks, dave

2 1

APRICOT '97
by David R. Conrad 23 Dec '96

23 Dec '96

Hi, Apologies if inappropriate and if you've seen this before (but quite a few NANOG people indicated they wanted to attend, so...) -- The Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT, http://www.apricot.net) is a conference and series of tutorials targetted primarily at people who run (or want to run) large networks, particularly Internet Service Providers. This year, there are 13 tutorials ranging from DNS to Perl Programming and a 3 track conference consisting of 2 two day tracks on network operations and services & applications, and 2 one day tracks, one on legal and policy issues in cooperation with the Asia Pacific Policy and Legal (APPLe) Forum and the other, the Business of the Internet, in cooperation with the Asia Pacific Internet Association (APIA). For more information on the conference program and the tutorials, see http://www.apricot.net/program.html. To register for the conference, see the APRICOT registration page at http://www.apricot.net/registration.html (note that the web page uses SSL for secure transfers so you can safely send your credit card numbers over the Internet). If you do not have access to the web, please contact me and I'll send or fax an email form. Dates: APRICOT Tutorials: Jan 27 - 28 APRICOT Conference: Jan 29 - 30 APNIC Meeting: Jan 31 Fees: Conference Registration: US $275 Tutorials: US $275/tutorial If you have any questions, feel free to contact me or the organizing committee (apricot-oc(a)apricot.net) Note that space is quite limited... Regards, -drc

1 0