[anti-abuse-wg] 2010-08 New Policy Proposal (Abuse contact information)

>> My personal view is this won't solve the main issue. Making IRT
>> mandatory does not improve data quality especially not in the long
>> run. People might just put something in to make things work or they
>> will simply forget to update the object once it's there. I realize
>> there is another proposal floating around to fix this by
>> introducing a regular check. But as these are seperate there is no
>> guarantee both will make it to implementation. And again making it
>> mandatory for people putting stuff in the database, by no means
>> mean people pulling data from the database will start using it. At
>> least not unless you tell them how.

And the how is the big problem on both sides.
What is the right way to publish abuse contact information? remark
field? abuse-mailbox attribute? Or is it the IRT? There are so many
options that nobody really knows how to handle it.

One of my biggest concerns about the existing situation is printed here:
http://bit.ly/a5PNlH

"The total amount of queries the service makes to the RIPE Database may
range between 30 and 150 queries. This depends largely on the amount of
referenced objects the routine has to retrieve."

Needing up to 150 queries to find an abuse contact shows clearly that
there is a huge variety of possible places, which confuses and
frustrates people.

> I think you have highlighted something very important. No policy can
> ensure that network operators deal with abuse reports they don't have
> any interest in reading or resolving. Given that situation, removing
> the mandatory IRT reference makes that group more visible because
> they will have chosen not to create an IRT. This will help people
> reporting abuse as they'll know the operator wouldn't take the
> reports seriously anyway.
> 
> People interested in receiving abuse reports can already indicate
> that fact by creating an IRT object or adding an abuse-mailbox line
> to their maintainer. Making an IRT object mandatory will only enforce
> the form and not the intent. As such, I suspect it would add cost
> without value.

I absolutely agree with that and I can live with that, if we decide to
make the IRT Object the only place where abuse contact information will
be published in future. That means we stop using abuse-mailbox
attributes outside IRT Objects and we communicate that the IRT is the
"only" place to publish abuse contact information.

The next step that will happen, or is already happening is that ISPs are
using the reputation data you are talking about to block, for example
email, which is a pretty good idea in my opinion. "As long as you do not
offer a address where I can complain about your traffic I do not want
your traffic." And as soon as this happens people will create IRT
Objects to get their mail delivered and nobody knows if they are
handling their abuse complaints or just created the IRT Object. BTW: We
are receiving several request about such a reputation list every week.

Thanks,

Tobias

abusix.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 262 bytes
Desc: OpenPGP digital signature
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20101110/62f718f2/attachment.sig>