[acm-tf] Poster on theory of abuse contact management, was Date and time next ACM-TF meeting

Tobias Knecht wrote:
> Hi again,
>
>   
>> Someone mentioned abuse at ripe.net will be put in use, some day.
>> Perhaps, RIPE will just blindly forward reports to the relevant
>> allocation-specific abuse POC, in some cases.  In such cases, the
>> Sender should find the target address directly (and thus optimize the
>> traffic.)  This consideration would suggest a "hierarchical database",
>> in some sense.  To depict it, we may represent a Receiver forwarding a
>> report to a sub-allocation, e.g. an ISP to a customer of theirs.
>>     
>
> I heard discussion about that as well. In theory this might be a good
> idea, but I guess in live this will not be practical.
>   

Just to clarify one point here. The email address abuse at ripe.net is the
abuse mailbox address used by the RIPE NCC as an organisation. This is
for handling any abuse complaints regarding the IP addresses in use by
the RIPE NCC for our own infrastructure. It is not a generalised address
for any abuse processes concerning the RIPE community or RIPE service
region or RIPE NCC Members.

Regards
Denis Walker
Business Analyst
RIPE NCC Database Group

> You can not filter spam on an abuse mailbox, so this would be a nice aim
> for spammers to destroy the idea. And even if we find a way of not
> getting killed by spammers, you will get killed by complaints.
>
> Some of your customers receive far more than 600 to 800 thousands
> complaints a day. abusix is sending more than 2 million complaints every
> day to ip space in the ripe region.
>
> This will come to an end before it really has started. ;-)
>
>   
>>> The abusix "global reporting" is not subscription based. The 
>>> Deutsche Telekom reporting is not, the TDC repoting is not. But we 
>>> usually do not call it feedbackloops.
>>>       
>> AFAIK, the abusix db can be considered a sort of whois digest, rather
>> than independent data.  Dunno about the other two.  Shall we depict
>> multiple databases?
>>     
>
> They are using our DB. More than 300 different IPs per day query our
> caching database. So this shows that there is need for an official abuse
> contact phonebook and not a not complete phonebook by abusix ;-)
>
>   
>>> Or is your definition of a feedbackloop just reporting abusive
>>> behavior back to its source?
>>>       
>> Yeah, sort of.  I never saw a formal definition, but IMHO it should
>> provide for reaching the original source --the author-- of a reported
>> message, in some cases.
>>     
>
> Ah okay, than I got it. I was just to deep into my jargon that I didn't
> get it.
>
>
>