So why not just say so? -mel

On Jul 29, 2019, at 4:12 PM, John Von Essen <john@essenz.com> wrote:

Really??? You cant parse “User unknown”...

Dan is simply pointed out how ridiculous it is that amazon lists a non-existent email address with Arin for abuse.

So yeah... really amazon?

Sent from my iPhone

...

On Jul 29, 2019, at 7:07 PM, Mel Beckman <mel@beckman.org> wrote:

Dan,

I don’t really have the time to parse the debug output you sent. If you want me, or most others, to pay attention to your post, please provide a more detailed explanation of what the deal is than “Really, amazon?”

-mel

...

On Jul 29, 2019, at 4:03 PM, Dan Hollis <goemon@sasami.anime.net> wrote:

Amazon, you really should know better.

Source ip: 54.240.4.4

https://search.arin.net/rdap/?query=54.240.4.4

Source Registry ARIN Kind Group Full Name Amazon SES Abuse Handle ASA152-ARIN Email email-abuse@amazon.com

...

...

...

RCPT To:<email-abuse@amazon.com> <<< 550 #5.1.0 Address rejected. 550 5.1.1 <email-abuse@amazon.com>... User unknown DATA <<< 503 #5.5.1 RCPT first

Jul 29 09:47:27 yuri sendmail[14067]: x6TGlQe4014062: to=<email-abuse@amazon.com>, ctladdr=<goemon@sasami.anime.net> (500/500), delay=00:00:01, xdelay=00:00:01, mailer=esmtp92, relay=amazon-smtp.amazon.com. [207.171.188.4], dsn=5.1.1, stat=User unknown

"User unknown" is pretty clear. But whatever. -Dan On Mon, 29 Jul 2019, Mel Beckman wrote:

Dan,

I don’t really have the time to parse the debug output you sent. If you want me, or most others, to pay attention to your post, please provide a more detailed explanation of what the deal is than “Really, amazon?”

-mel

...

On Jul 29, 2019, at 4:03 PM, Dan Hollis <goemon@sasami.anime.net> wrote:

Amazon, you really should know better.

Source ip: 54.240.4.4

https://search.arin.net/rdap/?query=54.240.4.4

Source Registry ARIN Kind Group Full Name Amazon SES Abuse Handle ASA152-ARIN Email email-abuse@amazon.com

...

...

...

RCPT To:<email-abuse@amazon.com> <<< 550 #5.1.0 Address rejected. 550 5.1.1 <email-abuse@amazon.com>... User unknown DATA <<< 503 #5.5.1 RCPT first

Jul 29 09:47:27 yuri sendmail[14067]: x6TGlQe4014062: to=<email-abuse@amazon.com>, ctladdr=<goemon@sasami.anime.net> (500/500), delay=00:00:01, xdelay=00:00:01, mailer=esmtp92, relay=amazon-smtp.amazon.com. [207.171.188.4], dsn=5.1.1, stat=User unknown

On Tue, Jul 30, 2019 at 11:45 AM Scott Christopher <sc@ottie.org> wrote:

Dan Hollis wrote:

...

...

...

...

RCPT To:<email-abuse@amazon.com> <<< 550 #5.1.0 Address rejected. 550 5.1.1 <email-abuse@amazon.com>... User unknown DATA <<< 503 #5.5.1 RCPT first

Try jeff@amazon.com

-- S.C.

Then update your ARIN records to reflect that. Fully agree with Dan on this one. -- Regards, Chris Knipe

Christoffer Hansen wrote:

On 30/07/2019 11:59, Chris Knipe wrote:

...

Then update your ARIN records to reflect that. Fully agree with Dan on this one.

Imagine ARIN did a take from RIPE NCC [Policy Proposal Idea?] and a policy came into effect of validating ALL 'OrgAbuseEmail' objects listed in the ARIN database. And revoked the resources from those that failed to respond after multiple attempts.

Then imagine the media attention, public outcry, corporate lawyers from Amazon, the pressure from Congress, and an ARIN that would no longer function as an independent body anymore. . . -- S.C.

