Re: PlayStationNetwork blocking of CGNAT public addresses
So you ignore/don't deal with the abuse coz it's shipped in a format you refuse to handle? And you don't even bother telling the reporter you would like it in a per ip format? Or make attempts to make it work the way they report it (split out the ip's and modify the to be forwarded mail to only contain the ip's belonging to that customer)???? Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Baldur Norddahl <baldur.norddahl@gmail.com> Datum: 21-09-16 10:37 (GMT+01:00) Aan: nanog@nanog.org Onderwerp: Re: PlayStationNetwork blocking of CGNAT public addresses Hi We have the opposite problem with PSN: Sometimes they will send abuse reports with several of our IP addresses listed. The problem with that is that we can not give data about one customer to another customer. By listing multiple IP addresses we are prevented from forwarding the email to the customer. Which means we may ignore it instead. Regards, Baldur
On 22 September 2016 at 10:42, Alexander Maassen <outsider@scarynet.org> wrote:
So you ignore/don't deal with the abuse coz it's shipped in a format you refuse to handle?
And you don't even bother telling the reporter you would like it in a per ip format? Or make attempts to make it work the way they report it (split out the ip's and modify the to be forwarded mail to only contain the ip's belonging to that customer)????
You will have to remember that these are automated mails from the reporter. If I write them back it goes into their bit bucket, because they do not really care enough to bother replying. I am betting they are sending out thousands mails each day and they can not handle manually replying to all of that. In the same way we receive a large amount of automated mail so we have to be able to handle it automatically. Send me something sane and I will make a script that forwards it. Send me something unusable and I wont - but I will not do manual handling of your automated mail. All I am trying to do here is tell people that send abuse mails not to combine multiple abuse complaints in one mail, because that makes it harder for everybody and makes it more likely that your mail will be dropped as too much work. Double so if your abuse mails is from an automated system, because I will try to match your automated system with my own. However it is much harder to make a system that can edit your complaint and duplicate it to several recipients, than it is to run a simple filter that just forwards the mail as is. As to PSN they will usually send multiple mails if the abuse is ongoing. At some point they will send a mail with just one IP and that one gets forwarded. So we are dropping some of the mails, but the users eventually get notified anyway. It is not ideal but it works. Regards, Baldur
On 9/22/2016 8:10 AM, Baldur Norddahl wrote:
On 22 September 2016 at 10:42, Alexander Maassen <outsider@scarynet.org> wrote:
So you ignore/don't deal with the abuse coz it's shipped in a format you refuse to handle?
And you don't even bother telling the reporter you would like it in a per ip format? Or make attempts to make it work the way they report it (split out the ip's and modify the to be forwarded mail to only contain the ip's belonging to that customer)????
You will have to remember that these are automated mails from the reporter. If I write them back it goes into their bit bucket, because they do not really care enough to bother replying. I am betting they are sending out thousands mails each day and they can not handle manually replying to all of that. In the same way we receive a large amount of automated mail so we have to be able to handle it automatically. Send me something sane and I will make a script that forwards it. Send me something unusable and I wont - but I will not do manual handling of your automated mail.
All I am trying to do here is tell people that send abuse mails not to combine multiple abuse complaints in one mail, because that makes it harder for everybody and makes it more likely that your mail will be dropped as too much work. Double so if your abuse mails is from an automated system, because I will try to match your automated system with my own. However it is much harder to make a system that can edit your complaint and duplicate it to several recipients, than it is to run a simple filter that just forwards the mail as is.
As to PSN they will usually send multiple mails if the abuse is ongoing. At some point they will send a mail with just one IP and that one gets forwarded. So we are dropping some of the mails, but the users eventually get notified anyway. It is not ideal but it works.
Regards,
Baldur
P.S. If you would prefer an individual email for each IP address on
We've also started ignoring their abuse emails, for the same reason. Their abuse emails at one point contained the line: this list, please let us know. But, they didn't respond after we contacted them requesting it (and that line has since been removed).
