[anti-abuse-wg] Abuse Contact Information - Policy Proposal

Hello again,

> But it is not all bad news. We have an Abuse Finder Tool. This is still
> in a pre-production phase and is described on RIPE Labs:
> http://labs.ripe.net/content/updated-heuristics-abuse-finder-service
>
> This service will find "abuse-mailbox:" attributes and related IRT
> objects and "remarks:" attributes that 'look like' they contain a
> reference to an abuse handler for any specified Internet resource. This
> service currently works for RIPE and APNIC resources. To a limited
> extent it also works with AfriNIC's data, but they don't use IRT objects
> or "abuse-mailbox:" so it can only look for "remarks:".
> 
> This service does not return any personal data other than abuse
> contacts. Therefore it is not subject to any access control limits. The
> tool provides 'on demand' access to abuse contacts as many times as you
> wish. This reduces, or in many cases eliminates, the need for access to
> bulk data.

I really love it. This is a really good idea and this might help a lot.

BUT: (sorry I have to ;-)

I found out a few things:

At the moment the XML Webservice is restricted. I was just trying to
penetrate that service a little bit and it shut down after about 15
minutes of excessive usage.

The service might be a little slow to use it without local caching. But
I think that will change in future and with the "real" API.

And last but not least the problem all RIRs have and such a great thing
as the Abuse Finder will not solve the integrity and correctness (not
accuracy).

I have done a test, I was using all 4791 (/8 up to /16) ranges from the
RIPE Database and shot them into the Abuse Finder.

2616 did have a results, which is around 54%
2175 did not have any result, which is around 45%

That problem should be addresses as well. Probably with a Best Practice
Paper.


At the end there are some questions about data output.

For example: 134.61.0.0/16
This range is giving back 2 different addresses. That is absolutely
correct, but does it make sense? This will lead again to frustration of
not knowing which is the right place and correct way to publish abuse
related data.


So I'm still a big fan of the IRT Object, because it is tailor made and
solves all those problems. And probably once there will be a time, were
it is not necessary to offer abuse-mailbox attributes for any other
objects than the IRT and not necessary to use remark fields for abuse
contact publishing and at that time it is not needed to do up to 150
queries for one request at the Abuse Finder.


Thanks Tobias