On 30 Jul 2019, at 6:44 AM, Scott Christopher <sc@ottie.org<mailto:sc@ottie.org>> wrote: On 30/07/2019 11:59, Chris Knipe wrote: Then update your ARIN records to reflect that. Fully agree with Dan on this one. Imagine ARIN did a take from RIPE NCC [Policy Proposal Idea?] and a policy came into effect of validating ALL 'OrgAbuseEmail' objects listed in the ARIN database. And revoked the resources from those that failed to respond after multiple attempts. Then imagine the media attention, public outcry, corporate lawyers from Amazon, the pressure from Congress, and an ARIN that would no longer function as an independent body anymore. . . Scott - Alas, you have a fundamental misunderstanding about the nature of ARIN… we don’t do anything other than implement policies that this community wants. If the community developed a policy to require Abuse POC’s validation, and said policy made clear that failure to do so was to result in revocation, then ARIN would indeed implement the policy (and that includes revocation for those who ignored the policy.) This is actually exactly the way the US Government asked us to operate in 1997 - "Creation of ARIN will give the users of IP numbers (mostly Internet service providers, corporations and other large institutions) a voice in the policies by which they are managed and allocated within the North American region.” <https://www.nsf.gov/news/news_summ.jsp?cntn_id=102819>. Further, this support was reiterated by the USG recently in 2012 - "The American Registry for Internet Numbers (ARIN) is the RIR for Canada, many Caribbean and North Atlantic islands, and the United States. The USG participates in the development of and is supportive of the policies, processes, and procedures agreed upon by the Internet technical community through ARIN.” <https://www.ntia.doc.gov/blog/2012/united-states-government-s-internet-protocol-numbering-principles> We’ve see the lawyer route as well, and I have zero doubt in both the enforceability of the ARIN registration services agreements and ARIN’s ability to operate the registry according to the community policy. So, my advice is that this community not make policy that it doesn’t want to see implemented (and if you have interest or concern about ARIN policies, then I’d recommend get involved in their development – https://www.arin.net/get-involved/) i.e. the good news is that this community gets to decide how IP addresses are managed in the region (as opposed to some federal agency) – the consequence is that we really do manage the registry as directed by this community, so please try to avoid self-immolation if at all possible... Thanks! /John John Curran President and CEO American Registry for Internet Numbers

Scott, you might want to read "Policy Development Process (PDP)” https://www.arin.net/participate/policy/pdp/ in order to discover just exactly what John means by “If the community developed a policy”. You might also want to join the Public Policy Mailing List, arin-ppml@arin.net, to discuss. Scintillating discourse, I assure you. —Sandy

On Jul 31, 2019, at 10:17 AM, Scott Christopher <sc@ottie.org> wrote:

John Curran wrote:

...

Scott -

Alas, you have a fundamental misunderstanding about the nature of ARIN… we don’t do anything other than implement policies that this community wants. If the community developed a policy to require Abuse POC’s validation, and said policy made clear that failure to do so was to result in revocation, then ARIN would indeed implement the policy (and that includes revocation for those who ignored the policy.)

Hello John - you are absolutely right. Since the community has shown overwhelming disapproval of Amazon's invalid abuse POC, please go ahead and revoke Amazon's resources.

Maybe do this late Friday afternoon for the courtesy toward Amazon's support staff ?

And since this will certainly be historic, please post an announcement to nanog-list ?

Thanks, and Good luck !

S.C.

Actually if ARIN doesn’t pull the resources, after notification and a grace period to get them fixed, then what is the point in writing policy requiring that they be up to date and working? There needs to be checks and balances for systems to work. The only thing is what should the grace period be?

On 1 Aug 2019, at 7:31 am, Scott Christopher <sc@ottie.org> wrote:

Sandra Murphy wrote:

...

Scott, you might want to read "Policy Development Process (PDP)” https://www.arin.net/participate/policy/pdp/ in order to discover just exactly what John means by “If the community developed a policy”.

You might also want to join the Public Policy Mailing List, arin-ppml@arin.net, to discuss. Scintillating discourse, I assure you.

Yes - I am aware of how ARIN functions, its mandate, its governance, etc.