Considering that there are likely to be many such emails - just how much time is it going to take your abuse desk staffer to just parse out those IPs from whatever log that they send you? And how much time would processing say 50 individual emails take compared to 50 IPs in a single email? --srs
On 22-Sep-2016, at 6:58 PM, Brian Rak <brak@gameservers.com> wrote:
We've also started ignoring their abuse emails, for the same reason. Their abuse emails at one point contained the line:
P.S. If you would prefer an individual email for each IP address on this list, please let us know.
But, they didn't respond after we contacted them requesting it (and that line has since been removed).
Single IP per email: automated, zero time at all. Multiple IPs per email: manual process, minutes per IP. On 9/22/2016 9:34 AM, Suresh Ramasubramanian wrote:
Considering that there are likely to be many such emails - just how much time is it going to take your abuse desk staffer to just parse out those IPs from whatever log that they send you?
And how much time would processing say 50 individual emails take compared to 50 IPs in a single email?
--srs
On 22-Sep-2016, at 6:58 PM, Brian Rak <brak@gameservers.com <mailto:brak@gameservers.com>> wrote:
We've also started ignoring their abuse emails, for the same reason. Their abuse emails at one point contained the line:
P.S. If you would prefer an individual email for each IP address on this list, please let us know.
But, they didn't respond after we contacted them requesting it (and that line has since been removed).
The format of the abuse complaint doesn't mean anything if it still doesn't contain any relevant data to say what the abuse IS. (Or, even if it IS abuse at all.) On Thu, Sep 22, 2016 at 9:37 AM, Brian Rak <brak@gameservers.com> wrote:
Single IP per email: automated, zero time at all.
Multiple IPs per email: manual process, minutes per IP.
On 9/22/2016 9:34 AM, Suresh Ramasubramanian wrote:
Considering that there are likely to be many such emails - just how much time is it going to take your abuse desk staffer to just parse out those IPs from whatever log that they send you?
And how much time would processing say 50 individual emails take compared to 50 IPs in a single email?
--srs
On 22-Sep-2016, at 6:58 PM, Brian Rak <brak@gameservers.com <mailto: brak@gameservers.com>> wrote:
We've also started ignoring their abuse emails, for the same reason.
Their abuse emails at one point contained the line:
P.S. If you would prefer an individual email for each IP address on this list, please let us know.
But, they didn't respond after we contacted them requesting it (and that line has since been removed).
Well yes – if you have the automation, that is great. Of course the format of whatever log they send you matters too. I’ve had abuse complaints in a past life where the abuse report was a screenshot from a checkpoint firewall with “Dear team, for your attention” in bright red in a large font. Personally I don’t trash abuse reports that are valid. --srs From: Tom Beecher <beecher@beecher.cc> Date: Thursday, 22 September 2016 at 7:35 PM To: Brian Rak <brak@gameservers.com> Cc: Suresh Ramasubramanian <ops.lists@gmail.com>, "nanog@nanog.org" <nanog@nanog.org> Subject: Re: PlayStationNetwork blocking of CGNAT public addresses The format of the abuse complaint doesn't mean anything if it still doesn't contain any relevant data to say what the abuse IS. (Or, even if it IS abuse at all.) On Thu, Sep 22, 2016 at 9:37 AM, Brian Rak <brak@gameservers.com> wrote: Single IP per email: automated, zero time at all. Multiple IPs per email: manual process, minutes per IP. On 9/22/2016 9:34 AM, Suresh Ramasubramanian wrote: Considering that there are likely to be many such emails - just how much time is it going to take your abuse desk staffer to just parse out those IPs from whatever log that they send you? And how much time would processing say 50 individual emails take compared to 50 IPs in a single email? --srs On 22-Sep-2016, at 6:58 PM, Brian Rak <brak@gameservers.com <mailto:brak@gameservers.com>> wrote: We've also started ignoring their abuse emails, for the same reason. Their abuse emails at one point contained the line:
P.S. If you would prefer an individual email for each IP address on this list, please let us know.
But, they didn't respond after we contacted them requesting it (and that line has since been removed).
participants (5)
-
Alexander Maassen -
Baldur Norddahl -
Brian Rak -
Suresh Ramasubramanian -
Tom Beecher