[anti-abuse-wg] 2011-06 New Policy Proposal (Abuse ContactManagement in the RIPE NCC Database)

Hi,

> On 12/08/11 11:04, Tobias Knecht wrote:
>> If the current system was so obvious to everyone:
>> - why do so many data maintainers put abuse contact details in
>> "remarks:"?
> 
> Until recently, the attribute trouble: existed. Then it was removed and
> moved all the data over to remarks-attribute.
> At the same time, the abuse-mailbox:-attribute was created.
> It is going to take at least another 10 years before all handles are
> updated to this standard.

I think you are partly right. I do not think that this will take 10
years. The clean-up is a major part of this proposal and I think there
will be a lot of opportunities to really clean up things. It could be
easily done to use the same objects that are used for an admin-c as an
abuse-c as long as an abuse-mailbox attribute is given. If this is not
given, maybe one of the higher level ranges has an abuse-c which is
absolutely enough. At the end only direct allocated ranges would need an
abuse-c set, because this would be enough from a policy point of view.

>> - why do so many users send complaints to email addresses found in
>> "notify:" and "changed:" attributes?
> 
> I always send to all emails I can find when contacting unknown companies.
> This is because the data accuracy is not always very good and I don't
> want to waste time resending my email.
> Secondly, it can be difficult to know if tech-c or admin-c should
> receive the mail.
> Adding abuse-c could make it even more difficult to decide. The
> works-all-the-time solution is to send to anyone.

And that is exactly what this proposal should fix.

This will not make it more difficult to decide. If you have an abuse
report you have to use abuse-c in future. There is no questions if you
should use admin-c or tech-c.

If abuse-c is not working you can go up in the hierarchy and/or inform
RIPE NCC if something is really going wrong and data is not accurate.
This will start a process in whcih RIPE NCC will contact the maintainer
and work through with him to get things solved. (Another plus for the
data accuracy)

The data accuracy part can be looked at by the Task Force if wished by
the community as soon as we have consensus on this proposal.

>> - why does anyone use "abuse-mailbox:", which has always been optional,
>> when "admin-c:" has always been available?
> 
> Because the email:-attribute is by default hidden.
> Abuse-mailbox: is the workaround.

Exactly. And this workaround should be pushed into a working solution
and not staying a workaround.

>> - The "admin-c:" has never been defined as an abuse contact. It is not
>> reasonable to assume that everyone who linked an email address to that
>> attribute wants to receive abuse complaints on that address, even if
>> some do.
> 
> That doesn't really matter to me. They are responsible for the resource
> and can redirect my email to the proper person if they are unable to
> answer it.
> Failure to respond is subject to existing ripe policies, although
> probably never practised.

I'm not on the same page with you here. Redirecting complaints kills the
speed of complaints to react fast. And this will end up in bad abuse
handling. Great abuse handling imho is fast in processing and in reaction.

And we are talking here not about 10 or 15 complaints a day. We are
talking about Abuse Departments and abuse mailboxes receiving up to
500.000 messages per day and asking for more.

>> What if the administrative contact is not the place to report abuse to.
>> Just because other companies are different then yours?
>>
> 
> You are correct about that. Admin-c is always the end-user/customer
> (Ripe policy). The abuse-contact is however often an ISP/LIR or a
> comination of one/both/the other depending on the what the issue is.
> An abusive user on a webforum is subject to admin-c while a hacker could
> be subject to the ISP abuse-c.

Abuse departments are there to solve abuse. No matter what kind of
abuse. I do not see a difference in that. Even than while automatic
reporting formats like ARF or X-ARF are used more and more it is easily
possible to redirect complaints from a role-account to the right place.
But is is not easy doable to redirect complaints from a personal email
address to the right place.


Thanks,

Tobias

-- 
abusix

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 307 bytes
Desc: OpenPGP digital signature
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20111208/846368c1/attachment.sig>