What I have been saying is that, if ARIN did something so brazen as to revoke Amazon's resources because of some bounced PoC emails, the impact would be *dramatic* and likely lead to the end of ARIN. Just think about this for a minute. :) Obviously this will not happen because ARIN is so righteously competent. :)

I wasn't criticizing ARIN (or anybody) I was just answering a hypothetical.

-- S.C.

-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org

On 31 Jul 2019, at 5:31 PM, Scott Christopher <sc@ottie.org<mailto:sc@ottie.org>> wrote: ... What I have been saying is that, if ARIN did something so brazen as to revoke Amazon's resources because of some bounced PoC emails, the impact would be *dramatic* and likely lead to the end of ARIN. Just think about this for a minute. :) Obviously this will not happen because ARIN is so righteously competent. :) Scott - ARIN revokes resources because of other administrative matters (e.g. not paying one’s ARIN fees), and while there is obviously quite a bit of process and notice to avoid this if all possible, we do indeed revoke and networks go down as a result. <https://www.arin.net/resources/fees/returns/#revocation (This isn’t much different that what happens when an organization fails to renew their organizational domain name and then disappears from the net – failure to follow contractual terms results in consequences sometimes rather dramatic, and it’s not the registry’s fault nor is there meaningful legal recourse for halfwitted self-inflicted harm…) If the community passes a new policy that makes clear that ARIN is to exercise contractual authority for violations of that policy, then we will establish a similar set of processes (with appropriate notice provisions) and then implement. As I have noted previously, I have zero doubt in the enforceability of the ARIN registration services agreements in this regard – so please carefully consider proposed policy both from the overall community benefit being sought, and from the implications faced as a number resource holder having to comply oneself with the new obligations. Thanks! /John John Curran President and CEO American Registry for Internet Numbers

On Sun, Aug 04, 2019 at 12:12:48AM -0700, Stephen Satchell wrote:

"The rules" have been around for years, and are codified in the RFCs that are widely published and available to all at zero cost. (That wasn't always true, as it wasn't until the DDN Protocol Handbook volumes were published in 1985 that the RFCs were available to everyone. I seem to recall there was an FTP site that provided the RFC documents before that, but my memory is hazy on that.)

IIRC, the CSnet CIC provided an RFC-by-mail service in the mid to late 1980's. It allowed anyone to request any RFC by number, e.g., sending it "rfc123" would result in a response containing that RFC. I also share your recollection of an earlier FTP site but a few minutes of checking old documents hasn't turned up its name and it's fallen out of long-term memory, at least for the moment.

During my career as a web server admin, mail admin, and network admin, I followed "the rules" strictly. As the main abuse contact during my time at a web hosting company, my postmaster@ and abuse@ contact addresses were according to Hoyle, and published with the company ASN, netblock, and domain registration records.

I've done the same -- imperfectly, to be sure, I've certainly tried. Half my grump with Amazon here is that they have, for all practical purposes, unlimited money and unlimited personnel. They should be the go-to example for How To Do It Right. They should be the model (or one of the models) that we're all trying to emulate, the gold standard that we can all point to. But they're not. The other half of my grump is that they're enormous, and therefore capable of inflicting enormous damage. The larger an operation, the more critical it is that abuse/security/et.al. be fully supported, highly responsive, empowered to act decisively, etc. But they're not. And I have yet to see anyone from Amazon (a) admit this and (b) ask for help fixing it. ---rsk

On Aug 12, 2019, at 3:52 PM, Henry Yen <henry@AegisInfoSys.com> wrote:

ftp://rfc-editor.org <ftp://rfc-editor.org/> ftp://rfc-editor.org <ftp://rfc-editor.org/> still mounts perfectly well using macOS Finder but shows to be now devoid of useful content via ftp.

James R. Cutler James.cutler@consultant.com GPG keys: hkps://hkps.pool.sks-keyservers.net

On Mon, 12 Aug 2019, Bruce H McIntosh wrote:

On 8/12/19 3:26 PM, Rich Kulawiec wrote:

...

Half my grump with Amazon here is that they have, for all practical purposes, unlimited money and unlimited personnel. They should be the go-to example for How To Do It Right. They should be the model (or one of the models) that we're all trying to emulate, the gold standard that we can all point to.

But they're not.

The other half of my grump is that they're enormous, and therefore capable of inflicting enormous damage. The larger an operation, the more critical it is that abuse/security/et.al. be fully supported, highly responsive, empowered to act decisively, etc.

But they're not.

And I have yet to see anyone from Amazon (a) admit this and (b) ask for help fixing it.

The larger they are, the more immune from having to follow the rules they think they are.

SBL seems the only way to wake them up. -Dan

John Curran wrote: ...

As I have noted previously, I have zero doubt in the enforceability of the ARIN registration services agreements in this regard – so please carefully consider proposed policy both from the overall community benefit being sought, and from the implications faced as a number resource holder having to comply oneself with the new obligations.

I completely agree that ARIN can revoke an organization's resources. Nobody has ever doubted that. What I have been saying is that if ARIN revoked Amazon's resources because of a trivial matter of bounced Abuse PoC, even if the small "community" of network operators and other interested parties passed a rule supporting this, the backlash would be *enormous* and lead to media attention, litigation, police, investigation by U.S. Congress, etc. The interests of the public affected by a global Amazon/AWS outage would greatly outweigh the rights of this small "community" which would ultimately be stripped away, I'd think. This is moot, of course, because ARIN would give ample notices and time to Amazon and they would dutifully comply. But the original poster to which I replied invited us to imagine such a situation. S.C.

On Sun, Aug 4, 2019 at 5:17 AM Scott Christopher <sc@ottie.org> wrote:

John Curran wrote:

...

As I have noted previously, I have zero doubt in the enforceability of the ARIN registration services agreements in this regard – so please carefully consider proposed policy both from the overall community benefit being sought, and from the implications faced as a number resource holder having to comply oneself with the new obligations.

I completely agree that ARIN can revoke an organization's resources. Nobody has ever doubted that.

What I have been saying is that if ARIN revoked Amazon's resources because of a trivial matter of bounced Abuse PoC, even if the small "community" of network operators and other interested parties passed a rule supporting this, the backlash would be *enormous* and lead to media attention, litigation, police, investigation by U.S. Congress, etc.

The interests of the public affected by a global Amazon/AWS outage would greatly outweigh the rights of this small "community" which would ultimately be stripped away, I'd think.

This is moot, of course, because ARIN would give ample notices and time to Amazon and they would dutifully comply. But the original poster to which I replied invited us to imagine such a situation.

I don't think that "companies with tons of lawyers" should be a factor in making resource allocation policies. But considering either small or big networks, an escalation path would reduce friction and increase overall compliance... for instance, failure to have functioning abuse PoC could lead first to being inegible to receive new resources. Rubens

On Mon, Aug 5, 2019 at 2:16 AM Scott Christopher <sc@ottie.org> wrote:

[...]

It's not about $BIGCORP having lots of corporate lawyers imposing its will on the small guys - it's about Amazon's role as a public utility, upon which many many many important things depend.

S.C.

I must have missed the news amidst all the interest rate changes and tariff tweets... ...apparently Amazon has become a public utility now? I look forward with bemusement to the PUC tariff filings for AWS pricing. ^_^;; Matt

On Fri, Aug 9, 2019 at 4:31 PM Stephen Satchell <list@satchell.net> wrote:

On 8/9/19 4:03 PM, Matthew Petach wrote:

...

...apparently Amazon has become a public utility now?

I look forward with bemusement to the PUC tariff filings for AWS pricing. ^_^;;

[...]

And it wouldn't be the PUC, as Amazon is a company national in scope. It would be something like the FCC. Public Utility Commissions are at the local (usually county) or state level.

That was somewhat the point. Public utilities make some amount of sense when there's a local natural monopoly. With a global company, there's no such thing as a local natural monopoly in play; how would you assign oversight to a global entity? Which "public" would be the ones being protected? The city of Seattle, WA, where Amazon is headquartered? The State of Washington? The United States, at a federal level? What about the "public" that uses Amazon in all the other countries of the world? There's no way to make a global entity a regulated public utility; we don't have an organization that has that level of oversight across country boundaries, unless you start thinking about entities that can enforce *treaties* between countries. And I'm not sure I'd want our Ambassadors being the ones at the table deciding how best to regulate Amazon. :/

[Speaking ONLY FOR MYSELF AS AN INDIVIDUAL.] On Aug 4, 2019, at 8:15 AM, Rubens Kuhl <rubensk@gmail.com> wrote:

On Sun, Aug 4, 2019 at 5:17 AM Scott Christopher <sc@ottie.org> wrote: John Curran wrote:

...

...

As I have noted previously, I have zero doubt in the enforceability of the ARIN registration services agreements in this regard – so please carefully consider proposed policy both from the overall community benefit being sought, and from the implications faced as a number resource holder having to comply oneself with the new obligations.

I completely agree that ARIN can revoke an organization's resources. Nobody has ever doubted that.

What I have been saying is that if ARIN revoked Amazon's resources because of a trivial matter of bounced Abuse PoC, even if the small "community" of network operators and other interested parties passed a rule supporting this, the backlash would be *enormous* and lead to media attention, litigation, police, investigation by U.S. Congress, etc.

The interests of the public affected by a global Amazon/AWS outage would greatly outweigh the rights of this small "community" which would ultimately be stripped away, I'd think.

This is moot, of course, because ARIN would give ample notices and time to Amazon and they would dutifully comply. But the original poster to which I replied invited us to imagine such a situation.

I don't think that "companies with tons of lawyers" should be a factor in making resource allocation policies. But considering either small or big networks, an escalation path would reduce friction and increase overall compliance... for instance, failure to have functioning abuse PoC could lead first to being inegible to receive new resources.

I would love for “companies with tons of lawyers” to be irrelevant to policy creation and implementation. However, ARIN has to exist to enforce policy and support the community. If there is an existential threat to the corporation, e.g. legal risks, that must be taken into account. To be clear, this does not mean a company with lots of lawyers should be allowed to direct policy. ARIN’s policies should and do come from the communities and their elected representatives (the AC). But to say that ARIN should not consider the legal implications goes a bit too far, IMHO. [Reminder: Speaking ONLY FOR MYSELF AS AN INDIVIDUAL.] -- TTFN, patrick

On Tue, 30 Jul 2019 16:02:58 +0300, T�ma Gavrichenkov said:

On Tue, Jul 30, 2019 at 1:20 PM Christoffer Hansen <christoffer@netravnen.de> wrote:

...

Imagine ARIN did a take from RIPE NCC [Policy Proposal Idea?] and a policy came into effect of validating ALL 'OrgAbuseEmail' objects listed in the ARIN database.

Just to be precise, such a policy (2019-04) is still in a discussion phase in RIPE and has already seen significant resistance.

OK, I'll bite. What reasons are they giving for their resistance? (And if known, what are the *real* reasons if different?)

On Wed, Jul 31, 2019 at 3:35 PM Valdis Klētnieks <valdis.kletnieks@vt.edu> wrote:

On Tue, 30 Jul 2019 16:02:58 +0300, Töma Gavrichenkov said:

...

such a policy (2019-04) is still in a discussion phase in RIPE and has already seen significant resistance.

OK, I'll bite. What reasons are they giving for their resistance?

Here's a good place to start: https://ripe78.ripe.net/archives/steno/37/ ^F, "You're done", enjoy! -- Töma

On Tue, Jul 30, 2019 at 04:02:58PM +0300, T??ma Gavrichenkov wrote:

On Tue, Jul 30, 2019 at 1:20 PM Christoffer Hansen <christoffer@netravnen.de> wrote:

...

Imagine ARIN did a take from RIPE NCC [Policy Proposal Idea?] and a policy came into effect of validating ALL 'OrgAbuseEmail' objects listed in the ARIN database.

Just to be precise, such a policy (2019-04) is still in a discussion phase in RIPE and has already seen significant resistance.

You can, however, point fingers at APNIC instead, where pretty much the same policy proposal from the same authors (prop-125) was already implemented in apnic-127-v006 "Internet Number Resource Policies".

I think they will be planning to reach out to ARIN with the same text right after the RIPE process ends this way or another.

Uh, ARIN-2019-5 has been in the ARIN PDP since March of this year. See https://www.arin.net/participate/policy/drafts/2019_5/ Most recent related PPML thread: https://lists.arin.net/pipermail/arin-ppml/2019-July/067241.html Cheers, Joe -- Posted from my personal account - see X-Disclaimer header. Joe Provo / Gweep / Earthling

On 2019-07-30 10:59, Chris Knipe wrote:

On Tue, Jul 30, 2019 at 11:45 AM Scott Christopher <sc@ottie.org> wrote:

...

Dan Hollis wrote:

...

...

...

...

RCPT To:<email-abuse@amazon.com> <<< 550 #5.1.0 Address rejected. 550 5.1.1 <email-abuse@amazon.com>... User unknown DATA <<< 503 #5.5.1 RCPT first

Try jeff@amazon.com

-- S.C.

Then update your ARIN records to reflect that. Fully agree with Dan on this one.

Even if it existed it would just be an autoresponder telling you that your email wasn't read and to go resubmit the report on their website. Maybe they should change it to noreply@amazon.com. Rob

On Wed, 31 Jul 2019 16:36:08 -0000, Richard Williams via NANOG said:

To contact AWS SES about spam or abuse the correct email address is abuse@amazonaws.com

You know that, and I know that, but why doesn't the person at AWS whose job it is to keep the ARIN info correct and up to date know that?

On Jul 31, 2019, at 1:13 PM, Scott Christopher <sc@ottie.org> wrote:

Valdis Klētnieks wrote:

...

On Wed, 31 Jul 2019 16:36:08 -0000, Richard Williams via NANOG said:

...

To contact AWS SES about spam or abuse the correct email address is abuse@amazonaws.com

You know that, and I know that, but why doesn't the person at AWS whose job it is to keep the ARIN info correct and up to date know that?

Because it will get spammed if publicly listed in WHOIS.

Not an excuse. I’m saying this on behalf of ALL the other ASNs that keep their POCs up to date.

On Wed, 2019-07-31 at 23:13 +0300, Scott Christopher wrote:

Because it will get spammed if publicly listed in WHOIS.

I will take that at *least* as ironic as you meant it. b.

On Wed, Jul 31, 2019 at 11:13:48PM +0300, Scott Christopher wrote:

Because it will get spammed if publicly listed in WHOIS.

Yes. It will. Are you telling us that Amazon, with its enormous financial and personnel resources, doesn't have ANYBODY on staff who knows how to properly manage an abuse@ address -- part of which includes dealing with that exact problem? ---rsk

On Thu, Aug 01, 2019 at 12:54:07AM +0300, Scott Christopher wrote:

Rich Kulawiec wrote:

...

On Wed, Jul 31, 2019 at 11:13:48PM +0300, Scott Christopher wrote:

...

Because it will get spammed if publicly listed in WHOIS.

Yes. It will. Are you telling us that Amazon, with its enormous financial and personnel resources, doesn't have ANYBODY on staff who knows how to properly manage an abuse@ address -- part of which includes dealing with that exact problem?

They do, but it's just time-consuming and inefficient. You can't spam-filter the content of abuse@ obviously.

Actually, yes, you can -- but probably not in the way you're thinking, because if you do it *that* way you will break [some of the] required functionality.

But in addition to spam, random (read: non-technical) people will send complaints outside of the usual purview of spam, network abuse, DMCA, etc. They find some FAQ on the web telling them to determine the PoC on whois.domaintools.com and then they start firing crap.

This is not my first day on the job. I'm aware of what shows up at role addresses. However, handling the problems you enumerate here is a straightforward (albeit occasionally tedious) matter that any operations engineer above entry-level should be able to handle. Doubly so because people like me have done them the favor of writing about it (here and elsewhere), so they can use our experience without needing to repeat our numerous mistakes.

I prefer openness and transparency and the general spirit of WHOIS but, in practice, you really do need the limit the PoC information to a trusted group of insiders.

First, there's no such thing as a trusted group of insiders. Second, even if such a group existed, limiting PoC information to them is impossible. Think about it. Third, besides WHOIS PoC, RFC 2142 (and decades of best practices) specify abuse@, postmaster@, etc. My expectation is that anyone equipped with baseline competence will be fully prepared to handle traffic to those addresses (as applicable) effectively at whatever scale their operation requires. ---rsk